ci: give the dev branch the same workflow coverage as main - #60
Open
roshan-ku wants to merge 1 commit into
Open
Conversation
Add dev to the push filters of Continuous Integration and OpenSSF Scorecard, and to the pull_request base filter of the Pull Request workflow. Scheduled workflows only ever run on the default branch, so Daily Build and Coverity Scan now fan out over a main/dev matrix, check out the matrix branch explicitly and tag their artifacts with it. Coverity passes the scanned ref and sha to upload-sarif so dev findings are not attributed to main, and Scorecard only publishes results from the default branch, which is all the Scorecard API accepts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Gives the
devbranch the same CI/security workflow coverage asmain.Changes
pushnow also triggers ondevpull_requestnow also matches adevbase branchpushnow also triggers ondev;publish_resultsis gated to the default branch, which is the only branch the Scorecard API accepts results frombuild,afl-fuzzandlibfuzzerfan out over abranch: [main, dev]matrix (fail-fast: false), check outrefs/heads/<branch>and upload branch-suffixed artifacts so names don't collidemain/devmatrix; the scanned commit is resolved and passed toupload-sarifviaref/shasodevfindings aren't attributed tomainScheduled workflows always run on the default branch, so a matrix is the only way to give
devequivalent nightly/weekly coverage — hence the explicit branch checkout rather thangithub.sha.scan_on_demand.ymlalready accepts a branch input and needed no change.Notes for reviewers
workflow_dispatchon Daily Build / Coverity now scans bothmainanddevregardless of the selected ref.devbecomes a merge target, its branch protection rules need the new required status checks added.Validation
actionlintreports no issues.