diff --git a/.github/workflows/rust-clippy.yml b/.github/workflows/rust-clippy.yml index 348e9c9..44405de 100644 --- a/.github/workflows/rust-clippy.yml +++ b/.github/workflows/rust-clippy.yml @@ -1,55 +1,72 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. -# rust-clippy is a tool that runs a bunch of lints to catch common -# mistakes in your Rust code and help improve your Rust code. -# More details at https://github.com/rust-lang/rust-clippy -# and https://rust-lang.github.io/rust-clippy/ - -name: rust-clippy analyze +name: Clippy SARIF on: push: - branches: [ "main" ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ "main" ] + branches: + - main schedule: - - cron: '17 12 * * 4' + - cron: "17 12 * * 4" + workflow_dispatch: + +permissions: + contents: read + security-events: write + actions: read + +env: + CARGO_TERM_COLOR: always jobs: - rust-clippy-analyze: - name: Run rust-clippy analyzing + clippy-sarif: + name: Clippy SARIF runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + timeout-minutes: 25 + steps: - - name: Checkout code - uses: actions/checkout@v4 + - name: Checkout + uses: actions/checkout@v6 + with: + persist-credentials: false - name: Install Rust toolchain - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af #@v1 + uses: actions-rust-lang/setup-rust-toolchain@v1 with: - profile: minimal - toolchain: stable components: clippy - override: true + cache-key: clippy-sarif - - name: Install required cargo - run: cargo install clippy-sarif sarif-fmt + - name: Install SARIF tools + run: | + cargo install --locked clippy-sarif sarif-fmt - - name: Run rust-clippy - run: - cargo clippy - --all-features - --message-format=json | clippy-sarif | tee rust-clippy-results.sarif | sarif-fmt - continue-on-error: true + - name: Run Clippy and generate SARIF + id: clippy + shell: bash + run: | + set +e - - name: Upload analysis results to GitHub - uses: github/codeql-action/upload-sarif@v3 + cargo clippy \ + --workspace \ + --all-targets \ + --all-features \ + --locked \ + --message-format=json \ + | clippy-sarif \ + | tee rust-clippy-results.sarif \ + | sarif-fmt + + clippy_status=${PIPESTATUS[0]} + echo "exit_code=${clippy_status}" >> "$GITHUB_OUTPUT" + + exit 0 + + - name: Upload Clippy SARIF + uses: github/codeql-action/upload-sarif@v4 + if: always() with: sarif_file: rust-clippy-results.sarif + category: clippy wait-for-processing: true + + - name: Fail if Clippy failed + if: steps.clippy.outputs.exit_code != '0' + run: exit 1