-
Notifications
You must be signed in to change notification settings - Fork 14
107 lines (99 loc) · 2.96 KB
/
on.pr.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
---
name: "PR"
"on":
## Run on PR filings
pull_request:
paths:
- docs/**/*.*
- example/**/*.*
- graalvm/**/*.*
- internal/**/*.*
- tools/**/*.*
## Run on PR queue check requests
merge_group: {}
concurrency:
# Cancel previous actions from the same PR: https://stackoverflow.com/a/72408109
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
dependency-graph:
name: "Dependency Graph"
continue-on-error: true
runs-on: ubuntu-latest
permissions:
id-token: write
contents: write
steps:
- name: Harden Runner
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
with:
egress-policy: audit
- name: "Setup: Checkout"
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
- name: "Report: Dependency Graph"
continue-on-error: true
uses: advanced-security/maven-dependency-submission-action@bfd2106013da0957cdede0b6c39fb5ca25ae375e # v4.0.2
dependency-review:
name: "Dependency Review"
runs-on: ubuntu-latest
needs: [dependency-graph]
permissions:
contents: read
pull-requests: write
steps:
- name: Harden Runner
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
with:
egress-policy: audit
- name: "Checkout Repository"
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
- name: "Dependency Review"
uses: actions/dependency-review-action@5bbc3ba658137598168acb2ab73b21c432dd411b # v4.2.5
with:
config-file: "./.github/dependency-review-config.yml"
comment-summary-in-pr: always
retry-on-snapshot-warnings: true
warn-only: true
test:
name: "Tests: ${{ matrix.label }}"
uses: ./.github/workflows/module.build.yml
strategy:
fail-fast: false
matrix:
runner: [ubuntu-latest]
main: [true]
label: ["Ubuntu"]
labs: [false]
flags: ["--config=linux"]
testlabel: ["Ubuntu"]
coverage: [false]
include:
# Bazel 7
- runner: ubuntu-latest
label: Ubuntu
labs: false
main: true
coverage: false
flags: --config=linux
- runner: macos-latest
label: macOS
labs: false
main: true
coverage: true
flags: --config=mac
- runner: windows-2022
label: Windows
labs: false
main: true
coverage: false
flags: --config=windows
secrets: inherit
with:
runner: ${{ matrix.runner }}
label: ${{ matrix.label }}
labs: ${{ matrix.labs }}
main: ${{ matrix.main }}
flags: ${{ matrix.flags }}
coverage: ${{ matrix.coverage }}