mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-10-03 16:46:02 +01:00
Chandler Carruth
76dd872ab4
This provides a native harness with several advantages over
`pre-commit`:
- Faster when initializing the cache
- Smaller cache sizes: under 43mb compared to over 62mb
- Better integration with `uv` for Python usage
Steps for migrating for existing contributors:
1. Install `prek` following instructions in the updated docs.
2. Replace hooks in an existing checkout with a special flag:
```sh
prek install --overwrite
```
The `--overwrite` flag is what removes the old hooks.
If you used the pre-push variant:
```sh
prek install --hook-type pre-push --overwrite
```
3. Optional cleanups:
```sh
rm -rf ~/.cache/pre-commit # reclaim the old hook-environment cache
pipx uninstall pre-commit # if installed via pipx; or `brew uninstall
pre-commit`
```
Assisted-by: Antigravity with Gemini
41 lines
1.1 KiB
Markdown
41 lines
1.1 KiB
Markdown
# Workflows
|
|
|
|
<!--
|
|
Part of the Carbon Language project, under the Apache License v2.0 with LLVM
|
|
Exceptions. See /LICENSE for license information.
|
|
SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
-->
|
|
|
|
## Hardening
|
|
|
|
Workflows are hardened using
|
|
[Step Security tool](https://app.stepsecurity.io/secureworkflow). Findings for
|
|
the "Harden Runner" steps are
|
|
[available online](https://app.stepsecurity.io/github/carbon-language/carbon-lang/actions/runs).
|
|
|
|
### Allowed endpoints
|
|
|
|
Most jobs only have a few endpoints, but due to tools which do downloads, a few
|
|
have significantly more. These are:
|
|
|
|
- clangd_tidy.yaml (Bazel)
|
|
- prek.yaml (Bazel, prek)
|
|
- nightly_release.yaml (Bazel)
|
|
- tests.yaml (Bazel)
|
|
|
|
When updating one of these, consider updating all of them.
|
|
|
|
We try to keep `allowed-endpoints` with one per line. Prettier wants to wrap
|
|
them, which we fix this with `prettier-ignore`.
|
|
|
|
## Testing
|
|
|
|
We keep around an `action-test` branch in carbon-lang, which can be used to test
|
|
triggers with `push:` configurations. For example:
|
|
|
|
```
|
|
on:
|
|
push:
|
|
branches: [action-test]
|
|
```
|