mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-11-10 12:28:25 +00:00
Chandler Carruth
a1305604f2
Newer versions of `protobuf` depend on Rust to a limited extent. Builds don't use it, and _our_ builds rarely even touch on `protobuf`. But the way CI was running `bazel mod` commands in `action.yml` forced fully evaluating all the module extensions, including Rust. This ends up both hitting end points we didn't allow and being really expensive. We can skip that and keep the more targeted `cquery` that doesn't do anything beyond what our builds need. We also still have a test that the lock file is accurate, so we don't lose any coverage here, it just makes things faster. That said, we _do_ want to be able to hit the Rust dependency if and where we (transitively) need it, and we'll at least need our `prek` checks to be able to resolve them and rebuilding the lock file after an update, so the relevant end points are added to our hardened runner as allowed. The second issue is that `rules_python` in version 2.0 and newer is using a Bazel feature we disable. There is an escape hatch though that we can enable in our `.bazelrc` so it keeps working, and that works even with the current version. Once this lands, the Dependabot update of the Bazel module versions should be able to make more progress. Assisted-by: Antigravity with Claude Opus
96 lines
3.1 KiB
YAML
96 lines
3.1 KiB
YAML
# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
|
|
# Exceptions. See /LICENSE for license information.
|
|
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
|
|
name: 'Clang Tidy (clangd)'
|
|
|
|
on:
|
|
push:
|
|
branches: [trunk, action-test]
|
|
pull_request:
|
|
merge_group:
|
|
|
|
permissions:
|
|
contents: read # For actions/checkout.
|
|
pull-requests: read # For dorny/paths-filter to read pull requests.
|
|
|
|
# Cancel previous workflows on the PR when there are multiple fast commits.
|
|
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#concurrency
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
clangd-tidy:
|
|
runs-on: ubuntu-22.04
|
|
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
|
|
with:
|
|
egress-policy: block
|
|
# When adding endpoints, see README.md.
|
|
# prettier-ignore
|
|
allowed-endpoints: >
|
|
*.blob.storage.azure.net:443
|
|
*.githubapp.com:443
|
|
*.sourceforge.net:443
|
|
api.github.com:443
|
|
api.ipify.org:443
|
|
bcr.bazel.build:443
|
|
download.gnome.org:443
|
|
downloads.sourceforge.net:443
|
|
files.pythonhosted.org:443
|
|
formulae.brew.sh:443
|
|
github.com:443
|
|
go.dev:443
|
|
index.crates.io:443
|
|
mirror.bazel.build:443
|
|
mirrors.kernel.org:443
|
|
nodejs.org:443
|
|
oauth2.googleapis.com:443
|
|
objects.githubusercontent.com:443
|
|
pkg-containers.githubusercontent.com:443
|
|
pypi.org:443
|
|
raw.githubusercontent.com:443
|
|
registry.npmjs.org:443
|
|
release-assets.githubusercontent.com:443
|
|
releases.astral.sh:443
|
|
releases.bazel.build:443
|
|
static.crates.io:443
|
|
static.rust-lang.org:443
|
|
storage.googleapis.com:443
|
|
uploads.github.com:443
|
|
www.googleapis.com:443
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- id: filter
|
|
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
|
|
with:
|
|
predicate-quantifier: 'every'
|
|
filters: |
|
|
has_cpp:
|
|
- added|modified: '{**/*.cpp,**/*.h}'
|
|
- '!**/*.tpl.h'
|
|
list-files: 'shell'
|
|
|
|
- uses: ./.github/actions/build-setup-common
|
|
if: steps.filter.outputs.has_cpp == 'true'
|
|
with:
|
|
matrix_runner: 'ubuntu-22.04'
|
|
remote_cache_upload: '--remote_upload_local_results=false'
|
|
|
|
- name: Create compile commands
|
|
if: steps.filter.outputs.has_cpp == 'true'
|
|
run: ./scripts/create_compdb.py
|
|
|
|
- name: Run clangd-tidy
|
|
if: steps.filter.outputs.has_cpp == 'true'
|
|
env:
|
|
FILTER_FILES: ${{ steps.filter.outputs.has_cpp_files }}
|
|
run: |
|
|
uvx --with clangd-tidy==1.1.0.post2 clangd-tidy -p . -j 10 $FILTER_FILES
|