mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-11-10 12:28:25 +00:00
Chandler Carruth
a1305604f2
Newer versions of `protobuf` depend on Rust to a limited extent. Builds don't use it, and _our_ builds rarely even touch on `protobuf`. But the way CI was running `bazel mod` commands in `action.yml` forced fully evaluating all the module extensions, including Rust. This ends up both hitting end points we didn't allow and being really expensive. We can skip that and keep the more targeted `cquery` that doesn't do anything beyond what our builds need. We also still have a test that the lock file is accurate, so we don't lose any coverage here, it just makes things faster. That said, we _do_ want to be able to hit the Rust dependency if and where we (transitively) need it, and we'll at least need our `prek` checks to be able to resolve them and rebuilding the lock file after an update, so the relevant end points are added to our hardened runner as allowed. The second issue is that `rules_python` in version 2.0 and newer is using a Bazel feature we disable. There is an escape hatch though that we can enable in our `.bazelrc` so it keeps working, and that works even with the current version. Once this lands, the Dependabot update of the Bazel module versions should be able to make more progress. Assisted-by: Antigravity with Claude Opus
87 lines
2.9 KiB
YAML
87 lines
2.9 KiB
YAML
# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
|
|
# Exceptions. See /LICENSE for license information.
|
|
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
|
|
name: prek
|
|
|
|
on:
|
|
pull_request:
|
|
merge_group:
|
|
push:
|
|
branches: [trunk]
|
|
|
|
permissions:
|
|
contents: read # For actions/checkout.
|
|
|
|
jobs:
|
|
prek:
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
|
|
with:
|
|
egress-policy: block
|
|
# When adding endpoints, see README.md.
|
|
# prettier-ignore
|
|
allowed-endpoints: >
|
|
*.blob.storage.azure.net:443
|
|
*.githubapp.com:443
|
|
*.sourceforge.net:443
|
|
api.github.com:443
|
|
api.ipify.org:443
|
|
bcr.bazel.build:443
|
|
download.gnome.org:443
|
|
downloads.sourceforge.net:443
|
|
files.pythonhosted.org:443
|
|
formulae.brew.sh:443
|
|
github.com:443
|
|
go.dev:443
|
|
index.crates.io:443
|
|
mirror.bazel.build:443
|
|
mirrors.kernel.org:443
|
|
nodejs.org:443
|
|
oauth2.googleapis.com:443
|
|
objects.githubusercontent.com:443
|
|
pkg-containers.githubusercontent.com:443
|
|
pypi.org:443
|
|
raw.githubusercontent.com:443
|
|
registry.npmjs.org:443
|
|
release-assets.githubusercontent.com:443
|
|
releases.astral.sh:443
|
|
releases.bazel.build:443
|
|
static.crates.io:443
|
|
static.rust-lang.org:443
|
|
storage.googleapis.com:443
|
|
uploads.github.com:443
|
|
www.googleapis.com:443
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
# Ensure LLVM is set up consistently.
|
|
- uses: ./.github/actions/build-setup-common
|
|
with:
|
|
matrix_runner: ubuntu-22.04
|
|
remote_cache_upload: '--remote_upload_local_results=false'
|
|
|
|
- uses: j178/prek-action@44924fe9ef4a6f88253c4b6b1bf11c689d3ce53d # v3.1.0
|
|
|
|
# We want to automatically create github suggestions for prek file
|
|
# changes for a pull request. But `pull_request` actions never have write
|
|
# permissions to the repository, so we create the suggestions (or, for
|
|
# Dependabot PRs, commit the fixes) in a separate privileged `workflow_run`
|
|
# action in prek_suggestions.yaml. Here, we upload the diffs and event
|
|
# configuration to an artifact for use by that action.
|
|
- name: Collect prek output
|
|
if: failure()
|
|
run: |
|
|
mkdir -p prek-output
|
|
git diff > prek-output/diff
|
|
cp $GITHUB_EVENT_PATH prek-output/event
|
|
- uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
if: failure()
|
|
with:
|
|
name: prek output
|
|
path: prek-output/*
|