From c18903b09765f948082002b01e5d8b7e30bbfe80 Mon Sep 17 00:00:00 2001 From: Nils Andreas Svee Date: Tue, 1 Sep 2026 12:27:45 +0700 Subject: [PATCH] ci: download Gitea tool binaries --- .gitea/workflows/fuzz.yml | 12 +++++++++++- .gitea/workflows/semver.yml | 20 ++++++++++++++++---- .gitea/workflows/supply-chain.yml | 31 +++++++++++++++++++++++++------ 3 files changed, 52 insertions(+), 11 deletions(-) diff --git a/.gitea/workflows/fuzz.yml b/.gitea/workflows/fuzz.yml index beb7e9d..2ca5a6a 100644 --- a/.gitea/workflows/fuzz.yml +++ b/.gitea/workflows/fuzz.yml @@ -16,6 +16,7 @@ env: CARGO_TERM_COLOR: always # Pinned for reproducibility; bump deliberately alongside `fuzz/Cargo.lock`. CARGO_FUZZ_VERSION: 0.13.1 + CARGO_FUZZ_SHA256: 86edc9b8f20c29ff07c3e5fcd67bc3f0784b3b960a5428635060f20d50555461 jobs: fuzz-smoke: @@ -44,7 +45,16 @@ jobs: run: rustup toolchain install nightly --profile minimal --no-self-update - name: Install cargo-fuzz - run: cargo install cargo-fuzz --locked --version "${CARGO_FUZZ_VERSION}" + run: | + set -euo pipefail + archive="cargo-fuzz-${CARGO_FUZZ_VERSION}-x86_64-unknown-linux-musl.tar.gz" + curl --fail --show-error --location --retry 3 \ + "https://github.com/rust-fuzz/cargo-fuzz/releases/download/${CARGO_FUZZ_VERSION}/${archive}" \ + --output "$archive" + echo "${CARGO_FUZZ_SHA256} ${archive}" | sha256sum --check --status - + tar -xzf "$archive" cargo-fuzz + install -Dm755 cargo-fuzz "${RUNNER_TEMP}/bin/cargo-fuzz" + echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH" - name: Build all fuzz targets run: cargo +nightly fuzz build diff --git a/.gitea/workflows/semver.yml b/.gitea/workflows/semver.yml index b254653..ff25865 100644 --- a/.gitea/workflows/semver.yml +++ b/.gitea/workflows/semver.yml @@ -13,6 +13,10 @@ on: permissions: contents: read +env: + CARGO_SEMVER_CHECKS_VERSION: 0.50.0 + CARGO_SEMVER_CHECKS_SHA256: 52a65dc88dc53fa8b57d6087954eb52cda149ca03bcfca78ce3fdecd23f893c4 + jobs: semver: name: cargo-semver-checks @@ -30,11 +34,19 @@ jobs: with: cache: false - # The action wrapper downloads through the GitHub API and uses the - # GitHub cache service. The underlying CLI is portable and preserves - # the existing wrapper's `feature-group: all-features` behavior. + # The CLI preserves the previous wrapper's `feature-group: all-features` + # behavior without its GitHub API/cache dependency. - name: Install cargo-semver-checks - run: cargo install cargo-semver-checks --locked + run: | + set -euo pipefail + archive="cargo-semver-checks-x86_64-unknown-linux-gnu.tar.gz" + curl --fail --show-error --location --retry 3 \ + "https://github.com/obi1kenobi/cargo-semver-checks/releases/download/v${CARGO_SEMVER_CHECKS_VERSION}/${archive}" \ + --output "$archive" + echo "${CARGO_SEMVER_CHECKS_SHA256} ${archive}" | sha256sum --check --status - + tar -xzf "$archive" cargo-semver-checks + install -Dm755 cargo-semver-checks "${RUNNER_TEMP}/bin/cargo-semver-checks" + echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH" - name: Check semver compatibility run: cargo semver-checks check-release --all-features diff --git a/.gitea/workflows/supply-chain.yml b/.gitea/workflows/supply-chain.yml index 1fc007c..2f44f45 100644 --- a/.gitea/workflows/supply-chain.yml +++ b/.gitea/workflows/supply-chain.yml @@ -16,8 +16,9 @@ permissions: env: ACTIONLINT_VERSION: 1.7.7 - # Match the version embedded in the replaced cargo-deny Docker action. CARGO_DENY_VERSION: 0.20.2 + CARGO_DENY_SHA256: 9f12ed4c49936e09b48bf862b595cde2fe64fcbd9d74dfacac6131ca824c8d5f + ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757 jobs: cargo-deny: @@ -47,7 +48,17 @@ jobs: persist-credentials: false - name: Install cargo-deny - run: cargo install cargo-deny --locked --version "${CARGO_DENY_VERSION}" + run: | + set -euo pipefail + archive="cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl.tar.gz" + curl --fail --show-error --location --retry 3 \ + "https://github.com/EmbarkStudios/cargo-deny/releases/download/${CARGO_DENY_VERSION}/${archive}" \ + --output "$archive" + echo "${CARGO_DENY_SHA256} ${archive}" | sha256sum --check --status - + tar -xzf "$archive" --strip-components=1 \ + "cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl/cargo-deny" + install -Dm755 cargo-deny "${RUNNER_TEMP}/bin/cargo-deny" + echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH" - name: Run cargo-deny run: >- @@ -66,14 +77,23 @@ jobs: persist-credentials: false - name: Install actionlint - run: go install github.com/rhysd/actionlint/cmd/actionlint@v${ACTIONLINT_VERSION} + run: | + set -euo pipefail + archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" + curl --fail --show-error --location --retry 3 \ + "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${archive}" \ + --output "$archive" + echo "${ACTIONLINT_SHA256} ${archive}" | sha256sum --check --status - + tar -xzf "$archive" actionlint + install -Dm755 actionlint "${RUNNER_TEMP}/bin/actionlint" + echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH" - name: actionlint handwritten workflows # actionlint validates GitHub Actions syntax. It cannot parse Gitea's # required absolute action URL in interop-netem.yml, so that workflow # is checked by the Gitea runner instead. run: | - "$(go env GOPATH)/bin/actionlint" \ + actionlint \ .gitea/workflows/ci.yml \ .gitea/workflows/docker-publish.yml \ .gitea/workflows/fuzz.yml \ @@ -86,5 +106,4 @@ jobs: - name: actionlint generated release workflow run: >- - "$(go env GOPATH)/bin/actionlint" -shellcheck= - .github/workflows/irtt-rs-release.yml + actionlint -shellcheck= .github/workflows/irtt-rs-release.yml