Skip to content

Commit 5b59e39

Browse files
clrxblaecsocket
clrxbl
and
aecsocket
authored
chore: improve actions performance and security practices (#5970)
* chore: bump actions and pin versions * build: switch to blacksmith * fix: use rust-toolchain stable * build: improve pnpm store caching * chore: remove emoji from workflows * fix: run prepare job on blacksmith * chore: kebab case id * build: add concurrency groups to limit duplicate jobs * build: switch around node setup and pnpm setup task * chore: bump to nodejs 24, fix pnpm caching * fix: enable corepack * fix: concurrency deadlock in frontend preview * fix: approve build scripts * fix: just don't cancel concurrent previews * build: remove pnpm setup action everywhere * build: cache apt packages * build: yet another attempt at fixing concurrency * build: lower runner type for frontend deploy * fix: eslint not existing * build: add sccache to turbo-ci * fix: correct nextest pkg * fix: turbo ignoring sccache * revert me: test labrinth tests * Revert "revert me: test labrinth tests" This reverts commit def5cc1. * build: compile app before docker build * build: lower runner types * build: remove docker inline caching * build: try mold on labrinth * build: tweak labrinth prod build profile * fix: app windows builds and caching * fix: tombi format cargo.toml * fix: swap ping test to cubecraft to avoid CI flakiness * typos fix --------- Co-authored-by: aecsocket <aecsocket@tutanota.com>
1 parent 9015ff0 commit 5b59e39

29 files changed

Lines changed: 975 additions & 381 deletions

‎.github/workflows/changelog-comment.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@ jobs:
1616
runs-on: ubuntu-latest
1717

1818
steps:
19-
- name: 💬 Post or update changelog comment
20-
uses: actions/github-script@v7
19+
- name: Post or update changelog comment
20+
uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0
2121
with:
2222
github-token: ${{ secrets.CROWDIN_GH_TOKEN }}
2323
script: |

‎.github/workflows/check-generic.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,15 @@ jobs:
1212
typos:
1313
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/checkout@v4
16-
- uses: crate-ci/typos@v1.43.1
15+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
16+
- uses: crate-ci/typos@6ac2ebd1b93eade61faf7e12688ad87a073fea59 # v1.46.0
1717

1818
# see <https://github.com/influxdata/datafusion-udf-wasm/pull/275>
1919
tombi:
2020
runs-on: ubuntu-latest
2121
steps:
22-
- uses: actions/checkout@v4
23-
- uses: taiki-e/install-action@v2
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
- uses: taiki-e/install-action@b5fddbb5361bce8a06fb168c9d403a6cc552b084 # v2.75.29
2424
with:
2525
tool: tombi
2626
- run: tombi lint

‎.github/workflows/check-rust.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ jobs:
1212
shear:
1313
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/checkout@v4
16-
- uses: dtolnay/rust-toolchain@stable
17-
- uses: cargo-bins/cargo-binstall@main
15+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
16+
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
17+
- uses: cargo-bins/cargo-binstall@dc19f1e48450eefe5a29b8da6c6b00a87d730b37 # v1.18.1
1818
- run: cargo binstall --no-confirm cargo-shear
1919
- run: cargo shear

‎.github/workflows/daedalus-docker.yml‎

Lines changed: 67 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -8,28 +8,79 @@ on:
88
- .github/workflows/daedalus-docker.yml
99
- 'apps/daedalus_client/**'
1010
- 'packages/daedalus/**'
11+
- Cargo.toml
12+
- Cargo.lock
1113
pull_request:
1214
types: [opened, synchronize]
1315
paths:
1416
- .github/workflows/daedalus-docker.yml
1517
- 'apps/daedalus_client/**'
1618
- 'packages/daedalus/**'
19+
- Cargo.toml
20+
- Cargo.lock
1721
merge_group:
1822
types: [checks_requested]
1923

24+
concurrency:
25+
group: ${{ github.workflow }}-${{ github.ref }}
26+
cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/prod' }}
27+
2028
jobs:
2129
docker:
22-
runs-on: ubuntu-latest
30+
runs-on: blacksmith-4vcpu-ubuntu-2404
31+
env:
32+
SCCACHE_DIR: '/mnt/sccache'
33+
SCCACHE_CACHE_SIZE: '10G'
34+
SCCACHE_MULTILEVEL_CHAIN: 'disk,s3'
35+
SCCACHE_S3_KEY_PREFIX: '${{ github.repository }}/'
36+
SCCACHE_BUCKET: ${{ secrets.SCCACHE_BUCKET }}
37+
SCCACHE_REGION: ${{ secrets.SCCACHE_REGION }}
38+
SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
39+
AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_S3_ACCESS_KEY_ID }}
40+
AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_S3_SECRET_ACCESS_KEY }}
41+
RUSTC_WRAPPER: 'sccache'
2342
steps:
24-
- name: 📥 Check out code
25-
uses: actions/checkout@v4
43+
- name: Check out code
44+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
45+
46+
- name: Setup Rust toolchain
47+
uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
48+
with:
49+
rustflags: ''
50+
cache: false
51+
52+
- name: Cache Cargo registry and index
53+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
54+
with:
55+
path: |
56+
~/.cargo/registry
57+
~/.cargo/git
58+
~/.cargo/bin
59+
key: ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('**/Cargo.lock') }}
60+
61+
- name: Mount sccache disk cache
62+
uses: useblacksmith/stickydisk@13af8883542ca949a717e70fef89d15edbb29d88 # v1.2.0
63+
with:
64+
key: ${{ github.repository }}-daedalus-sccache
65+
path: /mnt/sccache
66+
67+
- name: Setup sccache
68+
uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
69+
70+
- name: Build daedalus_client
71+
run: cargo build --release --package daedalus_client
72+
73+
- name: Stage Docker context
74+
run: |
75+
mkdir -p apps/daedalus_client/docker-stage
76+
cp target/release/daedalus_client apps/daedalus_client/docker-stage/daedalus_client
2677
27-
- name: 🧰 Set up Docker Buildx
28-
uses: docker/setup-buildx-action@v2
78+
- name: Set up Docker Buildx
79+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
2980

30-
- name: ⚙️ Generate Docker image metadata
31-
id: docker_meta
32-
uses: docker/metadata-action@v5
81+
- name: Generate Docker image metadata
82+
id: docker-meta
83+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
3384
env:
3485
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
3586
with:
@@ -43,20 +94,19 @@ jobs:
4394
org.opencontainers.image.description=Modrinth game metadata query client
4495
org.opencontainers.image.licenses=MIT
4596
46-
- name: 🔑 Login to GitHub Packages
47-
uses: docker/login-action@v3
97+
- name: Login to GitHub Packages
98+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
4899
with:
49100
registry: ghcr.io
50101
username: ${{ github.actor }}
51102
password: ${{ secrets.GITHUB_TOKEN }}
52103

53-
- name: 🔨 Build and push
54-
uses: docker/build-push-action@v6
104+
- name: Build and push
105+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
55106
with:
107+
context: ./apps/daedalus_client/docker-stage
56108
file: ./apps/daedalus_client/Dockerfile
57109
push: ${{ github.event_name != 'pull_request' }}
58-
tags: ${{ steps.docker_meta.outputs.tags }}
59-
labels: ${{ steps.docker_meta.outputs.labels }}
60-
annotations: ${{ steps.docker_meta.outputs.annotations }}
61-
cache-from: type=registry,ref=ghcr.io/modrinth/daedalus:main
62-
cache-to: type=inline
110+
tags: ${{ steps.docker-meta.outputs.tags }}
111+
labels: ${{ steps.docker-meta.outputs.labels }}
112+
annotations: ${{ steps.docker-meta.outputs.annotations }}

‎.github/workflows/daedalus-run.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ jobs:
1212

1313
steps:
1414
- name: Checkout repository
15-
uses: actions/checkout@v3
15+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1616

1717
- name: Log in to GitHub Container Registry
18-
uses: docker/login-action@v2
18+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
1919
with:
2020
registry: ghcr.io
2121
username: ${{ github.actor }}

‎.github/workflows/frontend-deploy.yml‎

Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -21,16 +21,20 @@ on:
2121
type: string
2222
description: 'The environment to deploy to (staging-preview or production-preview)'
2323

24+
concurrency:
25+
group: ${{ github.workflow }}-${{ github.ref }}-${{ inputs.environment || 'push' }}
26+
cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/prod' }}
27+
2428
jobs:
2529
deploy:
26-
runs-on: ubuntu-latest
30+
runs-on: blacksmith-2vcpu-ubuntu-2404
2731
permissions:
2832
contents: read
2933
deployments: write
3034
pull-requests: write
3135
steps:
3236
- name: Checkout code
33-
uses: actions/checkout@v4
37+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3438
with:
3539
fetch-depth: 0
3640

@@ -63,14 +67,25 @@ jobs:
6367
echo "url=https://modrinth.com" >> $GITHUB_OUTPUT
6468
fi
6569
66-
- name: Setup pnpm
67-
uses: pnpm/action-setup@v4
68-
6970
- name: Setup Node
70-
uses: actions/setup-node@v4
71+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
7172
with:
7273
node-version-file: .nvmrc
73-
cache: pnpm
74+
75+
- name: Enable Corepack
76+
run: corepack enable
77+
78+
- name: Get pnpm store path
79+
id: pnpm-store
80+
run: echo "store-path=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
81+
82+
- name: Restore pnpm cache
83+
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
84+
with:
85+
path: ${{ steps.pnpm-store.outputs.store-path }}
86+
key: pnpm-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/pnpm-lock.yaml') }}
87+
restore-keys: |
88+
pnpm-cache-
7489
7590
- name: Inject build variables
7691
working-directory: ./apps/frontend
@@ -99,7 +114,7 @@ jobs:
99114
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
100115

101116
- name: Create Sentry release and upload sourcemaps
102-
uses: getsentry/action-release@v3
117+
uses: getsentry/action-release@5657c9e888b4e2cc85f4d29143ea4131fde4a73a # v3.6.0
103118
env:
104119
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
105120
SENTRY_ORG: modrinth
@@ -111,7 +126,7 @@ jobs:
111126

112127
- name: Deploy Cloudflare Worker
113128
id: wrangler
114-
uses: cloudflare/wrangler-action@v3
129+
uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
115130
with:
116131
apiToken: ${{ secrets.CF_API_TOKEN }}
117132
accountId: ${{ secrets.CF_ACCOUNT_ID }}
@@ -137,7 +152,7 @@ jobs:
137152
138153
- name: Upload deployment URL
139154
if: ${{ inputs.environment != '' }}
140-
uses: actions/upload-artifact@v6
155+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
141156
with:
142157
name: deployment-url-${{ inputs.environment }}
143158
path: deployment-url-${{ inputs.environment }}.txt

‎.github/workflows/frontend-preview.yml‎

Lines changed: 28 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ jobs:
1616
if: github.repository_owner == 'modrinth' && github.event.pull_request.head.repo.full_name == github.repository
1717
uses: ./.github/workflows/frontend-deploy.yml
1818
secrets: inherit
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.environment }}
21+
cancel-in-progress: true
1922
strategy:
2023
matrix:
2124
environment: [staging-preview, production-preview]
@@ -24,22 +27,36 @@ jobs:
2427

2528
deploy-storybook:
2629
if: github.repository_owner == 'modrinth' && github.event.pull_request.head.repo.full_name == github.repository
27-
runs-on: ubuntu-latest
30+
runs-on: blacksmith-2vcpu-ubuntu-2404
31+
concurrency:
32+
group: ${{ github.workflow }}-${{ github.ref }}-storybook
33+
cancel-in-progress: true
2834
permissions:
2935
contents: read
3036
deployments: write
3137
steps:
3238
- name: Checkout code
33-
uses: actions/checkout@v4
34-
35-
- name: Setup pnpm
36-
uses: pnpm/action-setup@v4
39+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3740

3841
- name: Setup Node
39-
uses: actions/setup-node@v4
42+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
4043
with:
4144
node-version-file: .nvmrc
42-
cache: pnpm
45+
46+
- name: Enable Corepack
47+
run: corepack enable
48+
49+
- name: Get pnpm store path
50+
id: pnpm-store
51+
run: echo "store-path=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
52+
53+
- name: Restore pnpm cache
54+
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
55+
with:
56+
path: ${{ steps.pnpm-store.outputs.store-path }}
57+
key: pnpm-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/pnpm-lock.yaml') }}
58+
restore-keys: |
59+
pnpm-cache-
4360
4461
- name: Install dependencies
4562
working-directory: ./packages/ui
@@ -54,7 +71,7 @@ jobs:
5471
run: echo "sha_short=${GITHUB_SHA::8}" >> $GITHUB_OUTPUT
5572

5673
- name: Deploy Storybook preview
57-
uses: cloudflare/wrangler-action@v3
74+
uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
5875
with:
5976
apiToken: ${{ secrets.CF_API_TOKEN }}
6077
accountId: ${{ secrets.CF_ACCOUNT_ID }}
@@ -69,7 +86,7 @@ jobs:
6986
needs: [deploy, deploy-storybook]
7087
steps:
7188
- name: Download deployment URLs
72-
uses: actions/download-artifact@v7
89+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
7390
with:
7491
pattern: deployment-url-*
7592
merge-multiple: true
@@ -89,7 +106,7 @@ jobs:
89106
90107
- name: Find comment
91108
if: github.event_name == 'pull_request'
92-
uses: peter-evans/find-comment@v3
109+
uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
93110
id: fc
94111
with:
95112
token: ${{ secrets.CROWDIN_GH_TOKEN }}
@@ -98,7 +115,7 @@ jobs:
98115

99116
- name: Comment deploy URL on PR
100117
if: github.event_name == 'pull_request'
101-
uses: peter-evans/create-or-update-comment@v5
118+
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
102119
with:
103120
token: ${{ secrets.CROWDIN_GH_TOKEN }}
104121
issue-number: ${{ github.event.pull_request.number }}

‎.github/workflows/i18n-pull.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,14 +51,14 @@ jobs:
5151
CROWDIN_GH_TOKEN_DEFINED: ${{ secrets.CROWDIN_GH_TOKEN != '' }}
5252

5353
- name: Checkout
54-
uses: actions/checkout@v4
54+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5555
with:
5656
ref: ${{ github.ref }}
5757
token: ${{ secrets.CROWDIN_GH_TOKEN }}
5858

5959
- name: Configure Git author
6060
id: git-author
61-
uses: MarcoIeni/git-config@v0.1
61+
uses: MarcoIeni/git-config@59144859caf016f8b817a2ac9b051578729173c4 # v0.1.2
6262
env:
6363
GITHUB_TOKEN: ${{ secrets.CROWDIN_GH_TOKEN }}
6464

@@ -79,7 +79,7 @@ jobs:
7979
echo "safe_branch_name=$SAFE_BRANCH_NAME" >> "$GITHUB_OUTPUT"
8080
8181
- name: Download translations from Crowdin
82-
uses: crowdin/github-action@v2
82+
uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2.16.2
8383
with:
8484
upload_sources: false
8585
upload_translations: false
@@ -96,7 +96,7 @@ jobs:
9696
run: sudo chown -R $USER:$USER .
9797

9898
- name: Create Pull Request
99-
uses: peter-evans/create-pull-request@v7
99+
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
100100
with:
101101
title: 'New translations from Crowdin (${{ steps.branch-name.outputs.branch_name }})'
102102
body-path: .github/templates/crowdin-pr.md

‎.github/workflows/i18n-push.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ jobs:
5353
CROWDIN_PERSONAL_TOKEN_DEFINED: ${{ secrets.CROWDIN_PERSONAL_TOKEN != '' }}
5454

5555
- name: Checkout
56-
uses: actions/checkout@v4
56+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5757
with:
5858
ref: ${{ github.ref }}
5959

@@ -68,7 +68,7 @@ jobs:
6868
echo "safe_branch_name=$SAFE_BRANCH_NAME" >> "$GITHUB_OUTPUT"
6969
7070
- name: Upload translations to Crowdin
71-
uses: crowdin/github-action@v1
71+
uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2.16.2
7272
with:
7373
upload_sources: true
7474
upload_translations: false

0 commit comments

Comments
 (0)