ci: Security Improvements #539
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build pipeline | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| env: | |
| RUST_TOOLCHAIN_VERSION: "1.94.0" | |
| RUSTFLAGS: "-D warnings" | |
| RUSTDOCFLAGS: "-D warnings" | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| test: | |
| name: Run tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5 | |
| - run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}" | |
| - run: cargo test --all-features | |
| clippy: | |
| name: Check clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5 | |
| - run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}" --component clippy | |
| - run: cargo clippy --all-targets -- -D warnings | |
| fmt: | |
| name: Check formatting | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5 | |
| - run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}" --component rustfmt | |
| - run: cargo fmt --all -- --check | |
| docs: | |
| name: Generate docs | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5 | |
| - run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}" | |
| - run: cargo doc --document-private-items | |
| build: | |
| name: Build and push container image | |
| needs: [test, clippy, fmt, docs] | |
| permissions: | |
| id-token: write | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| matrix: | |
| runner: | |
| - ubuntu-latest | |
| - ubicloud-standard-8-arm | |
| steps: | |
| - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5 | |
| - name: Build and (optionally) push container image | |
| id: build | |
| uses: stackabletech/actions/build-container-image@013e6482fbc0edf2d38cf9220fc931f6a81336fb # v0.0.6 | |
| with: | |
| image-name: trino-lb | |
| image-index-manifest-tag: dev | |
| container-file: docker/Dockerfile | |
| - name: Publish Container Image on oci.stackable.tech | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| uses: stackabletech/actions/publish-image@013e6482fbc0edf2d38cf9220fc931f6a81336fb # v0.0.6 | |
| with: | |
| image-registry-uri: oci.stackable.tech | |
| image-registry-username: robot$stackable+github-action-build | |
| image-registry-password: ${{ secrets.HARBOR_ROBOT_STACKABLE_GITHUB_ACTION_BUILD_SECRET }} | |
| # trino-lb is not (yet) a product as the SDP, but a community project, so use "stackable" instead of "sdp" | |
| image-repository: stackable/trino-lb | |
| image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }} | |
| source-image-uri: ${{ steps.build.outputs.image-manifest-uri }} | |
| publish_manifests: | |
| name: Build and publish index manifest | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| needs: [build] | |
| permissions: | |
| id-token: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| - name: Publish and Sign Image Index Manifest to oci.stackable.tech | |
| uses: stackabletech/actions/publish-index-manifest@013e6482fbc0edf2d38cf9220fc931f6a81336fb # v0.0.6 | |
| with: | |
| image-registry-uri: oci.stackable.tech | |
| image-registry-username: robot$stackable+github-action-build | |
| image-registry-password: ${{ secrets.HARBOR_ROBOT_STACKABLE_GITHUB_ACTION_BUILD_SECRET }} | |
| # trino-lb is not (yet) a product as the SDP, but a community project, so use "stackable" instead of "sdp" | |
| image-repository: stackable/trino-lb | |
| image-index-manifest-tag: dev |