Files
Asmir Avdicevic c334d2da21 ci(secruity): ensure locked cargo files and dependabot cooldown (#788)
## Description

- Uses `--locked` to ensure we only use deps from the lock file
- Adds cooldown period to dependabot
- pins actions versions
- introduces zizimor and pinact

## Breaking Changes

<!-- Optional, if there are any breaking changes document them,
including how to migrate older code. -->

## Notes & open questions

<!-- Any notes, remarks or open questions you have to make about the -->
<!-- PR. -->

## Change checklist
<!-- Remove any that are not relevant. -->
- [ ] Self-review.
- [ ] Documentation updates following the [style
guide](https://rust-lang.github.io/rfcs/1574-more-api-documentation-conventions.html#appendix-a-full-conventions-text),
if relevant.
- [ ] Tests if relevant.
- [ ] All breaking changes documented.
- [ ] This PR was created by a human that thought critically about the
      proposed change and wrote an as clear and concise description as
      they could.
- [ ] This PR isn't slop, and is carefully crafted to do have the
      intented effect.
- [ ] `cargo make` passes locally.

---------

Co-authored-by: Friedel Ziegelmayer <me@dignifiedquire.com>
2026-08-20 14:00:43 +00:00

51 lines
1.8 KiB
YAML

name: Coverage
on:
pull_request:
push:
branches: ['main']
# Default to read-only; jobs that need more grant it explicitly.
permissions:
contents: read
jobs:
coverage:
timeout-minutes: 5
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
with:
toolchain: stable
- uses: taiki-e/install-action@b20dedce73af6905cdc30d6611090c9b67557c8d # v2.85.12
with:
tool: cargo-llvm-cov
- shell: bash
# Run llvm-cov _without_ the "aws-lc-rs-fips" feature, since
# that has complex build requirements:
# https://github.com/aws/aws-lc/blob/3263ce2a553e4e917217fb487f8c6f488fcb1866/BUILDING.md#build-prerequisites
#
# This list of features was determined using:
# cargo metadata --format-version 1 --no-deps \
# | jq -r ' .packages[].features | keys[]' \
# | sort -u \
# | grep -vFx -e 'default' -e 'aws-lc-rs-fips' \
# | paste -sd ',' -
run: |
cargo llvm-cov --locked \
--features="arbitrary,aws-lc-rs,bloom,fast-apple-datapath,futures-io,json-output,lock_tracking,log,platform-verifier,qlog,ring,runtime-smol,runtime-tokio,rustls,rustls-log,rustls,ring,serde,serde_json,tracing,tracing-log" \
--workspace --lcov --output-path lcov.info
- name: Upload coverage to Codecov
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: lcov.info
fail_ci_if_error: false