Secure GitHub actions #143

	name: CI

	on:
	push:
	branches: [ main ]
	pull_request:
	branches: [ main ]

	permissions:
	contents: read

	jobs:
	build:
	name: build ${{ matrix.binding }}
	runs-on: ubuntu-latest
	strategy:
	matrix:
	binding: [pixel_bridge, deflate, saphyr, serde_json, zip]
	steps:
	- name: Checkout code
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	persist-credentials: false

	- name: Set up Rust
	uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
	with:
	# NOTE: b/514328084 - Crubit generates some code that causes unused-imports warnings. By
	# default rustflags is "-D warnings" causing the build to fail.
	rustflags: ""

	- name: Install Protobuf
	if: matrix.binding == 'serde_json'
	run: sudo apt-get update && sudo apt-get install -y libprotobuf-dev protobuf-compiler

	- name: Configure CMake
	run: cmake -B build -S ${{ matrix.binding }}

	- name: Build
	run: cmake --build build --parallel

	summary:
	name: summary
	needs: build
	runs-on: ubuntu-latest
	steps:
	- name: Complete
	run: echo "All bindings built successfully!"

Provide feedback