Skip to content

Commit

Permalink
chore: Add update nix direnv workflow
Browse files Browse the repository at this point in the history
  • Loading branch information
jmuelbert committed Nov 8, 2024
1 parent 1dbadbc commit 61f034b
Show file tree
Hide file tree
Showing 3 changed files with 100 additions and 75 deletions.
25 changes: 25 additions & 0 deletions .github/workflows/update-nix-direnv.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
name: Update nix-direnv
"on":
schedule:
- cron: 0 0 16 * *
workflow_dispatch:
permissions:
contents: write

Check failure

Code scanning / Scorecard

Token-Permissions High

score is 0: topLevel 'contents' permission set to 'write'
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow.
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help
pull-requests: write
jobs:
update-nix-direnv:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Update nix-direnv to the latest version
run: nix run '.#update-nix-direnv'
- name: Create Pull Request
uses: peter-evans/create-pull-request@v7

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
with:
assignees: ${{ github.repository_owner }}
branch: update/nix-direnv
commit-message: "chore(deps): Update nix-direnv"
title: "chore(deps): Update nix-direnv"
token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
38 changes: 19 additions & 19 deletions .github/workflows/yamllint.yaml
Original file line number Diff line number Diff line change
@@ -1,27 +1,27 @@
name: yamllint

Check failure

Code scanning / Scorecard

Token-Permissions High

score is 0: no topLevel permission defined
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow.
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help

Check failure on line 1 in .github/workflows/yamllint.yaml

View check run for this annotation

Trunk.io / Trunk Check

checkov(CKV2_GHA_1)

[new] Ensure top-level permissions are not set to write-all
"on":
pull_request:
branches: ["main"]
branches: [main]
paths:
- '**.nix'
- '**.yaml'
- '**.yml'
- .github/workflows/yamllint.yaml
- flake.lock
- '**.nix'
- '**.yaml'
- '**.yml'
- .github/workflows/yamllint.yaml
- flake.lock
push:
branches: ["main"]
branches: [main]
paths:
- '**.nix'
- '**.yaml'
- '**.yml'
- .github/workflows/yamllint.yaml
- flake.lock
- '**.nix'
- '**.yaml'
- '**.yml'
- .github/workflows/yamllint.yaml
- flake.lock
jobs:
yamllint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: DeterminateSystems/nix-installer-action@v14
- uses: DeterminateSystems/magic-nix-cache-action@v8
- name: Check YAML files
yamllint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Check YAML files
run: nix develop --command yamllint --format github .
112 changes: 56 additions & 56 deletions flake.nix
Original file line number Diff line number Diff line change
Expand Up @@ -34,63 +34,63 @@
, pre-commit-hooks
, treefmt-nix
,
};
}:
flake-utils.lib.eachDefaultSystem (
system:
let
overlays = [ ];
pkgs = import nixpkgs {
inherit system overlays;
};
pre-commit = pre-commit-hooks.lib.${system}.run (
import ./pre-commit-hooks.nix { inherit pkgs treefmtEval; }
);
treefmtEval = treefmt-nix.lib.evalModule pkgs ./treefmt-nix;
in
with pkgs;
{
apps = {
inherit (pre-commit) shellHook;
buildInputs = with pkgs; [
microsoft-gsl
qt6.qtbase
qt6.wayland
ut
];
nativeBuildInputs =
[
appstream
appstream-glib
asciidoctor
ccache
clang
clang-tools
cmake
desktop-file-utils
fish
flatpak-builder
gdb
include-what-you-use
just
lonv
librsvg
lldb
llvm
lychee
mold-wrapped
nil
ninja
nushell
python311Packages.lcov-cobertura
qt6.wrapQtAppsHook
treefmtEcal.config.build.wrapper
(builtins.attrValues treefmtEval.config.build.programs)
]
++ pre-commit.enabledPackages;
};
formatter = treefmtEval.config.build.wrapper;
packages.default = qt6Packages.callPackage ./package.nix { };
}
system:
let
overlays = [ ];
pkgs = import nixpkgs {
inherit system overlays;
};
pre-commit = pre-commit-hooks.lib.${system}.run (
import ./pre-commit-hooks.nix { inherit pkgs treefmtEval; }
);
treefmtEval = treefmt-nix.lib.evalModule pkgs ./treefmt-nix;
in
with pkgs;
{
apps = {
inherit (pre-commit) shellHook;
buildInputs = with pkgs; [
microsoft-gsl
qt6.qtbase
qt6.wayland
ut
];
nativeBuildInputs =
[
appstream
appstream-glib
asciidoctor
ccache
clang
clang-tools
cmake
desktop-file-utils
fish
flatpak-builder
gdb
include-what-you-use
just
lonv
librsvg
lldb
llvm
lychee
mold-wrapped
nil
ninja
nushell
python311Packages.lcov-cobertura
qt6.wrapQtAppsHook
treefmtEcal.config.build.wrapper
(builtins.attrValues treefmtEval.config.build.programs)
]
++ pre-commit.enabledPackages;
};
formatter = treefmtEval.config.build.wrapper;
packages.default = qt6Packages.callPackage ./package.nix { };
}

);
}

0 comments on commit 61f034b

Please sign in to comment.