mirror of
https://github.com/edera-dev/sprout.git
synced 2026-11-04 18:42:21 +00:00
alex
2e643d8081
The concurrency groups included the commit SHA, so every run was in a group of its own and cancel-in-progress never cancelled a run that a newer push had replaced. Group runs by pull request or ref instead. Only pull request runs are cancelled, so every push to main still gets fully checked and published.
73 lines
2.1 KiB
YAML
73 lines
2.1 KiB
YAML
name: publish
|
|
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
permissions:
|
|
contents: read # Needed to checkout the repository.
|
|
|
|
concurrency:
|
|
group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
|
|
# Only cancel superseded pull request runs, so every push to main is fully checked.
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
artifacts:
|
|
name: artifacts
|
|
permissions:
|
|
contents: read # Needed to checkout the repository.
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
artifact-digest: "${{ steps.upload.outputs.artifact-digest }}"
|
|
steps:
|
|
- name: harden runner
|
|
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: 'install rust toolchain'
|
|
run: |
|
|
cargo version
|
|
|
|
- name: 'assemble artifacts'
|
|
run: ./hack/assemble.sh
|
|
|
|
- name: 'upload artifacts'
|
|
id: upload
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: artifacts
|
|
path: target/assemble/*
|
|
|
|
# Attestation runs in its own job so that pull requests, which run the build with
|
|
# code from the pull request, never get the permissions needed to attest.
|
|
attest:
|
|
name: attest
|
|
needs: artifacts
|
|
if: github.event_name != 'pull_request'
|
|
permissions:
|
|
id-token: write # Needed for attestation.
|
|
attestations: write # Needed for attestations.
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: harden runner
|
|
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: 'attest artifacts'
|
|
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
|
|
with:
|
|
subject-name: artifacts.zip
|
|
subject-digest: "sha256:${{ needs.artifacts.outputs.artifact-digest }}"
|