chore(deps): bump the all-actions group across 1 directory with 10 updates #1800
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Build | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - release/* | |
| pull_request: | |
| branches: | |
| - main | |
| - release/* | |
| workflow_dispatch: | |
| defaults: | |
| run: | |
| shell: bash | |
| permissions: | |
| packages: write | |
| contents: read | |
| issues: read | |
| checks: write | |
| pull-requests: write | |
| actions: read | |
| statuses: write | |
| env: | |
| LC_ALL: C.UTF-8 | |
| GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }} | |
| GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }} | |
| CG_EXEC: ionice -c 2 -n 2 nice -n 19 | |
| jobs: | |
| build_rust_macos: | |
| # Build macOS Rust targets separately on a macOS runner to have access to macOS SDKs | |
| name: Build Rust - macOS | |
| runs-on: macos-14 | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout Code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Install go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: "1.24.2" | |
| - name: Setup Java | |
| uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 | |
| with: | |
| distribution: temurin | |
| java-version: 25.0.2 | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 | |
| with: | |
| cache-read-only: false | |
| - name: Build Cargo Darwin | |
| run: ./gradlew cargoBuildX86Darwin cargoBuildAarch64Darwin | |
| - name: Build libsodium darwin-arm64 | |
| run: ./gradlew :libsodium:build | |
| - name: Build libsodium darwin-amd64 | |
| run: HIERO_LIBSODIUM_TARGET=darwin-amd64 HIERO_LIBSODIUM_CONFIGURE_HOST=x86_64-apple-darwin ./gradlew :libsodium:assemble | |
| build_rust_linux_windows: | |
| name: Build Rust - Linux / Windows | |
| runs-on: hl-crypto-lin-md | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout Code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Install go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: "1.24.2" | |
| - name: Setup Java | |
| uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 | |
| with: | |
| distribution: temurin | |
| java-version: 25.0.2 | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 | |
| with: | |
| cache-read-only: false | |
| - name: Setup clang-tools (Windows cross-compile) | |
| # Make sure 'clang-cl' and 'llvm-lib' are installed for compiling crates with C++ code for Windows | |
| # https://github.com/hiero-ledger/hiero-gradle-conventions/issues/97 | |
| # Also install g++-aarch64-linux-gnu because the compressor build via Rust/Go needs it. | |
| # Finally, install mingw that we use to build for Windows target. | |
| run: | | |
| sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 15CF4D18AF4F7421 | |
| sudo add-apt-repository deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-19 main | |
| sudo apt-get update | |
| sudo apt-get -y install clang-tools-19 | |
| sudo ln -s /usr/bin/clang-cl-19 /usr/bin/clang-cl | |
| sudo ln -s /usr/bin/llvm-lib-19 /usr/bin/llvm-lib | |
| clang-cl -v | |
| llvm-lib -v | |
| sudo apt-get -y install g++-aarch64-linux-gnu | |
| sudo apt-get -y install binutils-aarch64-linux-gnu | |
| sudo apt-get -y install mingw-w64 | |
| - name: Build Cargo Linux / Windows | |
| run: ./gradlew cargoBuildX86Linux cargoBuildAarch64Linux cargoBuildX86Windows | |
| - name: Build libsodium linux-amd64 | |
| run: ./gradlew :libsodium:build | |
| - name: Build libsodium linux-arm64 | |
| run: HIERO_LIBSODIUM_TARGET=linux-arm64 HIERO_LIBSODIUM_CONFIGURE_HOST=aarch64-linux-gnu ./gradlew :libsodium:assemble | |
| - name: Build libsodium windows-amd64 | |
| run: HIERO_LIBSODIUM_TARGET=windows-amd64 HIERO_LIBSODIUM_CONFIGURE_HOST=x86_64-w64-mingw32 ./gradlew :libsodium:assemble | |
| build: | |
| name: Build TSS Crypto Library | |
| needs: | |
| - build_rust_macos | |
| - build_rust_linux_windows | |
| runs-on: hl-crypto-lin-lg | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout Code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Java | |
| uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 | |
| with: | |
| distribution: temurin | |
| java-version: 25.0.2 | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 | |
| with: | |
| cache-read-only: false | |
| - name: Build software | |
| run: ./gradlew -PskipInstallRustToolchains=true assemble | |
| - name: Code Quality Checks | |
| run: ./gradlew -PskipInstallRustToolchains=true qualityCheck --continue | |
| - name: Gradle Unit Test | |
| run: ${CG_EXEC} ./gradlew -PskipInstallRustToolchains=true test :aggregation:testCodeCoverageReport --continue | |
| - name: Publish Unit Test Results | |
| uses: step-security/publish-unit-test-result-action@681100d67b09305624c089873f12c545ee7cbc24 # v2.23.0 | |
| with: | |
| files: "**/build/test-results/test/TEST-*.xml" | |
| test-cross-platform: | |
| name: Test on ${{ matrix.os }} | |
| needs: build | |
| strategy: | |
| matrix: | |
| # removed windows from test as the windows build does not complete due to size of runner (2c/7gb RAM) | |
| os: [macos-14] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Standardize Git Line Endings | |
| run: | | |
| git config --global core.autocrlf false | |
| git config --global core.eol lf | |
| - name: Checkout Code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Java | |
| uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 | |
| with: | |
| distribution: temurin | |
| java-version: 25.0.2 | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 | |
| with: | |
| cache-read-only: false | |
| - name: Gradle Unit Test | |
| # We do -PskipInstallRustToolchains=true, because all cargoBuild task results are taken FROM-CACHE | |
| run: ./gradlew test -PskipInstallRustToolchains=true --continue | |
| analyze: | |
| name: Analyze | |
| uses: ./.github/workflows/zxc-code-analysis.yaml | |
| needs: | |
| - build | |
| - test-cross-platform | |
| if: ${{ (github.event_name == 'push') && !failure() && !cancelled() }} | |
| with: | |
| custom-job-label: Source Code | |
| enable-snyk-scan: true | |
| snyk-org-identifier: hedera-services | |
| secrets: | |
| snyk-token: ${{ secrets.SNYK_TOKEN }} |