Skip to content

Commit b372e8b

Browse files
mayeutmayeut
committed
clean-up
1 parent ad4c251 commit b372e8b

File tree

1 file changed

+35
-23
lines changed

1 file changed

+35
-23
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 35 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,12 @@ on:
1414
tags:
1515
- "v*.*.*.*"
1616

17+
concurrency:
18+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
19+
cancel-in-progress: true
20+
21+
permissions: {}
22+
1723
jobs:
1824
build_bootstrap_image:
1925
name: Build x86_64 bootstrap image
@@ -28,31 +34,33 @@ jobs:
2834
id: llvm-version
2935
run: echo "version=$(cat llvm-version)" >> $GITHUB_OUTPUT
3036
- name: Set up Docker Buildx
31-
uses: docker/setup-buildx-action@v3
37+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
3238
id: setup-buildx
3339
- name: Cache Docker layers
3440
uses: actions/cache@v5
3541
with:
3642
path: .cache/buildx-x86_64-bootstrap
37-
key: buildx-x86_64-bootstrap-${{ github.sha }}
43+
key: buildx-x86_64-bootstrap-${{ github.sha }}-${{ github.ref_type }}
3844
restore-keys: |
45+
buildx-x86_64-bootstrap-${{ github.sha }}
3946
buildx-x86_64-bootstrap
47+
lookup-only: ${{ github.ref_type == 'tag' }} # zizmor: ignore[cache-poisoning]
4048
- name: Cache Docker cache mounts
4149
if: ${{ github.ref_type != 'tag' }}
42-
uses: actions/cache@v5
50+
uses: actions/cache@v5 # zizmor: ignore[cache-poisoning]
4351
with:
4452
path: .cache/buildx-x86_64-bootstrap-cache-mounts
4553
key: buildx-x86_64-bootstrap-cache-mounts-${{ github.sha }}
4654
restore-keys: |
4755
buildx-x86_64-bootstrap-cache-mount
4856
- name: Restore Docker cache mounts
4957
if: ${{ github.ref_type != 'tag' }}
50-
uses: reproducible-containers/buildkit-cache-dance@v3
58+
uses: reproducible-containers/buildkit-cache-dance@5b81f4d29dc8397a7d341dba3aeecc7ec54d6361 # v3.3.0
5159
with:
5260
builder: ${{ steps.setup-buildx.outputs.name }}
5361
cache-dir: .cache/buildx-x86_64-bootstrap-cache-mounts
5462
- name: Build image
55-
uses: docker/build-push-action@v6
63+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
5664
with:
5765
context: .
5866
platforms: linux/amd64
@@ -69,13 +77,14 @@ jobs:
6977
# https://github.com/moby/buildkit/issues/1896
7078
run: |
7179
rm -rf .cache/buildx-x86_64-bootstrap || true
72-
mv ${{ runner.temp }}/.buildx-cache-new .cache/buildx-x86_64-bootstrap
80+
mv "${RUNNER_TEMP}/.buildx-cache-new" .cache/buildx-x86_64-bootstrap
81+
7382
build_image:
7483
name: Build ${{ matrix.platform }} image
7584
needs: [build_bootstrap_image]
7685
runs-on: ubuntu-latest
7786
permissions:
78-
packages: write
87+
packages: write # push to ghcr.io
7988
contents: read
8089
strategy:
8190
fail-fast: false
@@ -101,21 +110,22 @@ jobs:
101110

102111
- name: Set up QEMU
103112
if: matrix.platform != 'amd64'
104-
uses: docker/setup-qemu-action@v3
113+
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
105114

106115
- name: Set up Docker Buildx
107-
uses: docker/setup-buildx-action@v3
116+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
117+
id: setup-buildx
108118

109119
- name: Restore bootstrap cache
110120
uses: actions/cache/restore@v5
111121
with:
112122
path: .cache/buildx-x86_64-bootstrap
113-
key: buildx-x86_64-bootstrap-${{ github.sha }}
123+
key: buildx-x86_64-bootstrap-${{ github.sha }}-${{ github.ref_type }}
114124
fail-on-cache-miss: true
115125

116126
- name: Cache Docker cache mounts
117127
if: ${{ github.ref_type != 'tag' }}
118-
uses: actions/cache@v5
128+
uses: actions/cache@v5 # zizmor: ignore[cache-poisoning]
119129
with:
120130
path: .cache/buildx-${{ matrix.platform }}-cache-mounts
121131
key: buildx-${{ matrix.platform }}-cache-mounts-${{ github.sha }}
@@ -124,13 +134,13 @@ jobs:
124134
125135
- name: Restore Docker cache mounts
126136
if: ${{ github.ref_type != 'tag' }}
127-
uses: reproducible-containers/buildkit-cache-dance@v3
137+
uses: reproducible-containers/buildkit-cache-dance@5b81f4d29dc8397a7d341dba3aeecc7ec54d6361 # v3.3.0
128138
with:
129139
builder: ${{ steps.setup-buildx.outputs.name }}
130140
cache-dir: .cache/buildx-${{ matrix.platform }}-cache-mounts
131141

132142
- name: Build image
133-
uses: docker/build-push-action@v6
143+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
134144
with:
135145
context: .
136146
platforms: linux/${{ matrix.platform }}
@@ -143,7 +153,9 @@ jobs:
143153
cache-from: type=local,src=${{ github.workspace }}/.cache/buildx-x86_64-bootstrap
144154

145155
- name: Prepare Archive
146-
run: tar cf - -C binaries/opt --owner 0 --group 0 clang | xz -9e -T0 > binaries/static-clang-linux-${{ matrix.platform }}.tar.xz
156+
run: tar cf - -C binaries/opt --owner 0 --group 0 clang | xz -9e -T0 > "binaries/static-clang-linux-${MATRIX_PLATFORM}.tar.xz"
157+
env:
158+
MATRIX_PLATFORM: ${{ matrix.platform }}
147159

148160
# TODO add some basic tests here
149161

@@ -156,7 +168,7 @@ jobs:
156168

157169
- name: Login to GitHub Container Registry
158170
if: github.event_name == 'push'
159-
uses: docker/login-action@v3
171+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
160172
with:
161173
registry: ghcr.io
162174
username: ${{ github.actor }}
@@ -165,7 +177,7 @@ jobs:
165177
- name: Push image by digest
166178
if: github.event_name == 'push'
167179
id: build
168-
uses: docker/build-push-action@v6
180+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
169181
with:
170182
context: .
171183
platforms: linux/${{ matrix.platform }}
@@ -195,7 +207,7 @@ jobs:
195207
if: github.event_name == 'push'
196208
runs-on: ubuntu-latest
197209
permissions:
198-
packages: write
210+
packages: write # push to ghcr.io
199211
contents: read
200212
needs:
201213
- build_image
@@ -212,11 +224,11 @@ jobs:
212224
merge-multiple: true
213225

214226
- name: Set up Docker Buildx
215-
uses: docker/setup-buildx-action@v3
227+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
216228

217229
- name: Docker meta
218230
id: meta
219-
uses: docker/metadata-action@v5
231+
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
220232
with:
221233
images: ghcr.io/${{ github.repository_owner }}/static-clang
222234
tags: |
@@ -227,7 +239,7 @@ jobs:
227239
type=pep440,pattern={{major}}
228240
229241
- name: Login to GitHub Container Registry
230-
uses: docker/login-action@v3
242+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
231243
with:
232244
registry: ghcr.io
233245
username: ${{ github.actor }}
@@ -237,14 +249,14 @@ jobs:
237249
working-directory: /tmp/digests
238250
run: |
239251
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
240-
$(printf 'ghcr.io/${{ github.repository_owner }}/static-clang@sha256:%s ' *)
252+
$(printf "ghcr.io/${GITHUB_REPOSITORY_OWNER}/static-clang@sha256:%s " *)
241253
242254
release:
243255
name: Release
244256
if: github.ref_type == 'tag'
245257
runs-on: ubuntu-latest
246258
permissions:
247-
contents: write
259+
contents: write # create release
248260
needs:
249261
- build_image
250262
steps:
@@ -267,6 +279,6 @@ jobs:
267279
run: cat binaries/sha256sums.txt
268280

269281
- name: Release
270-
uses: softprops/action-gh-release@v2
282+
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
271283
with:
272284
files: 'binaries/*'

0 commit comments

Comments
 (0)