ci: modernize clippy sarif workflow

.github/workflows/rust-clippy.yml

@@ -1,55 +1,72 @@
-# This workflow uses actions that are not certified by GitHub.
+name: Clippy SARIF
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-# rust-clippy is a tool that runs a bunch of lints to catch common
-# mistakes in your Rust code and help improve your Rust code.
-# More details at https://github.com/rust-lang/rust-clippy
-# and https://rust-lang.github.io/rust-clippy/
-
-name: rust-clippy analyze
 
 on:
   push:
-    branches: [ "main" ]
+    branches:
-  pull_request:
+      - main
-    # The branches below must be a subset of the branches above
-    branches: [ "main" ]
   schedule:
-    - cron: '17 12 * * 4'
+    - cron: "17 12 * * 4"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+env:
+  CARGO_TERM_COLOR: always
 
 jobs:
-  rust-clippy-analyze:
+  clippy-sarif:
-    name: Run rust-clippy analyzing
+    name: Clippy SARIF
     runs-on: ubuntu-latest
-    permissions:
+    timeout-minutes: 25
-      contents: read
+
-      security-events: write
-      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
     steps:
-      - name: Checkout code
+      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
-        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af #@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          profile: minimal
-          toolchain: stable
           components: clippy
-          override: true
+          cache-key: clippy-sarif
 
-      - name: Install required cargo
+      - name: Install SARIF tools
-        run: cargo install clippy-sarif sarif-fmt
+        run: |
+          cargo install --locked clippy-sarif sarif-fmt
 
-      - name: Run rust-clippy
+      - name: Run Clippy and generate SARIF
-        run:
+        id: clippy
-          cargo clippy
+        shell: bash
-          --all-features
+        run: |
-          --message-format=json | clippy-sarif | tee rust-clippy-results.sarif | sarif-fmt
+          set +e
-        continue-on-error: true
 
-      - name: Upload analysis results to GitHub
+          cargo clippy \
-        uses: github/codeql-action/upload-sarif@v3
+            --workspace \
+            --all-targets \
+            --all-features \
+            --locked \
+            --message-format=json \
+            | clippy-sarif \
+            | tee rust-clippy-results.sarif \
+            | sarif-fmt
+
+          clippy_status=${PIPESTATUS[0]}
+          echo "exit_code=${clippy_status}" >> "$GITHUB_OUTPUT"
+
+          exit 0
+
+      - name: Upload Clippy SARIF
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
         with:
           sarif_file: rust-clippy-results.sarif
+          category: clippy
           wait-for-processing: true
+
+      - name: Fail if Clippy failed
+        if: steps.clippy.outputs.exit_code != '0'
+        run: exit 1