chore(deps): bump taiki-e/install-action from 2.75.27 to 2.82.0 #204
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| # Force Node.js 24 for GitHub Actions (Node.js 20 deprecated, removed Sep 2026) | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| jobs: | |
| # Security: scan GitHub Actions workflows for common misconfigurations. | |
| # See docs/security.md and https://woodruffw.github.io/zizmor/ | |
| zizmor-security-scan: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.3.1 — pin to SHA per security best practices | |
| with: | |
| persist-credentials: false | |
| - name: Install zizmor | |
| uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2 | |
| with: | |
| tool: zizmor | |
| - name: Run zizmor security scan | |
| run: zizmor . | |
| ci-lint-test: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Install stable toolchain | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch HEAD (verified via GitHub API) | |
| with: | |
| targets: x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu | |
| - name: Cache dependencies and build | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| key: ci-lint-test | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update && sudo apt-get install -y \ | |
| libsystemd-dev libdbus-1-dev pkg-config | |
| - name: Check formatting | |
| run: cargo fmt --check | |
| - name: Clippy lint check | |
| run: cargo clippy --all-targets -- -D warnings | |
| - name: Run all tests | |
| run: cargo test --all-targets | |
| - name: Security audit (cargo audit) | |
| uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2 | |
| with: | |
| tool: cargo-audit | |
| - name: Run security audit | |
| run: cargo audit | |
| build-artifacts-ci: | |
| if: github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/') | |
| needs: [ci-lint-test] | |
| permissions: | |
| contents: read | |
| issues: none | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - x86_64-unknown-linux-gnu | |
| - aarch64-unknown-linux-gnu | |
| include: | |
| - target: x86_64-unknown-linux-gnu | |
| arch: x86_64 | |
| deb_arch: amd64 | |
| - target: aarch64-unknown-linux-gnu | |
| arch: aarch64 | |
| deb_arch: arm64 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Install stable toolchain and clippy | |
| run: | | |
| rustup update stable && rustup default stable | |
| rustup component add clippy | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update && sudo apt-get install -y \ | |
| libsystemd-dev libdbus-1-dev pkg-config | |
| - name: Cache dependencies and build | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| key: ci-build-${{ matrix.target }} | |
| - name: Install cross-compilation toolchain (cross-rs) | |
| if: matrix.arch == 'aarch64' | |
| uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2 | |
| with: | |
| tool: cross | |
| - name: Build binary | |
| run: | | |
| set -euo pipefail | |
| BINARY="target/${{ matrix.target }}/release/rouser" | |
| if [ "${{ matrix.arch }}" = "x86_64" ]; then | |
| cargo build --release --target ${{ matrix.target }} | |
| else | |
| cross build --release --target ${{ matrix.target }} | |
| fi | |
| - name: Create tarball artifact | |
| run: | | |
| set -euo pipefail | |
| BINARY="target/${{ matrix.target }}/release/rouser" | |
| ARCHIVE="rouser-${{ matrix.arch }}-linux.tar.gz" | |
| chmod +x .github/scripts/packaging.sh | |
| .github/scripts/packaging.sh package "$BINARY" "$ARCHIVE" | |
| - name: Upload CI artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: rouser-${{ matrix.arch }}-linux-ci | |
| path: "rouser-${{ matrix.arch }}-linux.tar.gz" | |
| retention-days: 7 |