From 9ebc36697a1a3bc0a5b6c1367bd4cfb536e10eab Mon Sep 17 00:00:00 2001 From: roshan-ku Date: Fri, 11 Sep 2026 12:45:55 +0530 Subject: [PATCH 1/2] ci: give the dev branch the same workflow coverage as main Add dev to the push filters of Continuous Integration and OpenSSF Scorecard, and to the pull_request base filter of the Pull Request workflow. Scheduled workflows only ever run on the default branch, so Daily Build and Coverity Scan now fan out over a main/dev matrix, check out the matrix branch explicitly and tag their artifacts with it. Coverity passes the scanned ref and sha to upload-sarif so dev findings are not attributed to main, and Scorecard only publishes results from the default branch, which is all the Scorecard API accepts. --- .github/workflows/ci.yml | 1 + .github/workflows/coverity.yml | 15 +++++++++++++-- .github/workflows/daily_build.yml | 30 +++++++++++++++++++++--------- .github/workflows/pull_request.yml | 1 + .github/workflows/scorecard.yml | 4 +++- 5 files changed, 39 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7088c5f..04f9e6e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,6 +9,7 @@ on: push: branches: - main + - dev tags: - '*' workflow_dispatch: diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 2964dd2..eebccca 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -19,12 +19,16 @@ concurrency: jobs: coverity: - name: Coverity Scan + name: Coverity Scan (${{ matrix.branch }}) runs-on: ubuntu-latest timeout-minutes: 30 permissions: contents: read security-events: write # Required to upload SARIF results to GitHub Security tab + strategy: + fail-fast: false + matrix: + branch: [main, dev] steps: - name: Clean up previous run @@ -36,10 +40,14 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.sha }} + ref: refs/heads/${{ matrix.branch }} fetch-depth: 0 persist-credentials: false + - name: Resolve scanned commit + id: scanned + run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" + - name: Environment check uses: ./.github/actions/environment-check @@ -55,3 +63,6 @@ jobs: with: sarif_file: reports/coverity-results.sarif category: coverity + # The workflow runs on the default branch, so the scanned ref must be stated explicitly. + ref: refs/heads/${{ matrix.branch }} + sha: ${{ steps.scanned.outputs.sha }} diff --git a/.github/workflows/daily_build.yml b/.github/workflows/daily_build.yml index 886f5aa..efff379 100644 --- a/.github/workflows/daily_build.yml +++ b/.github/workflows/daily_build.yml @@ -19,12 +19,16 @@ concurrency: jobs: build: - name: Daily Build + name: Daily Build (${{ matrix.branch }}) runs-on: ubuntu-latest timeout-minutes: 60 permissions: contents: read security-events: write # Required to upload SARIF results to GitHub Security tab + strategy: + fail-fast: false + matrix: + branch: [main, dev] steps: - name: Clean up previous run @@ -37,7 +41,7 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.sha }} + ref: refs/heads/${{ matrix.branch }} fetch-depth: 0 persist-credentials: false @@ -72,23 +76,27 @@ jobs: uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: - name: DVLED-SW-TK-DailyBuild-${{ github.run_id }} + name: DVLED-SW-TK-DailyBuild-${{ matrix.branch }}-${{ github.run_id }} path: ${{ github.workspace }}/reports/ retention-days: 30 afl-fuzz: - name: Daily AFL Fuzz + name: Daily AFL Fuzz (${{ matrix.branch }}) runs-on: ubuntu-latest # 2h of fuzzing plus headroom for dependency install and the harness build. timeout-minutes: 138 permissions: contents: read + strategy: + fail-fast: false + matrix: + branch: [main, dev] steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.sha }} + ref: refs/heads/${{ matrix.branch }} fetch-depth: 0 persist-credentials: false @@ -101,24 +109,28 @@ jobs: uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: - name: afl-fuzz-results-${{ github.run_id }} + name: afl-fuzz-results-${{ matrix.branch }}-${{ github.run_id }} path: fuzz/findings/ retention-days: 14 libfuzzer: - name: Daily libFuzzer + name: Daily libFuzzer (${{ matrix.branch }}) runs-on: ubuntu-latest # max-seconds applies per sanitizer mode (ASan + UBSan), so the fuzzing # itself takes ~2h; the rest covers the two builds. timeout-minutes: 138 permissions: contents: read + strategy: + fail-fast: false + matrix: + branch: [main, dev] steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.sha }} + ref: refs/heads/${{ matrix.branch }} fetch-depth: 0 persist-credentials: false @@ -131,7 +143,7 @@ jobs: uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: - name: libfuzzer-results-${{ github.run_id }} + name: libfuzzer-results-${{ matrix.branch }}-${{ github.run_id }} path: | fuzz/libfuzzer_corpus/ fuzz/ubsan_corpus/ diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml index 57b8e6f..e663467 100644 --- a/.github/workflows/pull_request.yml +++ b/.github/workflows/pull_request.yml @@ -10,6 +10,7 @@ on: types: [opened, synchronize, reopened, ready_for_review] branches: - main + - dev workflow_dispatch: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 360d32a..b4a040a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: push: branches: - main + - dev schedule: # Weekly on Monday at 06:30 UTC - cron: '30 6 * * 1' @@ -40,7 +41,8 @@ jobs: with: results_file: scorecard-results.sarif results_format: sarif - publish_results: true + # The Scorecard API only accepts results published from the default branch. + publish_results: ${{ github.ref_name == github.event.repository.default_branch }} repo_token: ${{ secrets.SCORECARD_TOKEN }} - name: Upload SARIF to Security tab From a7df95c0d591a31965de60366bcbc1aee278a92b Mon Sep 17 00:00:00 2001 From: roshan-ku Date: Thu, 17 Sep 2026 13:33:19 +0530 Subject: [PATCH 2/2] ci: run daily build and coverity on default branch, cache from main and dev --- .github/actions/environment-check/action.yml | 4 +-- .github/workflows/coverity.yml | 10 ++----- .github/workflows/daily_build.yml | 30 ++++++-------------- 3 files changed, 14 insertions(+), 30 deletions(-) diff --git a/.github/actions/environment-check/action.yml b/.github/actions/environment-check/action.yml index ec2b7ad..99f9c99 100644 --- a/.github/actions/environment-check/action.yml +++ b/.github/actions/environment-check/action.yml @@ -340,8 +340,8 @@ runs: echo "===== Cache Content Summary =====" du -sh "$RUNNER_TEMP/dvledtx-deps" || true - - name: Save environment cache (main branch only) - if: steps.env-cache.outputs.cache-hit != 'true' && github.ref == 'refs/heads/main' + - name: Save environment cache (main and dev branches) + if: steps.env-cache.outputs.cache-hit != 'true' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev') uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: | diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index eebccca..47ae311 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -19,16 +19,12 @@ concurrency: jobs: coverity: - name: Coverity Scan (${{ matrix.branch }}) + name: Coverity Scan (${{ github.event.repository.default_branch }}) runs-on: ubuntu-latest timeout-minutes: 30 permissions: contents: read security-events: write # Required to upload SARIF results to GitHub Security tab - strategy: - fail-fast: false - matrix: - branch: [main, dev] steps: - name: Clean up previous run @@ -40,7 +36,7 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: refs/heads/${{ matrix.branch }} + ref: refs/heads/${{ github.event.repository.default_branch }} fetch-depth: 0 persist-credentials: false @@ -64,5 +60,5 @@ jobs: sarif_file: reports/coverity-results.sarif category: coverity # The workflow runs on the default branch, so the scanned ref must be stated explicitly. - ref: refs/heads/${{ matrix.branch }} + ref: refs/heads/${{ github.event.repository.default_branch }} sha: ${{ steps.scanned.outputs.sha }} diff --git a/.github/workflows/daily_build.yml b/.github/workflows/daily_build.yml index efff379..69def9f 100644 --- a/.github/workflows/daily_build.yml +++ b/.github/workflows/daily_build.yml @@ -19,16 +19,12 @@ concurrency: jobs: build: - name: Daily Build (${{ matrix.branch }}) + name: Daily Build (${{ github.event.repository.default_branch }}) runs-on: ubuntu-latest timeout-minutes: 60 permissions: contents: read security-events: write # Required to upload SARIF results to GitHub Security tab - strategy: - fail-fast: false - matrix: - branch: [main, dev] steps: - name: Clean up previous run @@ -41,7 +37,7 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: refs/heads/${{ matrix.branch }} + ref: refs/heads/${{ github.event.repository.default_branch }} fetch-depth: 0 persist-credentials: false @@ -76,27 +72,23 @@ jobs: uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: - name: DVLED-SW-TK-DailyBuild-${{ matrix.branch }}-${{ github.run_id }} + name: DVLED-SW-TK-DailyBuild-${{ github.event.repository.default_branch }}-${{ github.run_id }} path: ${{ github.workspace }}/reports/ retention-days: 30 afl-fuzz: - name: Daily AFL Fuzz (${{ matrix.branch }}) + name: Daily AFL Fuzz (${{ github.event.repository.default_branch }}) runs-on: ubuntu-latest # 2h of fuzzing plus headroom for dependency install and the harness build. timeout-minutes: 138 permissions: contents: read - strategy: - fail-fast: false - matrix: - branch: [main, dev] steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: refs/heads/${{ matrix.branch }} + ref: refs/heads/${{ github.event.repository.default_branch }} fetch-depth: 0 persist-credentials: false @@ -109,28 +101,24 @@ jobs: uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: - name: afl-fuzz-results-${{ matrix.branch }}-${{ github.run_id }} + name: afl-fuzz-results-${{ github.event.repository.default_branch }}-${{ github.run_id }} path: fuzz/findings/ retention-days: 14 libfuzzer: - name: Daily libFuzzer (${{ matrix.branch }}) + name: Daily libFuzzer (${{ github.event.repository.default_branch }}) runs-on: ubuntu-latest # max-seconds applies per sanitizer mode (ASan + UBSan), so the fuzzing # itself takes ~2h; the rest covers the two builds. timeout-minutes: 138 permissions: contents: read - strategy: - fail-fast: false - matrix: - branch: [main, dev] steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: refs/heads/${{ matrix.branch }} + ref: refs/heads/${{ github.event.repository.default_branch }} fetch-depth: 0 persist-credentials: false @@ -143,7 +131,7 @@ jobs: uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: - name: libfuzzer-results-${{ matrix.branch }}-${{ github.run_id }} + name: libfuzzer-results-${{ github.event.repository.default_branch }}-${{ github.run_id }} path: | fuzz/libfuzzer_corpus/ fuzz/ubsan_corpus/