mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-11-15 15:58:10 +00:00
Chandler Carruth
9f2f906b85
Suggested edits don't work well for dependabot, and this is a case where it's especially useful to have the fixes automatically applied. So this creates a dependabot-specific flow that directly commits the fixes rather than merely attaching them as suggested edits. Because this directly commits the fixes, it also adds some restrictive filtering to only apply fixes that are edits to existing non-binary files, and files outside of `.github/`. The intent here is to minimize the risk, as the changes suggested are from a just-updated `prek` run. Also adds some extra safety to the `tests` action by omitting a secret there -- it isn't needed anyways. And it pins an additional version. Assisted-by: Antigravity with Opus
Workflows
Hardening
Workflows are hardened using Step Security tool. Findings for the "Harden Runner" steps are available online.
Allowed endpoints
Most jobs only have a few endpoints, but due to tools which do downloads, a few have significantly more. These are:
- clangd_tidy.yaml (Bazel)
- prek.yaml (Bazel, prek)
- nightly_release.yaml (Bazel)
- tests.yaml (Bazel)
When updating one of these, consider updating all of them.
We try to keep allowed-endpoints with one per line. Prettier wants to wrap
them, which we fix this with prettier-ignore.
Testing
We keep around an action-test branch in carbon-lang, which can be used to test
triggers with push: configurations. For example:
on:
push:
branches: [action-test]