ci: bump the github-actions group across 1 directory with 7 updates (… #993
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # .github/workflows/ci.yml | |
| # | |
| # PR + main CI — tests and quality gates only. NO release builds. | |
| # | |
| # Triggers: | |
| # - pull_request : quality gates (compile-warnings-as-errors, test, credo, | |
| # format, sobelow, hex.audit, deps.audit, dialyzer) on | |
| # x86_64. No Burrito build, no artifacts, no macOS. | |
| # - push to main : the same gates as a post-merge safety net. | |
| # | |
| # Release builds (Burrito single binary, macOS cross-compile, Cosign signing, | |
| # SLSA provenance, GitHub Release, Homebrew tap) run ONLY on version tags — | |
| # see release.yml. That's where the four `<arch> build + test` / | |
| # `<arch> macOS cross-build` status checks the `tags` ruleset requires are | |
| # produced. Keep this job's gate steps in sync with release.yml's | |
| # build-and-test job (it re-runs them before signing a release). | |
| # | |
| # Security note: all ${{ ... }} interpolations in `run:` blocks reference | |
| # trusted values defined in this file or runner-set vars. No user-controlled | |
| # strings (issue titles, PR bodies, commit messages, etc.) flow into shell | |
| # commands. | |
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| test: | |
| name: test (x86_64) | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install Erlang + Elixir | |
| uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 | |
| env: | |
| # The `ubuntu-24.04-arm` runner started reporting | |
| # `ImageOS=ubuntu24-arm64` (GitHub image rollout ~2026-06), which | |
| # setup-beam v1.24.0's OS-map doesn't recognise — it only knows | |
| # `ubuntu24`. This job runs on x86_64 ubuntu-24.04 (already | |
| # `ubuntu24`, so this is a no-op), but the override is kept in | |
| # lockstep with release.yml's setup-beam blocks. Drop once a newer | |
| # setup-beam maps `ubuntu24-arm64` natively. | |
| ImageOS: ubuntu24 | |
| with: | |
| elixir-version: '1.20.1' | |
| # Exact patch pin matching .tool-versions. Keep in lockstep with | |
| # the setup-beam blocks in release.yml (Beam Machine ERTS confirmed | |
| # published for 29.0.2 on all four Burrito targets, 2026-06-12). | |
| otp-version: '29.0.2' | |
| - name: Install integration system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y bubblewrap inotify-tools build-essential | |
| # Ubuntu 24.04's passt package predates --splice-only, which the | |
| # proxy-netns security tests require. Fetch the immutable commit | |
| # behind upstream tag 2026_06_11.a9c61ff and verify HEAD before | |
| # executing its Makefile. | |
| git init /tmp/passt | |
| git -C /tmp/passt remote add origin https://passt.top/passt | |
| git -C /tmp/passt fetch --depth 1 origin a9c61ffaf15347b8dfcc2347c5440e4b0e82333b | |
| git -C /tmp/passt checkout --detach a9c61ffaf15347b8dfcc2347c5440e4b0e82333b | |
| test "$(git -C /tmp/passt rev-parse HEAD)" = a9c61ffaf15347b8dfcc2347c5440e4b0e82333b | |
| make -C /tmp/passt pasta | |
| sudo install -m 0755 /tmp/passt/pasta /usr/local/bin/pasta | |
| bwrap --version | |
| command -v inotifywait | |
| pasta --help | grep -q -- --splice-only | |
| - name: Allow bwrap + pasta under AppArmor (Ubuntu 24.04 userns restriction) | |
| run: | | |
| # Ubuntu 24.04 ships kernel.apparmor_restrict_unprivileged_userns=1, | |
| # which blocks both bwrap's --unshare-net and pasta's uid_map setup. | |
| # Install unconfined profiles with the userns permission for exactly | |
| # the two sandbox launchers; do not weaken the host-wide sysctl. | |
| # Refs: containers/bubblewrap#632, ocaml/opam#5968, Ubuntu 23.10 blog. | |
| sudo tee /etc/apparmor.d/glorbo-ci-userns > /dev/null <<'EOF' | |
| abi <abi/4.0>, | |
| include <tunables/global> | |
| profile bwrap /usr/bin/bwrap flags=(unconfined) { | |
| userns, | |
| include if exists <local/bwrap> | |
| } | |
| profile pasta /usr/local/bin/pasta flags=(unconfined) { | |
| userns, | |
| } | |
| EOF | |
| sudo systemctl reload apparmor | |
| - name: Cache mix deps + build | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| deps | |
| _build | |
| key: mix-x86_64-${{ hashFiles('mix.lock') }} | |
| restore-keys: mix-x86_64- | |
| - name: Fetch deps | |
| run: mix deps.get | |
| - name: Compile (warnings as errors) | |
| run: mix compile --warnings-as-errors | |
| - name: Test | |
| run: mix test | |
| - name: Integration test | |
| run: mix test --only integration | |
| - name: Credo (strict) | |
| run: mix credo --strict | |
| - name: Format check | |
| run: mix format --check-formatted | |
| - name: Sobelow (SAST) | |
| # Reads .sobelow-conf (exit: true + documented ignore list). | |
| # Fails the build on any non-ignored finding. See .sobelow-conf | |
| # for the per-check false-positive rationale. | |
| run: mix sobelow --exit | |
| - name: Hex audit (dependency retirements) | |
| run: mix hex.audit | |
| - name: Dependency audit (mix_audit / advisories) | |
| # GHSA-rhv4-8758-jx7v (decimal unbounded-exponent DoS) is ignored: | |
| # it is first patched in decimal 3.0.0, but our dependency tree | |
| # (ecto family) constrains decimal to `~> 2.0`, so 3.0.0 is not | |
| # installable until those upstreams widen their constraint. The | |
| # advisory is MODERATE and requires parsing attacker-controlled | |
| # decimal strings with huge exponents — Glorbo does not parse | |
| # untrusted decimals (budgets are integer cents). Re-evaluate when | |
| # the ecto family allows decimal 3.x. | |
| run: mix deps.audit --ignore-advisory-ids "GHSA-rhv4-8758-jx7v" | |
| # Dialyzer (success-typing static analysis). Count-regression gate: the | |
| # codebase has a documented baseline of pre-existing warnings | |
| # (docs/testing/dialyzer-baseline.md); CI fails only when the count | |
| # EXCEEDS the baseline, i.e. a change introduced a NEW typing error. | |
| # Burn the baseline down over time, then make it blocking outright. | |
| - name: Cache Dialyzer PLT | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: _build/dialyzer_plts | |
| # Bumped key prefix (`plt2-`) after the codex-deep-dive PLT | |
| # relocation: PLTs moved from `priv/plts` (which Mix releases | |
| # bundle as runtime data) into `_build/dialyzer_plts` (release- | |
| # excluded). Old cache entries still point at the old path; the | |
| # key bump forces a one-time rebuild. | |
| key: plt2-ubuntu24-otp29.0.2-ex1.20.1-${{ hashFiles('mix.lock') }} | |
| restore-keys: plt2-ubuntu24-otp29.0.2-ex1.20.1- | |
| - name: Dialyzer (type analysis — fails on NEW warnings vs baseline) | |
| run: | | |
| # Build the PLT first so a genuine PLT build error fails the step | |
| # (rather than being masked by the `|| true` on the analysis run). | |
| mix dialyzer --plt | |
| mix dialyzer --format short > dialyzer.out 2>&1 || true | |
| count=$(grep -cE '^(lib|lib_dev|test)/[^[:space:]]+:[0-9]+' dialyzer.out || true) | |
| # Baseline history lives in docs/testing/dialyzer-baseline.md. | |
| # Measured at 126 on Elixir 1.20 / OTP 29 during the 2026-07-10 | |
| # stabilization pass; keep this ceiling equal to the checked tree. | |
| baseline=126 | |
| echo "Dialyzer warnings: ${count} (baseline ${baseline})" | |
| if [ "${count}" -gt "${baseline}" ]; then | |
| echo "::error::Dialyzer warnings increased (${count} > ${baseline}) — a change introduced a new typing error. See docs/testing/dialyzer-baseline.md." | |
| grep -E '^(lib|lib_dev|test)/' dialyzer.out || true | |
| exit 1 | |
| fi |