Pin GitHub Actions to commit SHAs #5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/github-workflow.json | |
| name: .NET | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| env: | |
| DOTNET_NOLOGO: true | |
| DOTNET_CLI_TELEMETRY_OPTOUT: true | |
| DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true | |
| NUGET_XMLDOC_MODE: '' | |
| DOTNET_MULTILEVEL_LOOKUP: 0 | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 # so that NerdBank.GitVersioning has access to history | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 | |
| with: | |
| extra_nix_config: | | |
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} | |
| - name: Restore dependencies | |
| run: nix develop --command dotnet restore | |
| - name: Build | |
| run: nix develop --command dotnet build --no-restore --configuration Release | |
| - name: Test | |
| run: nix develop --command dotnet test | |
| build-nix: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 | |
| with: | |
| extra_nix_config: | | |
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} | |
| - name: Build | |
| run: nix build | |
| - name: Reproducibility check | |
| run: nix build --rebuild | |
| check-dotnet-format: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 | |
| with: | |
| extra_nix_config: | | |
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} | |
| - name: Run Fantomas | |
| run: nix run .#fantomas -- --check . | |
| check-nix-format: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 | |
| with: | |
| extra_nix_config: | | |
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} | |
| - name: Run Alejandra | |
| run: nix develop --command alejandra --check . | |
| flake-check: | |
| name: Check flake | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 | |
| with: | |
| extra_nix_config: | | |
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} | |
| - name: Flake check | |
| run: nix flake check | |
| linkcheck: | |
| name: Check links | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31 | |
| with: | |
| extra_nix_config: | | |
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} | |
| - name: Run link checker | |
| run: nix develop --command markdown-link-check README.md | |
| nuget-pack: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 # so that NerdBank.GitVersioning has access to history | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31 | |
| with: | |
| extra_nix_config: | | |
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} | |
| - name: Restore dependencies | |
| run: nix develop --command dotnet restore | |
| - name: Build | |
| run: nix develop --command dotnet build --no-restore --configuration Release | |
| - name: Pack | |
| run: nix develop --command dotnet pack --configuration Release | |
| - name: Upload NuGet artifact | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: nuget-package | |
| path: FicroKanSharp/bin/Release/FicroKanSharp.*.nupkg | |
| expected-pack: | |
| needs: [nuget-pack] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Download NuGet artifact | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 | |
| with: | |
| name: nuget-package | |
| path: packed | |
| - name: Check NuGet contents | |
| # Verify that there is exactly one nupkg in the artifact that would be NuGet published | |
| run: if [[ $(find packed -maxdepth 1 -name 'FicroKanSharp.*.nupkg' -printf c | wc -c) -ne "1" ]]; then exit 1; fi | |
| all-required-checks-complete: | |
| if: ${{ always() }} | |
| needs: [check-dotnet-format, check-nix-format, build, build-nix, flake-check, nuget-pack, expected-pack] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: G-Research/common-actions/check-required-lite@2b7dc49cb14f3344fbe6019c14a31165e258c059 | |
| with: | |
| needs-context: ${{ toJSON(needs) }} | |