chore: pin risc0 dumper to the 3.0.5 stack #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| name: build + vet + test + smoke + wrap-risc0 + soundness | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Check out | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25.7' | |
| cache: true | |
| - name: Print versions | |
| run: | | |
| go version | |
| go env GOPATH GOMODCACHE | |
| - name: make all | |
| run: make all | |
| - name: Upload Cardano artifacts on failure | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: out-on-failure | |
| path: | | |
| out/ | |
| retention-days: 7 | |
| lint-audit: | |
| name: lint + vuln scan | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Check out | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25.7' | |
| cache: true | |
| - name: golangci-lint (incl. gosec) | |
| run: | | |
| curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh \ | |
| | sh -s -- -b "$(go env GOPATH)/bin" v2.12.2 | |
| "$(go env GOPATH)/bin/golangci-lint" run --timeout=5m | |
| - name: govulncheck (Go; fails only on vulns our code calls) | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| "$(go env GOPATH)/bin/govulncheck" ./... | |
| # Rust dep CVE scan (reads Cargo.lock; no crate build → no zkr artifact | |
| # needed). Report-only: the dumper's deps are pinned to risc0's exact | |
| # resolution, so an unfixable transitive advisory must not block CI — | |
| # bumping risc0 is a coordinated event. | |
| - name: cargo audit (risc0-dump deps, report-only) | |
| continue-on-error: true | |
| run: | | |
| cargo install cargo-audit --locked || true | |
| cargo audit --file tools/risc0-dump/Cargo.lock |