Skip to content

Commit 636640d

Browse files
rjaegersrjaegers
authored
Merge branch 'main' into feature/add-first-run-notice
Signed-off-by: Ron <[email protected]>
2 parents a30a501 + 3bd04a5 commit 636640d

25 files changed

+206
-227
lines changed

‎.devcontainer/cpp/apt-requirements-base.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"ca-certificates": "20240203",
44
"g++-14": "14.2.0-4ubuntu2~24.04",
55
"gdb-multiarch": "15.0.50.20240403-0ubuntu1",
6-
"git": "1:2.43.0-1ubuntu7.1",
6+
"git": "1:2.43.0-1ubuntu7.2",
77
"gnupg2": "2.4.4-2ubuntu17",
88
"ninja-build": "1.11.1-2",
99
"python3-pip": "24.0+dfsg-1ubuntu1.1",

‎.devcontainer/cpp/devcontainer-metadata-vscode.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@
1111
"[email protected]",
1212
"[email protected]",
1313
"[email protected]",
14-
"[email protected].5941",
15-
"sonarsource.sonarlint-vscode@4.14.1"
14+
"[email protected].5948",
15+
"sonarsource.sonarlint-vscode@4.15.0"
1616
],
1717
"settings": {
1818
"C_Cpp.intelliSenseEngine": "disabled",

‎.devcontainer/cpp/requirements.in‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
cmake==3.31.2
1+
cmake==3.31.4
22
conan==2.11.0
3-
gcovr==8.2
3+
gcovr==8.3

‎.devcontainer/cpp/requirements.txt‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -115,26 +115,26 @@ charset-normalizer==3.4.0 \
115115
--hash=sha256:fe9f97feb71aa9896b81973a7bbada8c49501dc73e58a10fcef6663af95e5079 \
116116
--hash=sha256:ffc519621dce0c767e96b9c53f09c5d215578e10b02c285809f76509a3931482
117117
# via requests
118-
cmake==3.31.2 \
119-
--hash=sha256:09b3b1c919c76d25272bd9a0f15baf954d6c883abffdd1cfb3fbf1afa7a2c556 \
120-
--hash=sha256:16a323fcbb86cf8a10aea82cd4deecb33edb3ed7e8907be8a06933ce04f6e6d1 \
121-
--hash=sha256:2988aac62b9ada74bb802a8065ea58abe57bf203c057bb7e0456c3575a89c48a \
122-
--hash=sha256:31aaa73c6bf49109b2a7ab86b3e6887b5db0da6be30ddfb30bed160b84787f89 \
123-
--hash=sha256:378036396394dad7673cdfc603bb85af34945607df43e8dad731f5907c755f3b \
124-
--hash=sha256:3bd054996b8a36ff5beb3cdd0ffbf8edf23d719cf946762662a9fb70525b1d1b \
125-
--hash=sha256:604c44684dbcbec1458310bd57b9e69b7768ddd7cd2fc852607ca24616f34518 \
126-
--hash=sha256:79b7eb78aea04e363a736e544afc4b4489f50415075bd77131e5314778b8e879 \
127-
--hash=sha256:7b5f4f5ec4b0d6275369881a2a7bf7230af1cb60afdb20a7b2fbc70690f13564 \
128-
--hash=sha256:8210a40d5b08bec7c752974f2b217a062a092480e33dcbd39d46a8cd96c29ddc \
129-
--hash=sha256:82ec0a96b965874dc793ed6d3aa7edad6f364d4ba8b86307548bfbbca70fd2dd \
130-
--hash=sha256:8c1fa50cafe54f9aa074d03cda1ade54271039d939194adc9cd1ac388b1af055 \
131-
--hash=sha256:8d8c840502f84a16562820ee23f963583953939de63a9582f0f7735868cd18e6 \
132-
--hash=sha256:994e14f485329d58d316487bd1759ad89717b895079e8b892a8220f03c1c5267 \
133-
--hash=sha256:aec014f19536f2b6b0a94f4e20990c28fb93c4bdf9193d57fa5e50ef829aaf78 \
134-
--hash=sha256:c8f9d7f8371a6739bbec7c238d213877f31b22a10930c91dea59b8b9463b6ee1 \
135-
--hash=sha256:cedb6de320a65ff0137e5c6090b9b7fba459788237d3d4deb6e66be19fe9b61d \
136-
--hash=sha256:e8fc23d376b3fae8945067f397d8503fff210eefe1e49ab9ece1d99a88679cf4 \
137-
--hash=sha256:fa3b23b8bd52c0ae9e3c6b635ac8ee70d8f35d24bacf39cc4cea22aec6e4ed84
118+
cmake==3.31.4 \
119+
--hash=sha256:20be7cdb41903edf85e8a498c4beff8d6854acbb087abfb07c362c738bdf0018 \
120+
--hash=sha256:225d9a643b0b60ffce0399ff0cabd7a4820e0dbcb794e97d3aacfcf7c0589ae6 \
121+
--hash=sha256:23781e17563693a68b0cef85749746894b8a61488e56e96fc6649b73652e8236 \
122+
--hash=sha256:25c5094394f0cee21130b5678e5b4552f72470e266df6d6fb1d5c505100f0eaa \
123+
--hash=sha256:2a37be93534df04513f0845492d71bc80899c3f87b77e3b01c95aff1a7fc9bde \
124+
--hash=sha256:466c9295af440bb4a47cc5e1af10576cf2227620528afd0fd0b3effa1d513b49 \
125+
--hash=sha256:838a388b559137f3654d8cf30f62bbdec10f8d1c3624f0d289614d33cdf4fba1 \
126+
--hash=sha256:89143a5e2a5916061f2cfc5012e9fe6281aaf7c0dae7930bdc68d105d22ddc39 \
127+
--hash=sha256:926d91cae2ba7d2f3df857d0fc066bdac4f3904bf5c95e99b60435e85aabedb4 \
128+
--hash=sha256:929a8d8d289d69e43784661748ddd08933ce1ec5db8f9bcfce6ee817a48f8787 \
129+
--hash=sha256:9479a9255197c49e135df039d8484c69aa63158a06ae9c2d0eb939da2f0f7dff \
130+
--hash=sha256:a6a3b0b9557f41c955a6b25c94205f2ca9c3a46edca809ad87507c5ef6bc4274 \
131+
--hash=sha256:a6ac2242e0b16ad7d94c9f8572d6f232e6169747be50e5cdf497f206c4819ce1 \
132+
--hash=sha256:b463efdf5b92f3b290235aa9f8da092b3dac19b7636c563fd156022dab580649 \
133+
--hash=sha256:c9f5f8289c5e7bd2ed654cbac164021fa7723064fee0443a2f0068bc08413d81 \
134+
--hash=sha256:d378c9e58eac906bddafd673c7571262dcd5a9946bb1e8f9e3902572a8fa95ca \
135+
--hash=sha256:f6af3b83a1b1fc1d990d18b6a566ee9c95c0393f986c6df15f2505dda8ad1bcc \
136+
--hash=sha256:f96127bf663168accd29d5a50ee68ea80f26bcd37f96c7a14ef2378781f19936 \
137+
--hash=sha256:fc048b4b70facd16699a43c737f6782b4eff56e8e6093090db5979532d9db0f6
138138
# via -r cpp/requirements.in
139139
colorama==0.4.6 \
140140
--hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
@@ -155,9 +155,9 @@ fasteners==0.19 \
155155
--hash=sha256:758819cb5d94cdedf4e836988b74de396ceacb8e2794d21f82d131fd9ee77237 \
156156
--hash=sha256:b4f37c3ac52d8a445af3a66bce57b33b5e90b97c696b7b984f530cf8f0ded09c
157157
# via conan
158-
gcovr==8.2 \
159-
--hash=sha256:9a1dddd4585d13ec77555db5d6b6a31ee81587ea6fc604ff9fcd232cb0782df5 \
160-
--hash=sha256:bee23da2198bc1e0b9d0109018b9460df52355372319b5ddf81aca4e54f6bd61
158+
gcovr==8.3 \
159+
--hash=sha256:d613a90aeea967b4972fbff69587bf8995ee3cd80df2556983b73141f30642d2 \
160+
--hash=sha256:faa371f9c4a7f78c9800da655107d4f99f04b718d1c0d9f48cafdcbef0049079
161161
# via -r cpp/requirements.in
162162
idna==3.10 \
163163
--hash=sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9 \

‎.devcontainer/rust/Dockerfile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
FROM ubuntu:24.04@sha256:80dd3c3b9c6cecb9f1667e9290b3bc61b78c2678c02cbdae5f0fea92cc6734ab
22

33
ARG BATS_VERSION=1.11.0
4-
ARG CARGO_BINSTALL_VERSION=1.10.8
5-
ARG RUST_VERSION=1.81.0
4+
ARG CARGO_BINSTALL_VERSION=1.10.22
5+
ARG RUST_VERSION=1.84.0
66

77
ARG DEBIAN_FRONTEND=noninteractive
88

@@ -47,9 +47,9 @@ RUN update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-14 20 \
4747
ENV BINSTALL_DISABLE_TELEMETRY=true
4848
# Install additional rust tools
4949
RUN wget -qO - "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-$(uname -m)-unknown-linux-gnu.tgz" | tar xz -C "/usr/bin" \
50-
&& cargo-binstall -y --locked [email protected] cargo-mutants@24.9.0 [email protected].9 \
50+
&& cargo-binstall -y --locked [email protected] cargo-mutants@25.0.0 [email protected].10 \
5151
# cargo-binstall can't (yet) install probe-rs-tools for aarch64, fall-back to script installation
52-
&& wget -qO - https://github.com/probe-rs/probe-rs/releases/download/v0.24.0/probe-rs-tools-installer.sh | sh
52+
&& wget -qO - https://github.com/probe-rs/probe-rs/releases/download/v0.26.0/probe-rs-tools-installer.sh | sh
5353

5454
COPY .devcontainer/rust/first-run-notice.txt /usr/local/etc/vscode-dev-containers/first-run-notice.txt
5555
RUN sed -i '/^<!--/d' /usr/local/etc/vscode-dev-containers/first-run-notice.txt

‎.devcontainer/rust/apt-requirements-base.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"bash-completion": "1:2.11-8",
33
"ca-certificates": "20240203",
44
"g++-14": "14.2.0-4ubuntu2~24.04",
5-
"git": "1:2.43.0-1ubuntu7.1",
5+
"git": "1:2.43.0-1ubuntu7.2",
66
"gnupg2": "2.4.4-2ubuntu17",
77
"libc6-dev": "2.39-0ubuntu8.3",
88
"rustup": "1.26.0-5build1",

‎.devcontainer/rust/devcontainer-metadata-vscode.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
"vscode": {
77
"extensions": [
88
"[email protected]",
9-
"[email protected].5941",
10-
"[email protected].2237",
9+
"[email protected].5948",
10+
"[email protected].2273",
1111
"[email protected]",
1212
"[email protected]"
1313
]

‎.github/workflows/acceptance-test.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
test:
2020
runs-on: ubuntu-latest
2121
steps:
22-
- uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v9.0.1
22+
- uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
2323
with:
2424
egress-policy: audit
2525
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -35,7 +35,7 @@ jobs:
3535
env:
3636
GH_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
3737
HEAD_REF: ${{ github.head_ref }}
38-
- uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
38+
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
3939
with:
4040
node-version: 20
4141
- run: npm ci
@@ -68,7 +68,7 @@ jobs:
6868
GITHUB_USER: ${{ secrets.TEST_GITHUB_USER }}
6969
GITHUB_PASSWORD: ${{ secrets.TEST_GITHUB_PASSWORD }}
7070
GITHUB_TOTP_SECRET: ${{ secrets.TEST_GITHUB_TOTP_SECRET }}
71-
- uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
71+
- uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
7272
if: always()
7373
with:
7474
name: playwright-artifacts

‎.github/workflows/build-push.yml‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -22,25 +22,23 @@ jobs:
2222
build-push:
2323
runs-on: ubuntu-latest
2424
permissions:
25+
attestations: write
2526
# dependency-submission needs contents write permission.
2627
contents: write
28+
# attest-build-provenance needs id-token write permission.
29+
id-token: write
2730
packages: write
2831
pull-requests: write
29-
# This is used to complete the identity challenge
30-
# with sigstore/fulcio when running outside of PRs.
31-
id-token: write
3232
strategy:
3333
matrix:
3434
flavor: ["cpp", "rust"]
3535
steps:
36-
- uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v9.0.1
36+
- uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
3737
with:
3838
egress-policy: audit
3939
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4040
with:
4141
persist-credentials: false
42-
- uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
43-
if: github.event_name != 'merge_group'
4442
- uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
4543
- uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
4644
if: github.event_name != 'merge_group'
@@ -84,7 +82,7 @@ jobs:
8482
id: devcontainer-metadata
8583
- run: echo "git-commit-epoch=$(git log -1 --pretty=%ct)" >> "$GITHUB_OUTPUT"
8684
id: devcontainer-epoch
87-
- uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
85+
- uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
8886
id: build-and-push
8987
env:
9088
SOURCE_DATE_EPOCH: ${{ steps.devcontainer-epoch.outputs.git-commit-epoch }}
@@ -98,20 +96,19 @@ jobs:
9896
devcontainer.metadata=${{ steps.devcontainer-metadata.outputs.metadata }}
9997
annotations: ${{ steps.metadata.outputs.annotations }}
10098
sbom: true
101-
provenance: true
10299
cache-from: type=gha,scope=${{ github.repository }}-${{ matrix.flavor }}
103100
cache-to: type=gha,mode=max,scope=${{ github.repository }}-${{ matrix.flavor }}
104101
- uses: ./.github/actions/container-size-diff
105102
id: container-size-diff
106103
with:
107104
from-container: ${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.flavor }}:latest
108105
to-container: ${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.flavor }}@${{ steps.build-and-push.outputs.digest }}
109-
- uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 # v2.9.0
106+
- uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 # v2.9.1
110107
with:
111108
header: container-size-diff-${{ matrix.flavor }}
112109
message: |
113110
${{ steps.container-size-diff.outputs.size-diff-markdown }}
114-
- uses: anchore/sbom-action@df80a981bc6edbc4e220a492d3cbe9f5547a6e75 # v0.17.9
111+
- uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
115112
if: steps.build-and-push.outputs.digest != '' && github.event_name != 'merge_group'
116113
with:
117114
image: ${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.flavor }}@${{ steps.build-and-push.outputs.digest }}
@@ -121,14 +118,18 @@ jobs:
121118
with:
122119
comment-summary-in-pr: on-failure
123120
fail-on-severity: critical
124-
- name: Sign the images with GitHub OIDC token
121+
- uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0
122+
if: github.event_name != 'merge_group'
123+
with:
124+
subject-name: ${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.flavor }}
125+
subject-digest: ${{ steps.build-and-push.outputs.digest }}
126+
push-to-registry: true
127+
- name: Verify attestation
125128
if: github.event_name != 'merge_group'
126-
# This step uses the GitHub OIDC identity token to provision an ephemeral certificate
127-
# against the sigstore community Fulcio instance.
128129
env:
129-
DIGEST: ${{ steps.build-and-push.outputs.digest }}
130+
GH_TOKEN: ${{ github.token }}
130131
run: |
131-
cosign sign --yes --recursive "${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.flavor }}@${DIGEST}"
132+
gh attestation verify --repo ${{ github.repository }} oci://${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.flavor }}@${{ steps.build-and-push.outputs.digest }}
132133
acceptance-test:
133134
if: github.event_name == 'pull_request'
134135
needs: build-push

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
with:
2727
persist-credentials: false
2828
- uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
29-
- uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
29+
- uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
3030
with:
3131
file: .devcontainer/${{ matrix.flavor }}/Dockerfile
3232
load: true
@@ -43,7 +43,7 @@ jobs:
4343
run: |
4444
set -Eeuo pipefail
4545
docker run --rm --mount type=bind,src=/var/run/docker.sock,dst=/var/run/docker.sock --mount type=bind,src="${{ github.workspace }}/test/${{ matrix.flavor }}",dst=/ws -w /ws ${{ github.repository }}-${{ matrix.flavor }}:test bats --formatter junit integration-tests.bats | tee test-report-${{ matrix.flavor }}.xml
46-
- uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
46+
- uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
4747
if: always()
4848
with:
4949
name: test-results-${{ matrix.flavor }}

0 commit comments

Comments
 (0)