-
Notifications
You must be signed in to change notification settings - Fork 7
123 lines (109 loc) · 4.08 KB
/
quality.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
# This workflow checks out code, performs a Codacy security scan
# and integrates the results with the
# GitHub Advanced Security code scanning feature. For more information on
# the Codacy security scan action usage and parameters, see
# https://github.com/codacy/codacy-analysis-cli-action.
# For more information on Codacy Analysis CLI in general, see
# https://github.com/codacy/codacy-analysis-cli.
name: Codacy Security Scan
on:
push:
branches:
- '**'
pull_request:
# The branches below must be a subset of the branches above
branches: [ "main" ]
schedule:
- cron: '43 0 * * 0'
permissions:
contents: read
jobs:
codacy-security-scan:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
name: Codacy Security Scan
runs-on: ubuntu-latest
steps:
# Checkout the repository to the GitHub Actions runner
- name: Checkout code
uses: actions/checkout@v3
# Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
- name: Run Codacy Analysis CLI
uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b
with:
# Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository
# You can also omit the token and run the tools that support default configurations
project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
verbose: true
output: results.sarif
format: sarif
# Adjust severity of non-security issues
gh-code-scanning-compat: true
# Force 0 exit code to allow SARIF file generation
# This will handover control about PR rejection to the GitHub side
max-allowed-issues: 2147483647
# Upload the SARIF file generated in the previous step
- name: Upload SARIF results file
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: results.sarif
rust-quality-gate:
name: Rust Quality Gate
env:
working-directory: "role-manager"
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v2
- name: Install Rust
uses: actions-rs/toolchain@v1
with:
toolchain: stable
override: true
- name: Build code
run: cargo build --all --release
working-directory: ${{ env.working-directory }}
- name: Format code with Rustfmt
run: cargo fmt --all -- --check
working-directory: ${{ env.working-directory }}
continue-on-error: true
id: rustfmt
- name: Run Clippy
run: cargo clippy --all -- -D warnings
working-directory: ${{ env.working-directory }}
continue-on-error: true
id: clippy
- name: Check errors and set workflow status
run: |
if [[ ${{ steps.rustfmt.outcome }} == 'failure' ]]; then
echo "Error: Rustfmt failed."
exit 1
fi
if [[ ${{ steps.clippy.outcome }} == 'failure' ]]; then
echo "Error: Clippy failed."
exit 1
fi
if: ${{ always() }}
rust-security:
name: Rust Security Gate
env:
working-directory: "role-manager"
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v2
- name: Install Rust
uses: actions-rs/toolchain@v1
with:
toolchain: stable
override: true
- name: Cargo audit
run: cargo audit --json | tee cargo-audit.json
working-directory: ${{ env.working-directory }}
id: cargo-audit