Add lists for privately disclosing vulns downstream #293
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This GitHub workflow config has been generated by a script via | |
| # | |
| # haskell-ci 'github' '--haddock' '--hlint' '--hlint-job' '9.4.5' '--github-patches' '.github/haskell-ci.patch' 'code/hsec-tools/hsec-tools.cabal' | |
| # | |
| # To regenerate the script (for example after adjusting tested-with) run | |
| # | |
| # haskell-ci regenerate | |
| # | |
| # For more information, see https://github.com/haskell-CI/haskell-ci | |
| # | |
| # version: 0.16.3 | |
| # | |
| # REGENDATA ("0.16.3",["github","--haddock","--hlint","--hlint-job","9.4.5","--github-patches",".github/haskell-ci.patch","code/hsec-tools/hsec-tools.cabal"]) | |
| # | |
| name: Haskell-CI | |
| on: | |
| - push | |
| - pull_request | |
| jobs: | |
| tools_changed: | |
| continue-on-error: true | |
| runs-on: ubuntu-20.04 | |
| outputs: | |
| should_skip: ${{ steps.skip_check.outputs.should_skip }} | |
| steps: | |
| - id: skip_check | |
| uses: fkirc/[email protected] | |
| with: | |
| concurrent_skipping: "never" | |
| skip_after_successful_duplicate: "true" | |
| paths: '["code/**"]' | |
| do_not_skip: '["push", "workflow_dispatch", "schedule"]' | |
| linux: | |
| name: Haskell-CI - Linux - ${{ matrix.compiler }} | |
| needs: tools_changed | |
| if: ${{ needs.tools_changed.outputs.should_skip != 'true' }} | |
| runs-on: ubuntu-20.04 | |
| timeout-minutes: | |
| 60 | |
| container: | |
| image: buildpack-deps:bionic | |
| continue-on-error: ${{ matrix.allow-failure }} | |
| strategy: | |
| matrix: | |
| include: | |
| - compiler: ghc-9.6.2 | |
| compilerKind: ghc | |
| compilerVersion: 9.6.2 | |
| setup-method: ghcup | |
| allow-failure: false | |
| - compiler: ghc-9.4.5 | |
| compilerKind: ghc | |
| compilerVersion: 9.4.5 | |
| setup-method: ghcup | |
| allow-failure: false | |
| - compiler: ghc-9.2.7 | |
| compilerKind: ghc | |
| compilerVersion: 9.2.7 | |
| setup-method: ghcup | |
| allow-failure: false | |
| - compiler: ghc-9.0.2 | |
| compilerKind: ghc | |
| compilerVersion: 9.0.2 | |
| setup-method: ghcup | |
| allow-failure: false | |
| - compiler: ghc-8.10.7 | |
| compilerKind: ghc | |
| compilerVersion: 8.10.7 | |
| setup-method: ghcup | |
| allow-failure: false | |
| fail-fast: false | |
| steps: | |
| - name: apt | |
| run: | | |
| apt-get update | |
| apt-get install -y --no-install-recommends gnupg ca-certificates dirmngr curl git software-properties-common libtinfo5 | |
| mkdir -p "$HOME/.ghcup/bin" | |
| curl -sL https://downloads.haskell.org/ghcup/0.1.19.2/x86_64-linux-ghcup-0.1.19.2 > "$HOME/.ghcup/bin/ghcup" | |
| chmod a+x "$HOME/.ghcup/bin/ghcup" | |
| "$HOME/.ghcup/bin/ghcup" install ghc "$HCVER" || (cat "$HOME"/.ghcup/logs/*.* && false) | |
| "$HOME/.ghcup/bin/ghcup" install cabal 3.10.1.0 || (cat "$HOME"/.ghcup/logs/*.* && false) | |
| env: | |
| HCKIND: ${{ matrix.compilerKind }} | |
| HCNAME: ${{ matrix.compiler }} | |
| HCVER: ${{ matrix.compilerVersion }} | |
| - name: Set PATH and environment variables | |
| run: | | |
| echo "$HOME/.cabal/bin" >> $GITHUB_PATH | |
| echo "LANG=C.UTF-8" >> "$GITHUB_ENV" | |
| echo "CABAL_DIR=$HOME/.cabal" >> "$GITHUB_ENV" | |
| echo "CABAL_CONFIG=$HOME/.cabal/config" >> "$GITHUB_ENV" | |
| HCDIR=/opt/$HCKIND/$HCVER | |
| HC=$HOME/.ghcup/bin/$HCKIND-$HCVER | |
| echo "HC=$HC" >> "$GITHUB_ENV" | |
| echo "HCPKG=$HOME/.ghcup/bin/$HCKIND-pkg-$HCVER" >> "$GITHUB_ENV" | |
| echo "HADDOCK=$HOME/.ghcup/bin/haddock-$HCVER" >> "$GITHUB_ENV" | |
| echo "CABAL=$HOME/.ghcup/bin/cabal-3.10.1.0 -vnormal+nowrap" >> "$GITHUB_ENV" | |
| HCNUMVER=$(${HC} --numeric-version|perl -ne '/^(\d+)\.(\d+)\.(\d+)(\.(\d+))?$/; print(10000 * $1 + 100 * $2 + ($3 == 0 ? $5 != 1 : $3))') | |
| echo "HCNUMVER=$HCNUMVER" >> "$GITHUB_ENV" | |
| echo "ARG_TESTS=--enable-tests" >> "$GITHUB_ENV" | |
| echo "ARG_BENCH=--enable-benchmarks" >> "$GITHUB_ENV" | |
| echo "HEADHACKAGE=false" >> "$GITHUB_ENV" | |
| echo "ARG_COMPILER=--$HCKIND --with-compiler=$HC" >> "$GITHUB_ENV" | |
| echo "GHCJSARITH=0" >> "$GITHUB_ENV" | |
| env: | |
| HCKIND: ${{ matrix.compilerKind }} | |
| HCNAME: ${{ matrix.compiler }} | |
| HCVER: ${{ matrix.compilerVersion }} | |
| - name: env | |
| run: | | |
| env | |
| - name: write cabal config | |
| run: | | |
| mkdir -p $CABAL_DIR | |
| cat >> $CABAL_CONFIG <<EOF | |
| remote-build-reporting: anonymous | |
| write-ghc-environment-files: never | |
| remote-repo-cache: $CABAL_DIR/packages | |
| logs-dir: $CABAL_DIR/logs | |
| world-file: $CABAL_DIR/world | |
| extra-prog-path: $CABAL_DIR/bin | |
| symlink-bindir: $CABAL_DIR/bin | |
| installdir: $CABAL_DIR/bin | |
| build-summary: $CABAL_DIR/logs/build.log | |
| store-dir: $CABAL_DIR/store | |
| install-dirs user | |
| prefix: $CABAL_DIR | |
| repository hackage.haskell.org | |
| url: http://hackage.haskell.org/ | |
| EOF | |
| cat >> $CABAL_CONFIG <<EOF | |
| program-default-options | |
| ghc-options: $GHCJOBS +RTS -M3G -RTS | |
| EOF | |
| cat $CABAL_CONFIG | |
| - name: versions | |
| run: | | |
| $HC --version || true | |
| $HC --print-project-git-commit-id || true | |
| $CABAL --version || true | |
| - name: update cabal index | |
| run: | | |
| $CABAL v2-update -v | |
| - name: cache (tools) | |
| uses: actions/cache/restore@v3 | |
| with: | |
| key: ${{ runner.os }}-${{ matrix.compiler }}-tools-6b1f90a1 | |
| path: ~/.haskell-ci-tools | |
| - name: install cabal-plan | |
| run: | | |
| mkdir -p $HOME/.cabal/bin | |
| curl -sL https://github.com/haskell-hvr/cabal-plan/releases/download/v0.7.3.0/cabal-plan-0.7.3.0-x86_64-linux.xz > cabal-plan.xz | |
| echo 'f62ccb2971567a5f638f2005ad3173dba14693a45154c1508645c52289714cb2 cabal-plan.xz' | sha256sum -c - | |
| xz -d < cabal-plan.xz > $HOME/.cabal/bin/cabal-plan | |
| rm -f cabal-plan.xz | |
| chmod a+x $HOME/.cabal/bin/cabal-plan | |
| cabal-plan --version | |
| - name: install hlint | |
| run: | | |
| if [ $((HCNUMVER >= 90400 && HCNUMVER < 90600)) -ne 0 ] ; then HLINTVER=$(cd /tmp && (${CABAL} v2-install -v $ARG_COMPILER --dry-run hlint --constraint='hlint >=3.5 && <3.6' | perl -ne 'if (/\bhlint-(\d+(\.\d+)*)\b/) { print "$1"; last; }')); echo "HLint version $HLINTVER" ; fi | |
| if [ $((HCNUMVER >= 90400 && HCNUMVER < 90600)) -ne 0 ] ; then if [ ! -e $HOME/.haskell-ci-tools/hlint-$HLINTVER/hlint ]; then echo "Downloading HLint version $HLINTVER"; mkdir -p $HOME/.haskell-ci-tools; curl --write-out 'Status Code: %{http_code} Redirects: %{num_redirects} Total time: %{time_total} Total Dsize: %{size_download}\n' --silent --location --output $HOME/.haskell-ci-tools/hlint-$HLINTVER.tar.gz "https://github.com/ndmitchell/hlint/releases/download/v$HLINTVER/hlint-$HLINTVER-x86_64-linux.tar.gz"; tar -xzv -f $HOME/.haskell-ci-tools/hlint-$HLINTVER.tar.gz -C $HOME/.haskell-ci-tools; fi ; fi | |
| if [ $((HCNUMVER >= 90400 && HCNUMVER < 90600)) -ne 0 ] ; then mkdir -p $CABAL_DIR/bin && ln -sf "$HOME/.haskell-ci-tools/hlint-$HLINTVER/hlint" $CABAL_DIR/bin/hlint ; fi | |
| if [ $((HCNUMVER >= 90400 && HCNUMVER < 90600)) -ne 0 ] ; then hlint --version ; fi | |
| - name: save cache (tools) | |
| uses: actions/cache/save@v3 | |
| if: always() | |
| with: | |
| key: ${{ runner.os }}-${{ matrix.compiler }}-tools-6b1f90a1 | |
| path: ~/.haskell-ci-tools | |
| - name: checkout | |
| uses: actions/checkout@v3 | |
| with: | |
| path: source | |
| - name: initial cabal.project for sdist | |
| run: | | |
| touch cabal.project | |
| echo "packages: $GITHUB_WORKSPACE/source/code/hsec-tools" >> cabal.project | |
| cat cabal.project | |
| - name: sdist | |
| run: | | |
| mkdir -p sdist | |
| $CABAL sdist all --output-dir $GITHUB_WORKSPACE/sdist | |
| - name: unpack | |
| run: | | |
| mkdir -p unpacked | |
| find sdist -maxdepth 1 -type f -name '*.tar.gz' -exec tar -C $GITHUB_WORKSPACE/unpacked -xzvf {} \; | |
| - name: generate cabal.project | |
| run: | | |
| PKGDIR_hsec_tools="$(find "$GITHUB_WORKSPACE/unpacked" -maxdepth 1 -type d -regex '.*/hsec-tools-[0-9.]*')" | |
| echo "PKGDIR_hsec_tools=${PKGDIR_hsec_tools}" >> "$GITHUB_ENV" | |
| rm -f cabal.project cabal.project.local | |
| touch cabal.project | |
| touch cabal.project.local | |
| echo "packages: ${PKGDIR_hsec_tools}" >> cabal.project | |
| echo "package hsec-tools" >> cabal.project | |
| echo " ghc-options: -Werror=missing-methods" >> cabal.project | |
| cat >> cabal.project <<EOF | |
| EOF | |
| $HCPKG list --simple-output --names-only | perl -ne 'for (split /\s+/) { print "constraints: $_ installed\n" unless /^(hsec-tools)$/; }' >> cabal.project.local | |
| cat cabal.project | |
| cat cabal.project.local | |
| - name: dump install plan | |
| run: | | |
| $CABAL v2-build $ARG_COMPILER $ARG_TESTS $ARG_BENCH --dry-run all | |
| cabal-plan | |
| - name: restore cache | |
| uses: actions/cache/restore@v3 | |
| with: | |
| key: ${{ runner.os }}-${{ matrix.compiler }}-${{ github.sha }} | |
| path: ~/.cabal/store | |
| restore-keys: ${{ runner.os }}-${{ matrix.compiler }}- | |
| - name: install dependencies | |
| run: | | |
| $CABAL v2-build $ARG_COMPILER --disable-tests --disable-benchmarks --dependencies-only -j2 all | |
| $CABAL v2-build $ARG_COMPILER $ARG_TESTS $ARG_BENCH --dependencies-only -j2 all | |
| - name: build w/o tests | |
| run: | | |
| $CABAL v2-build $ARG_COMPILER --disable-tests --disable-benchmarks all | |
| - name: build | |
| run: | | |
| $CABAL v2-build $ARG_COMPILER $ARG_TESTS $ARG_BENCH all --write-ghc-environment-files=always | |
| - name: tests | |
| run: | | |
| $CABAL v2-test $ARG_COMPILER $ARG_TESTS $ARG_BENCH all --test-show-details=direct | |
| - name: hlint | |
| run: | | |
| if [ $((HCNUMVER >= 90400 && HCNUMVER < 90600)) -ne 0 ] ; then (cd ${PKGDIR_hsec_tools} && hlint -XHaskell2010 src) ; fi | |
| if [ $((HCNUMVER >= 90400 && HCNUMVER < 90600)) -ne 0 ] ; then (cd ${PKGDIR_hsec_tools} && hlint -XHaskell2010 app) ; fi | |
| - name: cabal check | |
| run: | | |
| cd ${PKGDIR_hsec_tools} || false | |
| ${CABAL} -vnormal check | |
| - name: haddock | |
| run: | | |
| $CABAL v2-haddock --disable-documentation --haddock-all $ARG_COMPILER --with-haddock $HADDOCK $ARG_TESTS $ARG_BENCH all | |
| - name: unconstrained build | |
| run: | | |
| rm -f cabal.project.local | |
| $CABAL v2-build $ARG_COMPILER --disable-tests --disable-benchmarks all | |
| - name: save cache | |
| uses: actions/cache/save@v3 | |
| if: always() | |
| with: | |
| key: ${{ runner.os }}-${{ matrix.compiler }}-${{ github.sha }} | |
| path: ~/.cabal/store |