add chainguard osv feed #3222
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Validations" | |
| on: | |
| # needed so check results exist on main commits for downstream gates (publish-commit-image.yaml, release.yaml) | |
| push: | |
| branches: | |
| - main | |
| # needed when running from forks | |
| pull_request: | |
| permissions: {} | |
| jobs: | |
| # note: the name for this check is referenced in release.yaml, do not change here without changing there | |
| Static-Analysis: | |
| name: "Static Analysis" | |
| runs-on: runs-on=${{ github.run_id }}/cpu=2/ram=4+8/family=t4g+t3a+t3+m6g+m6a/spot=price-capacity-optimized/retry=when-interrupted | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 #v2.1.2 | |
| if: ${{ vars.TRACK_RESOURCE_METRICS != '' }} | |
| with: | |
| metrics: ${{ vars.TRACK_RESOURCE_METRICS }} | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 | |
| with: | |
| # in order to properly resolve the version from git | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| - name: Run static analysis | |
| run: make static-analysis | |
| - name: Ensure quality gate tools are properly configured | |
| run: | | |
| cd tests/quality && make validate-test-tool-versions | |
| Discover-Test-Envs: | |
| runs-on: runs-on=${{ github.run_id }}/cpu=2/ram=4+8/family=t4g+t3a+t3+m6g+m6a/spot=price-capacity-optimized/retry=when-interrupted | |
| permissions: | |
| contents: read | |
| outputs: | |
| envs: ${{ steps.get-envs.outputs.envs }} | |
| steps: | |
| - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 #v2.1.2 | |
| if: ${{ vars.TRACK_RESOURCE_METRICS != '' }} | |
| with: | |
| metrics: ${{ vars.TRACK_RESOURCE_METRICS }} | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| - name: Get tox environments | |
| id: get-envs | |
| run: | | |
| envs=$(uv run tox -l | jq -R -s -c 'split("\n") | map(select(length > 0))') | |
| echo "envs=$envs" >> $GITHUB_OUTPUT | |
| Test: | |
| needs: Discover-Test-Envs | |
| runs-on: runs-on=${{ github.run_id }}-test-${{ strategy.job-index }}/cpu=2/ram=4+8/family=t4g+t3a+t3+m6g+m6a/spot=price-capacity-optimized/retry=when-interrupted | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| toxenv: ${{ fromJson(needs.Discover-Test-Envs.outputs.envs) }} | |
| steps: | |
| - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 #v2.1.2 | |
| if: ${{ vars.TRACK_RESOURCE_METRICS != '' }} | |
| with: | |
| metrics: ${{ vars.TRACK_RESOURCE_METRICS }} | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 | |
| with: | |
| # in order to properly resolve the version from git | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| - name: Run unit tests | |
| env: | |
| TOXENV: ${{ matrix.toxenv }} | |
| run: uv run tox -e "$TOXENV" | |
| - name: Build assets | |
| run: make build | |
| # this is to help facilitate ensuring all checks have run with the checks API for release | |
| # see https://github.com/orgs/community/discussions/26822#discussioncomment-3305794 | |
| # as well as the release.yaml workflow | |
| Test-Gate: | |
| if: ${{ always() }} | |
| runs-on: runs-on=${{ github.run_id }}/cpu=2/ram=4+8/family=t4g+t3a+t3+m6g+m6a/spot=price-capacity-optimized/retry=when-interrupted | |
| name: Test Gate | |
| needs: [Test] | |
| steps: | |
| - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 #v2.1.2 | |
| if: ${{ vars.TRACK_RESOURCE_METRICS != '' }} | |
| with: | |
| metrics: ${{ vars.TRACK_RESOURCE_METRICS }} | |
| - env: | |
| TEST_RESULT: ${{ needs.Test.result }} | |
| run: | | |
| if [[ $TEST_RESULT == "success" || $TEST_RESULT == "skipped" ]]; then | |
| exit 0 | |
| else | |
| exit 1 | |
| fi |