32bfe1d186
* fix(workflows): standardize runner configuration for security jobs * ci(actionlint): add Blacksmith runner label to config Add blacksmith-2vcpu-ubuntu-2404 to actionlint self-hosted-runner labels config to suppress "unknown label" warnings during workflow linting. This label is used across all workflows after the Blacksmith migration. * fix(actionlint): adjust indentation for self-hosted runner labels * feat(security): enhance security workflow with CodeQL analysis steps * fix(security): update CodeQL action to version 4 for improved analysis * fix(security): remove duplicate permissions in security workflow * fix(security): revert CodeQL action to v3 for stability The v4 version was causing workflow file validation failures. Reverting to proven v3 version that is working on main branch. * fix(security): remove duplicate permissions causing workflow validation failure The permissions block had duplicate security-events and actions keys, which caused YAML validation errors and prevented workflow execution. Fixes: workflow file validation failures on main branch * fix(security): remove pull_request trigger to reduce costs * fix(security): restore PR trigger but skip codeql on PRs * fix(security): resolve YAML syntax error in security workflow * refactor(security): split CodeQL into dedicated scheduled workflow * fix(security): update workflow name to Rust Package Security Audit * fix(codeql): remove push trigger, keep schedule and on-demand only * feat(codeql): add CodeQL configuration file to ignore specific paths * Potential fix for code scanning alert no. 39: Hard-coded cryptographic value Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * fix(ci): resolve auto-response workflow merge markers * fix(build): restore ChannelMessage reply_target usage * ci(workflows): run workflow sanity on workflow pushes for all branches * ci(workflows): rename auto-response workflow to PR Auto Responder * ci(workflows): require owner approval for workflow file changes * ci: add lint-first PR feedback gate * ci(workflows): split label policy checks from workflow sanity * ci(workflows): consolidate policy and rust workflow setup --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
62 lines
1.6 KiB
YAML
62 lines
1.6 KiB
YAML
name: Rust Reusable Job
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
run_command:
|
|
description: "Shell command(s) to execute."
|
|
required: true
|
|
type: string
|
|
timeout_minutes:
|
|
description: "Job timeout in minutes."
|
|
required: false
|
|
default: 20
|
|
type: number
|
|
toolchain:
|
|
description: "Rust toolchain channel/version."
|
|
required: false
|
|
default: "stable"
|
|
type: string
|
|
components:
|
|
description: "Optional rustup components."
|
|
required: false
|
|
default: ""
|
|
type: string
|
|
targets:
|
|
description: "Optional rustup targets."
|
|
required: false
|
|
default: ""
|
|
type: string
|
|
use_cache:
|
|
description: "Whether to enable rust-cache."
|
|
required: false
|
|
default: true
|
|
type: boolean
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
run:
|
|
runs-on: blacksmith-2vcpu-ubuntu-2404
|
|
timeout-minutes: ${{ inputs.timeout_minutes }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Setup Rust toolchain
|
|
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
|
|
with:
|
|
toolchain: ${{ inputs.toolchain }}
|
|
components: ${{ inputs.components }}
|
|
targets: ${{ inputs.targets }}
|
|
|
|
- name: Restore Rust cache
|
|
if: inputs.use_cache
|
|
uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
|
|
|
|
- name: Run command
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
${{ inputs.run_command }}
|