mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-09-24 19:20:13 +01:00
Jon Ross-Perkins
da99b940f5
What I'm trying to fix is visible at: - PR: https://github.com/carbon-language/carbon-lang/pull/5779 - clangd-tidy run on merge: https://github.com/carbon-language/carbon-lang/actions/runs/16155546033/job/45597095935 - Merge attempt: https://github.com/carbon-language/carbon-lang/pull/5779#event-18534768919 That PR deletes block_value_store, so excluding deleted files here (`added|modified`). But also, I think this is blocking merge just because it's set for merge_group. Or it may be because of the clang-tidy job name overlap -- I'm just going to address both. Also trying to remove the base commit; I think dorny/paths-filter should actually be calculating this reasonably well, and it was holdover from where we set the commit explicitly elsewhere. There's a warning about it being ignored in pull_request, visible [here](https://github.com/carbon-language/carbon-lang/actions/runs/16155814211/job/45597903684).
Workflows
Hardening
Workflows are hardened using Step Security tool. Findings for the "Harden Runner" steps are available online.
Allowed endpoints
Most jobs only have a few endpoints, but due to tools which do downloads, a few have significantly more. These are:
- pre_commit.yaml (Bazel, pre-commit)
- nightly_release.yaml (Bazel)
- tests.yaml (Bazel)
When updating one of these, consider updating all of them.
We try to keep allowed-endpoints with one per line. Prettier wants to wrap
them, which we fix this with prettier-ignore.
Testing
We keep around an action-test branch in carbon-lang, which can be used to test
triggers with push: configurations. For example:
on:
push:
branches: [action-test]