mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-11-15 12:48:30 +00:00
Chandler Carruth
c0eee3e0bd
2.22.3 appears to fix blocking legitimate connections to GitHub infrastructure, which aligns with numerous flakes we've seen in our actions recently. There is also a fix to `prek`'s configuration to allow a URL that we already allow in other workflows. I'm also looking at how to automate all af this. Assisted-by: Antigravity with Opus
Workflows
Hardening
Workflows are hardened using Step Security tool. Findings for the "Harden Runner" steps are available online.
Allowed endpoints
Most jobs only have a few endpoints, but due to tools which do downloads, a few have significantly more. These are:
- clangd_tidy.yaml (Bazel)
- prek.yaml (Bazel, prek)
- nightly_release.yaml (Bazel)
- tests.yaml (Bazel)
When updating one of these, consider updating all of them.
We try to keep allowed-endpoints with one per line. Prettier wants to wrap
them, which we fix this with prettier-ignore.
Testing
We keep around an action-test branch in carbon-lang, which can be used to test
triggers with push: configurations. For example:
on:
push:
branches: [action-test]