chore(deps, base): update ca-certificates, locales, qemu-system-arm, udev, wget #330
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: CI | |
| on: | |
| merge_group: | |
| pull_request: | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.ref }}-${{ github.workflow }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| build-push-test: | |
| name: Build → Push → Test | |
| # For Dependabot PRs that update Docker base images or devcontainer dependencies, | |
| # run the full build/push pipeline. For all other Dependabot ecosystems (npm, pip, | |
| # GitHub Actions), skip the Docker build to avoid hitting Docker Hub pull rate limits | |
| # and to avoid needlessly rebuilding images that haven't changed. | |
| if: | | |
| github.actor != 'dependabot[bot]' || | |
| startsWith(github.head_ref, 'dependabot/docker/') || | |
| startsWith(github.head_ref, 'dependabot/devcontainers/') | |
| uses: ./.github/workflows/build-push-test.yml | |
| permissions: | |
| actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets | |
| artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata | |
| attestations: write # is needed by actions/attest-build-provenance to push attestations | |
| contents: write # is needed by anchore/sbom-action for artifact uploads | |
| id-token: write # is needed by actions/attest-build-provenance to obtain an OIDC token | |
| packages: write # is needed to push image manifest when using GitHub Container Registry | |
| pull-requests: write # is needed by marocchino/sticky-pull-request-comment to post comments | |
| secrets: | |
| DOCKER_REGISTRY_USERNAME: ${{ secrets.DOCKER_REGISTRY_USERNAME }} | |
| DOCKER_REGISTRY_PASSWORD: ${{ secrets.DOCKER_REGISTRY_PASSWORD }} | |
| TEST_GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }} | |
| TEST_GITHUB_USER: ${{ secrets.TEST_GITHUB_USER }} | |
| TEST_GITHUB_PASSWORD: ${{ secrets.TEST_GITHUB_PASSWORD }} | |
| TEST_GITHUB_TOTP_SECRET: ${{ secrets.TEST_GITHUB_TOTP_SECRET }} | |
| dependency-review: | |
| name: 🔍 Dependency Review | |
| needs: build-push-test | |
| # Run after build-push-test when it succeeded, and also when it was | |
| # skipped (i.e. for non-Docker Dependabot PRs), so that dependency | |
| # security checks always execute on pull requests. | |
| if: ${{ !cancelled() && (needs.build-push-test.result == 'success' || needs.build-push-test.result == 'skipped') }} | |
| uses: ./.github/workflows/wc-dependency-review.yml | |
| permissions: | |
| contents: read | |
| pull-requests: write # is needed by actions/dependency-review-action to write PR summaries | |
| publish-test-results: | |
| name: 📊 Publish Test Results | |
| runs-on: ubuntu-latest | |
| permissions: | |
| checks: write # is needed by EnricoMi/publish-unit-test-result-action to add a check run with test results | |
| pull-requests: write # is needed by EnricoMi/publish-unit-test-result-action to annotate PRs | |
| needs: build-push-test | |
| # Only run when build-push-test succeeded (i.e. test artifacts exist). | |
| if: ${{ !cancelled() && needs.build-push-test.result == 'success' }} | |
| steps: | |
| - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| disable-sudo: true | |
| egress-policy: audit | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| merge-multiple: true | |
| pattern: test-results-* | |
| - uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0 | |
| with: | |
| action_fail: true | |
| action_fail_on_inconclusive: true | |
| files: test-report-*.xml | |
| generate-documents: | |
| name: 📄 Documentation | |
| uses: ./.github/workflows/wc-document-generation.yml | |
| permissions: | |
| contents: read |