feature(ci): check advisories when they change

Author: blackheaven

.github/workflows/check-advisories-standalone.yml

@@ -0,0 +1,37 @@
+name: Check advisories standalone
+on:
+  - push
+  - pull_request
+jobs:
+  tools_changed:
+    continue-on-error: true
+    runs-on: ubuntu-22.04
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+    steps:
+      - id: skip_check
+        uses: fkirc/skip-duplicate-actions@master
+        with:
+          concurrent_skipping: "never"
+          skip_after_successful_duplicate: "true"
+          paths: '["code/**"]'
+  advisories_changed:
+    continue-on-error: true
+    runs-on: ubuntu-22.04
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+    steps:
+      - id: skip_check
+        uses: fkirc/skip-duplicate-actions@master
+        with:
+          concurrent_skipping: "never"
+          skip_after_successful_duplicate: "true"
+          paths: '["advisories/**"]'
+          do_not_skip: '["push", "workflow_dispatch", "schedule"]'
+  check-advisories:
+    name: Invoke check-advisories workflow
+    needs: [tools_changed, advisories_changed]
+    if: ${{ needs.tools_changed.outputs.should_skip == 'true'  && needs.advisories_changed.outputs.should_skip != 'true' }}
+    uses: ./.github/workflows/check-advisories.yml
+    with:
+      artifact-name: hsec-tools-main

.github/workflows/nix.yml

@@ -34,8 +34,10 @@ jobs:
           flake-lock-path: ./code/hsec-tools/flake.lock
       - run: nix -L build
         working-directory: ./code/hsec-tools
+      - run: mkdir -p ~/.local/bin
+      - run: cp code/hsec-tools/result/bin/hsec-tools ~/.local/bin
       - uses: actions/upload-artifact@v3
         if: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
         with:
           name: hsec-tools-main
-          path: code/hsec-tools/result/bin/hsec-tools
+          path: ~/.local/bin