Skip to content

chore(deps): bump the all-actions group across 1 directory with 10 updates #1800

chore(deps): bump the all-actions group across 1 directory with 10 updates

chore(deps): bump the all-actions group across 1 directory with 10 updates #1800

Workflow file for this run

# SPDX-License-Identifier: Apache-2.0
name: Build
on:
push:
branches:
- main
- release/*
pull_request:
branches:
- main
- release/*
workflow_dispatch:
defaults:
run:
shell: bash
permissions:
packages: write
contents: read
issues: read
checks: write
pull-requests: write
actions: read
statuses: write
env:
LC_ALL: C.UTF-8
GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
CG_EXEC: ionice -c 2 -n 2 nice -n 19
jobs:
build_rust_macos:
# Build macOS Rust targets separately on a macOS runner to have access to macOS SDKs
name: Build Rust - macOS
runs-on: macos-14
steps:
- name: Harden Runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
with:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Install go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: "1.24.2"
- name: Setup Java
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: temurin
java-version: 25.0.2
- name: Setup Gradle
uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
with:
cache-read-only: false
- name: Build Cargo Darwin
run: ./gradlew cargoBuildX86Darwin cargoBuildAarch64Darwin
- name: Build libsodium darwin-arm64
run: ./gradlew :libsodium:build
- name: Build libsodium darwin-amd64
run: HIERO_LIBSODIUM_TARGET=darwin-amd64 HIERO_LIBSODIUM_CONFIGURE_HOST=x86_64-apple-darwin ./gradlew :libsodium:assemble
build_rust_linux_windows:
name: Build Rust - Linux / Windows
runs-on: hl-crypto-lin-md
steps:
- name: Harden Runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
with:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Install go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: "1.24.2"
- name: Setup Java
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: temurin
java-version: 25.0.2
- name: Setup Gradle
uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
with:
cache-read-only: false
- name: Setup clang-tools (Windows cross-compile)
# Make sure 'clang-cl' and 'llvm-lib' are installed for compiling crates with C++ code for Windows
# https://github.com/hiero-ledger/hiero-gradle-conventions/issues/97
# Also install g++-aarch64-linux-gnu because the compressor build via Rust/Go needs it.
# Finally, install mingw that we use to build for Windows target.
run: |
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 15CF4D18AF4F7421
sudo add-apt-repository deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-19 main
sudo apt-get update
sudo apt-get -y install clang-tools-19
sudo ln -s /usr/bin/clang-cl-19 /usr/bin/clang-cl
sudo ln -s /usr/bin/llvm-lib-19 /usr/bin/llvm-lib
clang-cl -v
llvm-lib -v
sudo apt-get -y install g++-aarch64-linux-gnu
sudo apt-get -y install binutils-aarch64-linux-gnu
sudo apt-get -y install mingw-w64
- name: Build Cargo Linux / Windows
run: ./gradlew cargoBuildX86Linux cargoBuildAarch64Linux cargoBuildX86Windows
- name: Build libsodium linux-amd64
run: ./gradlew :libsodium:build
- name: Build libsodium linux-arm64
run: HIERO_LIBSODIUM_TARGET=linux-arm64 HIERO_LIBSODIUM_CONFIGURE_HOST=aarch64-linux-gnu ./gradlew :libsodium:assemble
- name: Build libsodium windows-amd64
run: HIERO_LIBSODIUM_TARGET=windows-amd64 HIERO_LIBSODIUM_CONFIGURE_HOST=x86_64-w64-mingw32 ./gradlew :libsodium:assemble
build:
name: Build TSS Crypto Library
needs:
- build_rust_macos
- build_rust_linux_windows
runs-on: hl-crypto-lin-lg
steps:
- name: Harden Runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
with:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
fetch-depth: 0
- name: Setup Java
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: temurin
java-version: 25.0.2
- name: Setup Gradle
uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
with:
cache-read-only: false
- name: Build software
run: ./gradlew -PskipInstallRustToolchains=true assemble
- name: Code Quality Checks
run: ./gradlew -PskipInstallRustToolchains=true qualityCheck --continue
- name: Gradle Unit Test
run: ${CG_EXEC} ./gradlew -PskipInstallRustToolchains=true test :aggregation:testCodeCoverageReport --continue
- name: Publish Unit Test Results
uses: step-security/publish-unit-test-result-action@681100d67b09305624c089873f12c545ee7cbc24 # v2.23.0
with:
files: "**/build/test-results/test/TEST-*.xml"
test-cross-platform:
name: Test on ${{ matrix.os }}
needs: build
strategy:
matrix:
# removed windows from test as the windows build does not complete due to size of runner (2c/7gb RAM)
os: [macos-14]
runs-on: ${{ matrix.os }}
steps:
- name: Harden Runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
with:
egress-policy: audit
- name: Standardize Git Line Endings
run: |
git config --global core.autocrlf false
git config --global core.eol lf
- name: Checkout Code
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
fetch-depth: 0
- name: Setup Java
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: temurin
java-version: 25.0.2
- name: Setup Gradle
uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
with:
cache-read-only: false
- name: Gradle Unit Test
# We do -PskipInstallRustToolchains=true, because all cargoBuild task results are taken FROM-CACHE
run: ./gradlew test -PskipInstallRustToolchains=true --continue
analyze:
name: Analyze
uses: ./.github/workflows/zxc-code-analysis.yaml
needs:
- build
- test-cross-platform
if: ${{ (github.event_name == 'push') && !failure() && !cancelled() }}
with:
custom-job-label: Source Code
enable-snyk-scan: true
snyk-org-identifier: hedera-services
secrets:
snyk-token: ${{ secrets.SNYK_TOKEN }}