ci: Run zizmor checks #337
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Elixir CI | |
| on: [push, pull_request] | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| asdf: | |
| name: ASDF | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| # cache the ASDF directory, using the values from .tool-versions | |
| - name: ASDF cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.asdf | |
| key: ${{ runner.os }}-asdf-v2-${{ hashFiles('.tool-versions') }} | |
| id: asdf-cache | |
| # only run `asdf install` if we didn't hit the cache | |
| - uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4.0.1 | |
| if: steps.asdf-cache.outputs.cache-hit != 'true' | |
| # only install Hex/Rebar if we didn't hit the cache | |
| - if: steps.asdf-cache.outputs.cache-hit != 'true' | |
| run: | | |
| mix local.rebar --force | |
| mix local.hex --force | |
| build: | |
| name: Build and test | |
| runs-on: ubuntu-latest | |
| needs: asdf | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: ASDF cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.asdf | |
| key: ${{ runner.os }}-asdf-v2-${{ hashFiles('.tool-versions') }} | |
| id: asdf-cache | |
| - uses: mbta/actions/reshim-asdf@62db3e5c547c3c7f439c4a7fb98e69fc79c1a9cc # v2.21 | |
| # The asdf job should have prepared the cache. exit if it didn't for some reason | |
| - run: exit 1 | |
| if: steps.asdf-cache.outputs.cache-hit != 'true' | |
| - name: Restore dependencies cache | |
| id: deps-cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: deps | |
| key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }} | |
| restore-keys: ${{ runner.os }}-mix- | |
| - name: Install dependencies (if needed) | |
| if: steps.deps-cache.outputs.cache-hit != 'true' | |
| run: mix deps.get | |
| - name: Compile (warnings as errors) | |
| run: mix compile --force --warnings-as-errors | |
| - name: Check formatting | |
| run: mix format --check-formatted | |
| - name: Credo | |
| run: mix credo --strict | |
| - name: Run tests | |
| run: mix test --cover | |
| - name: Save PR information | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| PR_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| echo "$PR_NUMBER" > cover/PR_NUMBER | |
| echo "$PR_SHA" > cover/PR_SHA | |
| if: github.event.pull_request | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: elixir-lcov | |
| path: cover/ | |
| - uses: mbta/actions/dialyzer@62db3e5c547c3c7f439c4a7fb98e69fc79c1a9cc # v2.21 | |
| zizmor: | |
| name: Run zizmor 🌈 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Run zizmor 🌈 | |
| uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 | |
| with: | |
| persona: pedantic | |
| advanced-security: false | |
| annotations: true |