build(msrv)!: require Rust 1.98.0 #287
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Advanced Clippy analysis with SARIF output for security integration | |
| # Note: Basic clippy checks are also run in the main CI workflow | |
| name: "Clippy Security Analysis" | |
| concurrency: | |
| group: >- | |
| clippy-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| on: | |
| pull_request: | |
| branches: ["main"] | |
| schedule: | |
| - cron: "17 22 * * 0" # Weekly on Sunday | |
| workflow_dispatch: | |
| # Run on main branch pushes for security scanning | |
| push: | |
| branches: ["main"] | |
| # Security: Define minimal required permissions | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| jobs: | |
| clippy-sarif: | |
| name: Clippy SARIF Analysis | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust toolchain | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| cache: true # toolchain/components are specified in rust-toolchain.toml | |
| cache-bin: false | |
| - name: Set up just | |
| uses: ./.github/actions/setup-just | |
| - name: Export tool versions | |
| id: tool_versions | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| resolve_version() { | |
| local name="$1" | |
| local value | |
| if ! value="$(just --evaluate "$name")"; then | |
| echo "::error::Failed to resolve $name from justfile" >&2 | |
| return 1 | |
| fi | |
| if [[ -z "$value" ]]; then | |
| echo "::error::Resolved empty $name from justfile" >&2 | |
| return 1 | |
| fi | |
| printf '%s\n' "$value" | |
| } | |
| clippy_sarif_version="$(resolve_version clippy_sarif_version)" | |
| sarif_fmt_version="$(resolve_version sarif_fmt_version)" | |
| { | |
| echo "CLIPPY_SARIF_VERSION=$clippy_sarif_version" | |
| echo "SARIF_FMT_VERSION=$sarif_fmt_version" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Install clippy-sarif | |
| uses: taiki-e/cache-cargo-install-action@9ee83daaa7b96a6fab930949ecf1122bba04a389 # v3.0.8 | |
| with: | |
| tool: clippy-sarif@${{ steps.tool_versions.outputs.CLIPPY_SARIF_VERSION }} | |
| - name: Install sarif-fmt | |
| uses: taiki-e/cache-cargo-install-action@9ee83daaa7b96a6fab930949ecf1122bba04a389 # v3.0.8 | |
| with: | |
| tool: sarif-fmt@${{ steps.tool_versions.outputs.SARIF_FMT_VERSION }} | |
| - name: Run clippy with SARIF output | |
| run: | | |
| set -euo pipefail | |
| # Lint levels are owned by Cargo.toml. | |
| cargo clippy \ | |
| --workspace \ | |
| --all-targets \ | |
| --all-features \ | |
| --message-format=json | \ | |
| clippy-sarif | \ | |
| tee rust-clippy-results.sarif | \ | |
| sarif-fmt | |
| - name: Upload SARIF results | |
| if: >- | |
| always() | |
| && hashFiles('rust-clippy-results.sarif') != '' | |
| && ( | |
| github.event_name != 'pull_request' | |
| || github.event.pull_request.head.repo.full_name == github.repository | |
| ) | |
| uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 | |
| with: | |
| sarif_file: rust-clippy-results.sarif | |
| category: "clippy" | |
| wait-for-processing: true |