feat: fetch GHSA data for dart and swift (#302) #781
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Validations" | |
| on: | |
| # needed for publishing commit images on the main branch | |
| push: | |
| branches: | |
| - main | |
| # needed when running from forks | |
| pull_request: | |
| jobs: | |
| # note: the name for this check is referenced in release.yaml, do not change here without changing there | |
| Validations: | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac #v4.0.0 | |
| with: | |
| # in order to properly resolve the version from git | |
| fetch-depth: 0 | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| - name: Run static analysis | |
| run: poetry run make static-analysis | |
| - name: Run unit tests | |
| run: poetry run make unit | |
| - name: Ensure quality gate tools are properly configured | |
| run: | | |
| cd tests/quality && make validate-test-tool-versions | |
| - name: Build assets | |
| run: poetry run make build | |
| Publish-PreProd: | |
| runs-on: ubuntu-22.04 | |
| needs: [Validations] | |
| if: github.ref == 'refs/heads/main' | |
| permissions: | |
| contents: read | |
| # package write permission is needed for publishing commit images | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac #v4.0.0 | |
| with: | |
| # in order to properly resolve the version from git | |
| fetch-depth: 0 | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| - name: Login to ghcr.io | |
| run: | | |
| echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io --username ${{ github.actor }} --password-stdin | |
| - name: Build assets | |
| run: poetry run make build | |
| - name: Publish commit image | |
| run: make ci-publish-commit | |
| - name: Publish to test PyPI | |
| run: make ci-publish-testpypi | |
| env: | |
| # note: "..._TESTPYPI" suffix should match the name of the testpypi repository (see the Makefile target) | |
| POETRY_PYPI_TOKEN_TESTPYPI: ${{ secrets.TEST_PYPI_TOKEN }} |