Skip to content

Commit 6215b40

Browse files
amanstepamanstep
authored
Merge pull request #1 from step-security/release
feat: Initial release
2 parents 98e995d + e3e885e commit 6215b40

File tree

127 files changed

+81174
-1
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

127 files changed

+81174
-1
lines changed

‎.Rbuildignore‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
^pr-fetch$
2+
^pr-push$
3+
^run-rchk$
4+
^setup-r$
5+
^setup-pandoc$
6+
^setup-tinytex$
7+
^examples$
8+
^LICENSE$
9+
^.github$
10+
^actions\.Rproj$
11+
^\.Rproj\.user$
12+
^Makefile$
13+
^CITATION.cff$
14+
^\.clusterfuzzlite$
15+
^check-r-package$
16+
^setup-r-dependencies$
17+
^setup-renv$

‎.clusterfuzzlite/Dockerfile‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
FROM gcr.io/oss-fuzz-base/base-builder:v1@sha256:ffd8a9fe9f951451e7b28610c83b0264e9fe20449af1f1dc31e243ec947315f7
2+
RUN apt-get update && apt-get install -y r-base make libxml2-dev libcurl4-openssl-dev
3+
COPY . $SRC/actions
4+
WORKDIR actions
5+
COPY .clusterfuzzlite/build.sh $SRC/

‎.clusterfuzzlite/build.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash -eu
2+
3+
# build project
4+
# e.g.
5+
# ./autogen.sh
6+
# ./configure
7+
# make -j$(nproc) all
8+
9+
cd /src/actions/src
10+
$CC -c fuzzer.c
11+
ar rcs fuzzer.a fuzzer.o
12+
13+
# build fuzzers
14+
# e.g.
15+
# $CXX $CXXFLAGS -std=c++11 -Iinclude \
16+
# /path/to/name_of_fuzzer.cc -o $OUT/name_of_fuzzer \
17+
# $LIB_FUZZING_ENGINE /path/to/library.a
18+
19+
$CC $CFLAGS fuzzer.c -o $OUT/fuzzer \
20+
$LIB_FUZZING_ENGINE /src/actions/src/fuzzer.a

‎.clusterfuzzlite/project.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
language: c

‎.github/workflows/actions_release.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: Release GitHub Actions
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
tag:
7+
description: "Tag for the release"
8+
required: true
9+
working_directory:
10+
description: "Working directories to run commands in (comma-separated, optional)"
11+
required: false
12+
type: string
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
release:
19+
permissions:
20+
actions: read
21+
id-token: write
22+
contents: write
23+
24+
uses: step-security/reusable-workflows/.github/workflows/actions_release.yaml@3e8d79e9716f171de1ce34a53e49f87ef9fddec4
25+
with:
26+
tag: "${{ github.event.inputs.tag }}"
27+
working_directory: ${{github.event.inputs.working_directory}}

‎.github/workflows/audit_package.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: NPM Audit Fix Run
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
force:
7+
description: "Use --force flag for npm audit fix?"
8+
required: true
9+
type: boolean
10+
base_branch:
11+
description: "Specify a base branch"
12+
required: false
13+
default: "main"
14+
schedule:
15+
- cron: "0 0 * * 1"
16+
17+
jobs:
18+
audit-fix:
19+
strategy:
20+
matrix:
21+
working_directory:
22+
- pr-fetch
23+
- pr-push
24+
- setup-pandoc
25+
- setup-r
26+
- setup-tinytex
27+
uses: step-security/reusable-workflows/.github/workflows/audit_fix.yml@3e8d79e9716f171de1ce34a53e49f87ef9fddec4
28+
with:
29+
force: ${{ inputs.force || false }}
30+
base_branch: ${{ inputs.base_branch || 'main' }}
31+
working_directory: ${{ matrix.working_directory }}
32+
33+
permissions:
34+
contents: write
35+
pull-requests: write
36+
packages: read
37+
issues: write

‎.github/workflows/auto_cherry_pick.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Auto Cherry-Pick from Upstream
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
base_branch:
7+
description: "Base branch to create the PR against"
8+
required: true
9+
default: "main"
10+
11+
permissions:
12+
contents: write
13+
pull-requests: write
14+
packages: read
15+
issues: write
16+
17+
jobs:
18+
cherry-pick:
19+
uses: step-security/reusable-workflows/.github/workflows/auto_cherry_pick.yaml@v1
20+
with:
21+
original-owner: "r-lib"
22+
repo-name: "actions"
23+
base_branch: ${{ inputs.base_branch }}

‎.github/workflows/cflite_build.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: ClusterFuzzLite continuous builds
2+
on:
3+
push:
4+
branches:
5+
- main
6+
paths:
7+
- 'src/**'
8+
workflow_dispatch:
9+
10+
permissions: read-all
11+
jobs:
12+
Build:
13+
runs-on: ubuntu-latest
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ github.ref }}
16+
cancel-in-progress: true
17+
strategy:
18+
fail-fast: false
19+
matrix:
20+
sanitizer:
21+
- address
22+
steps:
23+
- name: Build Fuzzers (${{ matrix.sanitizer }})
24+
id: build
25+
uses: google/clusterfuzzlite/actions/build_fuzzers@82652fb49e77bc29c35da1167bb286e93c6bcc05
26+
with:
27+
language: c # Change this to the language you are fuzzing.
28+
sanitizer: ${{ matrix.sanitizer }}
29+
upload-build: true

‎.github/workflows/cflite_pr.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: ClusterFuzzLite PR fuzzing
2+
on:
3+
pull_request:
4+
paths:
5+
- 'src/**'
6+
push:
7+
branches:
8+
- main
9+
paths:
10+
- 'src/**'
11+
workflow_dispatch:
12+
13+
permissions: read-all
14+
jobs:
15+
PR:
16+
runs-on: ubuntu-latest
17+
concurrency:
18+
group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ github.ref }}
19+
cancel-in-progress: true
20+
strategy:
21+
fail-fast: false
22+
matrix:
23+
sanitizer:
24+
- address
25+
steps:
26+
- name: Build Fuzzers (${{ matrix.sanitizer }})
27+
id: build
28+
uses: google/clusterfuzzlite/actions/build_fuzzers@82652fb49e77bc29c35da1167bb286e93c6bcc05
29+
with:
30+
language: c
31+
github-token: ${{ secrets.GITHUB_TOKEN }}
32+
sanitizer: ${{ matrix.sanitizer }}
33+
- name: Run Fuzzers (${{ matrix.sanitizer }})
34+
id: run
35+
uses: google/clusterfuzzlite/actions/run_fuzzers@82652fb49e77bc29c35da1167bb286e93c6bcc05
36+
with:
37+
github-token: ${{ secrets.GITHUB_TOKEN }}
38+
fuzz-seconds: 600
39+
mode: 'code-change'
40+
sanitizer: ${{ matrix.sanitizer }}
41+
output-sarif: true

‎.github/workflows/check-full.yaml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# NOTE: This workflow is overkill for most R packages and
2+
# check-standard.yaml is likely a better choice.
3+
# usethis::use_github_action("check-standard") will install it.
4+
on:
5+
push:
6+
branches: [main, master]
7+
pull_request:
8+
9+
name: R-CMD-check.yaml
10+
11+
permissions: read-all
12+
13+
jobs:
14+
R-CMD-check:
15+
runs-on: ${{ matrix.config.os }}
16+
17+
name: ${{ matrix.config.os }} (${{ matrix.config.r }})
18+
19+
strategy:
20+
fail-fast: false
21+
matrix:
22+
config:
23+
- {os: macos-latest, r: 'release'}
24+
25+
- {os: windows-latest, r: 'release'}
26+
# use 4.0 or 4.1 to check with rtools40's older compiler
27+
- {os: windows-latest, r: 'oldrel-4'}
28+
29+
- {os: ubuntu-latest, r: 'devel', http-user-agent: 'release'}
30+
- {os: ubuntu-latest, r: 'release'}
31+
- {os: ubuntu-latest, r: 'oldrel-1'}
32+
- {os: ubuntu-latest, r: 'oldrel-2'}
33+
- {os: ubuntu-latest, r: 'oldrel-3'}
34+
- {os: ubuntu-latest, r: 'oldrel-4'}
35+
36+
- {os: ubuntu-22.04-arm, r: 'release' }
37+
38+
39+
env:
40+
GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
41+
R_KEEP_PKG_SOURCE: yes
42+
43+
steps:
44+
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
45+
46+
- uses: ./setup-pandoc
47+
48+
- uses: ./setup-r
49+
with:
50+
r-version: ${{ matrix.config.r }}
51+
http-user-agent: ${{ matrix.config.http-user-agent }}
52+
use-public-rspm: true
53+
54+
- uses: gaborcsardi/quarto-actions/setup@fix/linux-arm64
55+
56+
- uses: ./setup-r-dependencies
57+
with:
58+
extra-packages: any::rcmdcheck
59+
needs: check
60+
61+
- uses: ./check-r-package
62+
with:
63+
upload-snapshots: true
64+
build_args: 'c("--no-manual","--compact-vignettes=gs+qpdf")'

0 commit comments

Comments
 (0)