diff --git a/.github/AGENTS.md b/.github/AGENTS.md index a646ec4..bf6e4c3 100644 --- a/.github/AGENTS.md +++ b/.github/AGENTS.md @@ -1,4 +1,4 @@ -# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate. +# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate. # Generated GitHub Workflows and Configurations `velnor-actions` from [tailrocks/velnor-new](https://github.com/tailrocks/velnor-new) owns its declared generated paths, the complete `.github/workflows/` namespace, and marked shared action definitions under `.github/actions/`. Successful generation replaces emitted owned paths and retires owned paths no longer emitted. Do not hand-edit these managed paths; change their inputs and run `velnor-actions generate`. diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml index c37bc0c..91b4170 100644 --- a/.github/actionlint.yaml +++ b/.github/actionlint.yaml @@ -1,4 +1,4 @@ -# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate. +# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate. config-variables: [] diff --git a/.github/actions/tofu-provider-admission/action.yml b/.github/actions/tofu-provider-admission/action.yml index 0053c93..ffbe332 100644 --- a/.github/actions/tofu-provider-admission/action.yml +++ b/.github/actions/tofu-provider-admission/action.yml @@ -1,4 +1,4 @@ -# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate. +# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate. name: Admit OpenTofu provider cache description: Restore and admit the exact OpenTofu provider cache entry. inputs: diff --git a/.github/actions/u26/action.yml b/.github/actions/u26/action.yml index e335f13..47f5702 100644 --- a/.github/actions/u26/action.yml +++ b/.github/actions/u26/action.yml @@ -1,4 +1,4 @@ -# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate. +# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate. name: Velnor Mise cache identity description: Qualify the hosted image and cache roots before V2 restore. inputs: diff --git a/.github/actions/velnor-tool-seed/action.yml b/.github/actions/velnor-tool-seed/action.yml index 9d1efb0..87c3a36 100644 --- a/.github/actions/velnor-tool-seed/action.yml +++ b/.github/actions/velnor-tool-seed/action.yml @@ -1,14 +1,19 @@ -# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate. +# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate. name: Restore Velnor tool seed description: Copy a matching host tool seed into this job. inputs: cache_key: description: Exact Mise cache key. required: true +outputs: + seed_admitted: + description: True only when the trusted seed matched and was copied. + value: ${{ steps.copy.outputs.seed_admitted }} runs: using: composite steps: - - name: Copy matching tool seed + - id: copy + name: Copy matching tool seed env: ACTIONS_ID_TOKEN_REQUEST_TOKEN: "" ACTIONS_ID_TOKEN_REQUEST_URL: "" @@ -23,4 +28,4 @@ runs: NPM_TOKEN: "" SEED_KEY: ${{ inputs.cache_key }} shell: bash - run: "bash -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; set -euo pipefail; seed=\"/opt/velnor/seed\"; key=\"$SEED_KEY\"; if [ -z \"$key\" ]; then echo \"tool seed disabled\"; exit 0; fi; trusted_seed_owner_root() { if [ \"${RUNNER_OS-}\" = macOS ]; then /usr/bin/stat -f %u \"$1\" | /usr/bin/grep -qx 0; else /usr/bin/stat -c %u -- \"$1\" | /usr/bin/grep -qx 0; fi; }; trusted_seed_file_matches() { local file=\"$1\" expected=\"$2\" actual=\"\" size=\"\" newline=\"\"; [ -f \"$file\" ] && [ ! -L \"$file\" ] || return 1; if [ \"${RUNNER_OS-}\" = macOS ]; then IFS= read -r size < <(/usr/bin/stat -f %z \"$file\") || return 1; else IFS= read -r size < <(/usr/bin/stat -c %s -- \"$file\") || return 1; fi; case \"$size\" in '\\'''\\''|*[!0-9]*) return 1 ;; esac; [ \"$size\" -le 512 ] || return 1; if IFS= read -r -d '\\'''\\'' actual < \"$file\"; then return 1; fi; printf -v newline '\\''\\n'\\''; [ \"$actual\" = \"$expected\" ] || [ \"$actual\" = \"$expected$newline\" ]; }; trusted_seed_path_is_real() { local current=\"$1\"; while [ \"$current\" != / ]; do [ ! -L \"$current\" ] || return 1; current=\"${current%/*}\"; [ -n \"$current\" ] || current=/; done; }; trusted_seed_mount_is_immutable() { if [ \"${RUNNER_OS-}\" = macOS ]; then /sbin/mount | /usr/bin/awk -v seed=\"$1\" '\\''index($0, \" on \") { marker=index($0, \" on \"); source=substr($0, 1, marker-1); rest=substr($0, marker+4); options_at=index(rest, \" (\"); target=substr(rest, 1, options_at-1); mount_options=substr(rest, options_at+2); targets[NR]=target; sources[NR]=source; options[NR]=mount_options; if (target == seed) { exact++; seed_source=source; if (mount_options ~ /read-only|rdonly/) readonly=1 } else if (index(target, seed \"/\") == 1) nested=1 } END { for (i=1; i<=NR; i++) if (sources[i] == seed_source && targets[i] != seed && options[i] !~ /read-only|rdonly/) writable_alias=1; exit !(exact == 1 && readonly && !nested && !writable_alias) }'\\''; else /usr/bin/findmnt -arn -o TARGET,FSTYPE,MAJ:MIN,OPTIONS | /usr/bin/awk -v seed=\"$1\" '\\''{ target=$1; targets[NR]=target; devices[NR]=$3; options[NR]=$4; if (target == seed) { exact++; device=$3; if ($2 != \"overlay\" && $2 != \"fuse.overlayfs\" && $4 ~ /(^|,)ro(,|$)/) readonly=1 } else if (index(target, seed \"/\") == 1) nested=1 } END { for (i=1; i<=NR; i++) if (devices[i] == device && targets[i] != seed && options[i] ~ /(^|,)rw(,|$)/) writable_alias=1; exit !(exact == 1 && readonly && !nested && !writable_alias) }'\\''; fi; }; trusted_seed_tree_bounded() { local root=\"$1\" count=0 entry relative depth; if ! /usr/bin/find \"$root\" -xdev -print0 | while IFS= read -r -d '\\'''\\'' entry; do ((count+=1)); [ \"$count\" -le 100000 ] || exit 1; case \"$entry\" in \"$root\") depth=0 ;; \"$root\"/*) relative=\"${entry#\"$root\"/}\"; depth=1; while [[ \"$relative\" == */* ]]; do relative=\"${relative#*/}\"; ((depth+=1)); done ;; *) exit 1 ;; esac; [ \"$depth\" -le 16 ] || exit 1; done; then return 1; fi; }; trusted_seed_tree_entries_are_safe() { if ! /usr/bin/find \"$1\" -xdev \\( ! -type d -a ! -type f -o ! -uid 0 \\) -print0 | while IFS= read -r -d '\\'''\\'' entry; do exit 1; done; then return 1; fi; }; trusted_seed_tree_is_safe() { trusted_seed_tree_bounded \"$1\" && trusted_seed_tree_entries_are_safe \"$1\"; }; trusted_seed_is_trusted() { [ -d \"$1\" ] && [ ! -L \"$1\" ] || return 1; trusted_seed_path_is_real \"$1\" || return 1; [ -f \"$1/PROVENANCE\" ] && [ ! -L \"$1/PROVENANCE\" ] || return 1; trusted_seed_owner_root \"$1\" || return 1; trusted_seed_owner_root \"$1/PROVENANCE\" || return 1; trusted_seed_file_matches \"$1/PROVENANCE\" \"velnor-host-seed-v1\" || return 1; trusted_seed_mount_is_immutable \"$1\" || return 1; trusted_seed_tree_is_safe \"$1\"; }; if [ ! -e \"$seed\" ]; then echo \"tool seed absent\"; exit 0; fi; if ! trusted_seed_is_trusted \"$seed\"; then echo \"untrusted tool seed; continuing cold\"; exit 0; fi; if [[ ! \"$key\" =~ ^mise-tools-v2-[0-9a-f]{64}$ ]] || [ ! -f \"$seed/mise/KEY\" ]; then echo \"tool seed key mismatch\"; exit 0; fi; if ! trusted_seed_file_matches \"$seed/mise/KEY\" \"$key\"; then echo \"tool seed key mismatch\"; exit 0; fi; if [ -d \"$seed/mise/tree\" ]; then /bin/mkdir -p \"$HOME/.local/share/mise\"; /bin/cp -R \"$seed/mise/tree/.\" \"$HOME/.local/share/mise/\"; echo \"tool seed restored share-dir\"; fi; if [ -d \"$seed/rustup/tree\" ]; then /bin/mkdir -p \"$RUNNER_TEMP/velnor/rustup\"; /bin/cp -R \"$seed/rustup/tree/.\" \"$RUNNER_TEMP/velnor/rustup/\"; echo \"tool seed restored toolchain-dir\"; fi'" + run: "bash -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; set -euo pipefail; seed=\"/opt/velnor/seed\"; key=\"$SEED_KEY\"; if [ -z \"$key\" ]; then echo \"tool seed disabled\"; exit 0; fi; trusted_seed_owner_root() { if [ \"${RUNNER_OS-}\" = macOS ]; then /usr/bin/stat -f %u \"$1\" | /usr/bin/grep -qx 0; else /usr/bin/stat -c %u -- \"$1\" | /usr/bin/grep -qx 0; fi; }; trusted_seed_file_matches() { local file=\"$1\" expected=\"$2\" actual=\"\" size=\"\" newline=\"\"; [ -f \"$file\" ] && [ ! -L \"$file\" ] || return 1; if [ \"${RUNNER_OS-}\" = macOS ]; then IFS= read -r size < <(/usr/bin/stat -f %z \"$file\") || return 1; else IFS= read -r size < <(/usr/bin/stat -c %s -- \"$file\") || return 1; fi; case \"$size\" in '\\'''\\''|*[!0-9]*) return 1 ;; esac; [ \"$size\" -le 512 ] || return 1; if IFS= read -r -d '\\'''\\'' actual < \"$file\"; then return 1; fi; printf -v newline '\\''\\n'\\''; [ \"$actual\" = \"$expected\" ] || [ \"$actual\" = \"$expected$newline\" ]; }; trusted_seed_path_is_real() { local current=\"$1\"; while [ \"$current\" != / ]; do [ ! -L \"$current\" ] || return 1; current=\"${current%/*}\"; [ -n \"$current\" ] || current=/; done; }; trusted_seed_mount_is_immutable() { if [ \"${RUNNER_OS-}\" = macOS ]; then /sbin/mount | /usr/bin/awk -v seed=\"$1\" '\\''index($0, \" on \") { marker=index($0, \" on \"); source=substr($0, 1, marker-1); rest=substr($0, marker+4); options_at=index(rest, \" (\"); target=substr(rest, 1, options_at-1); mount_options=substr(rest, options_at+2); targets[NR]=target; sources[NR]=source; options[NR]=mount_options; if (target == seed) { exact++; seed_source=source; if (mount_options ~ /read-only|rdonly/) readonly=1 } else if (index(target, seed \"/\") == 1) nested=1 } END { for (i=1; i<=NR; i++) if (sources[i] == seed_source && targets[i] != seed && options[i] !~ /read-only|rdonly/) writable_alias=1; exit !(exact == 1 && readonly && !nested && !writable_alias) }'\\''; else /usr/bin/findmnt -arn -o TARGET,FSTYPE,MAJ:MIN,OPTIONS | /usr/bin/awk -v seed=\"$1\" '\\''{ target=$1; targets[NR]=target; devices[NR]=$3; options[NR]=$4; if (target == seed) { exact++; device=$3; if ($2 != \"overlay\" && $2 != \"fuse.overlayfs\" && $4 ~ /(^|,)ro(,|$)/) readonly=1 } else if (index(target, seed \"/\") == 1) nested=1 } END { for (i=1; i<=NR; i++) if (devices[i] == device && targets[i] != seed && options[i] ~ /(^|,)rw(,|$)/) writable_alias=1; exit !(exact == 1 && readonly && !nested && !writable_alias) }'\\''; fi; }; trusted_seed_tree_bounded() { local root=\"$1\" count=0 entry relative depth; if ! /usr/bin/find \"$root\" -xdev -print0 | while IFS= read -r -d '\\'''\\'' entry; do ((count+=1)); [ \"$count\" -le 100000 ] || exit 1; case \"$entry\" in \"$root\") depth=0 ;; \"$root\"/*) relative=\"${entry#\"$root\"/}\"; depth=1; while [[ \"$relative\" == */* ]]; do relative=\"${relative#*/}\"; ((depth+=1)); done ;; *) exit 1 ;; esac; [ \"$depth\" -le 16 ] || exit 1; done; then return 1; fi; }; trusted_seed_tree_entries_are_safe() { if ! /usr/bin/find \"$1\" -xdev \\( ! -type d -a ! -type f -o ! -uid 0 \\) -print0 | while IFS= read -r -d '\\'''\\'' entry; do exit 1; done; then return 1; fi; }; trusted_seed_tree_is_safe() { trusted_seed_tree_bounded \"$1\" && trusted_seed_tree_entries_are_safe \"$1\"; }; trusted_seed_is_trusted() { [ -d \"$1\" ] && [ ! -L \"$1\" ] || return 1; trusted_seed_path_is_real \"$1\" || return 1; [ -f \"$1/PROVENANCE\" ] && [ ! -L \"$1/PROVENANCE\" ] || return 1; trusted_seed_owner_root \"$1\" || return 1; trusted_seed_owner_root \"$1/PROVENANCE\" || return 1; trusted_seed_file_matches \"$1/PROVENANCE\" \"velnor-host-seed-v1\" || return 1; trusted_seed_mount_is_immutable \"$1\" || return 1; trusted_seed_tree_is_safe \"$1\"; }; if [ ! -e \"$seed\" ]; then echo \"tool seed absent\"; exit 0; fi; if ! trusted_seed_is_trusted \"$seed\"; then echo \"untrusted tool seed; continuing cold\"; exit 0; fi; if [[ ! \"$key\" =~ ^mise-tools-v2-[0-9a-f]{64}$ ]] || [ ! -f \"$seed/mise/KEY\" ]; then echo \"tool seed key mismatch\"; exit 0; fi; if ! trusted_seed_file_matches \"$seed/mise/KEY\" \"$key\"; then echo \"tool seed key mismatch\"; exit 0; fi; trusted_seed_tree_has_file() { /usr/bin/find \"$1\" -type f -print -quit | /usr/bin/grep -q .; }; copied=false; if [ -d \"$seed/mise/tree\" ] && trusted_seed_tree_has_file \"$seed/mise/tree\"; then /bin/mkdir -p \"$HOME/.local/share/mise\"; /bin/cp -R \"$seed/mise/tree/.\" \"$HOME/.local/share/mise/\"; echo \"tool seed restored share-dir\"; copied=true; fi; if [ -d \"$seed/rustup/tree\" ] && trusted_seed_tree_has_file \"$seed/rustup/tree\"; then /bin/mkdir -p \"$RUNNER_TEMP/velnor/rustup\"; /bin/cp -R \"$seed/rustup/tree/.\" \"$RUNNER_TEMP/velnor/rustup/\"; echo \"tool seed restored toolchain-dir\"; copied=true; fi; [ \"$copied\" = true ] || { echo \"tool seed has no copyable payload\"; exit 0; }; printf '\\''seed_admitted=true\\n'\\'' >> \"$GITHUB_OUTPUT\"'" diff --git a/.github/actions/velnor-tools-cache-restore/action.yml b/.github/actions/velnor-tools-cache-restore/action.yml index 7c4b833..607faad 100644 --- a/.github/actions/velnor-tools-cache-restore/action.yml +++ b/.github/actions/velnor-tools-cache-restore/action.yml @@ -1,10 +1,14 @@ -# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate. +# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate. name: Velnor Mise tools cache restore description: Restore the exact renderer-owned V2 Mise tools paths. inputs: key: description: Exact runtime-qualified V2 tools key. required: true + seed-admitted: + description: Whether the trusted V2 prelude copied the exact seed. + required: false + default: "false" runs: using: composite steps: @@ -15,10 +19,11 @@ runs: key: ${{ inputs.key }} path: "~/.local/share/mise\n${{ runner.temp }}/velnor/rustup\n${{ runner.temp }}/velnor/cargo/.crates.toml\n${{ runner.temp }}/velnor/cargo/.crates2.json\n${{ runner.temp }}/velnor/cargo/bin" restore-keys: "" - - name: Discard tools bytes unless the exact restore key matched + - name: Keep only an exact cache hit or validated seed on a miss shell: bash env: TOOLS_CACHE_HIT: ${{ steps.restore.outputs.cache-hit }} TOOLS_EXPECTED_KEY: ${{ inputs.key }} TOOLS_MATCHED_KEY: ${{ steps.restore.outputs.cache-matched-key }} - run: "set -eu;\n[ -n \"$HOME\" ] && [ -n \"$RUNNER_TEMP\" ] || exit 1;\ncase \"$HOME\" in /*) ;; *) exit 1 ;; esac;\ncase \"$RUNNER_TEMP\" in /*) ;; *) exit 1 ;; esac;\n[ \"$HOME\" != / ] && [ \"$RUNNER_TEMP\" != / ] || exit 1;\nif [ \"$TOOLS_CACHE_HIT\" = true ] && [ -n \"$TOOLS_EXPECTED_KEY\" ] && [ \"$TOOLS_MATCHED_KEY\" = \"$TOOLS_EXPECTED_KEY\" ]; then\n[ ! -L \"$HOME/.local/share/mise\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/rustup\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/bin\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/.crates.toml\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/.crates2.json\" ] || exit 1;\nexit 0;\nfi;\nfor d in \"$HOME/.local/share/mise\" \"$RUNNER_TEMP/velnor/rustup\" \"$RUNNER_TEMP/velnor/cargo/bin\"; do\n[ ! -L \"$d\" ] || exit 1;\nrm -rf \"$d\";\ndone;\nfor f in \"$RUNNER_TEMP/velnor/cargo/.crates.toml\" \"$RUNNER_TEMP/velnor/cargo/.crates2.json\"; do\n[ ! -L \"$f\" ] || exit 1;\nrm -f \"$f\";\ndone" + TOOLS_SEED_ADMITTED: ${{ inputs.seed-admitted }} + run: "set -eu;\n[ -n \"$HOME\" ] && [ -n \"$RUNNER_TEMP\" ] || exit 1;\ncase \"$HOME\" in /*) ;; *) exit 1 ;; esac;\ncase \"$RUNNER_TEMP\" in /*) ;; *) exit 1 ;; esac;\n[ \"$HOME\" != / ] && [ \"$RUNNER_TEMP\" != / ] || exit 1;\ncache_hit=\"${TOOLS_CACHE_HIT-}\";\nexpected_key=\"${TOOLS_EXPECTED_KEY-}\";\nmatched_key=\"${TOOLS_MATCHED_KEY-}\";\nseed_admitted=\"${TOOLS_SEED_ADMITTED-}\";\nkeep=false;\nif [ \"$cache_hit\" = true ] && [[ \"$expected_key\" =~ ^mise-tools-v2-[0-9a-f]{64}$ ]] && [ \"$matched_key\" = \"$expected_key\" ]; then\nkeep=true;\nelif [ -z \"$cache_hit\" ] && [[ \"$expected_key\" =~ ^mise-tools-v2-[0-9a-f]{64}$ ]] && [ -z \"$matched_key\" ] && [ \"$seed_admitted\" = true ]; then\nkeep=true;\nfi;\nif [ \"$keep\" = true ]; then\n[ ! -L \"$HOME/.local/share/mise\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/rustup\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/bin\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/.crates.toml\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/.crates2.json\" ] || exit 1;\nexit 0;\nfi;\nfor d in \"$HOME/.local/share/mise\" \"$RUNNER_TEMP/velnor/rustup\" \"$RUNNER_TEMP/velnor/cargo/bin\"; do\n[ ! -L \"$d\" ] || exit 1;\nrm -rf \"$d\";\ndone;\nfor f in \"$RUNNER_TEMP/velnor/cargo/.crates.toml\" \"$RUNNER_TEMP/velnor/cargo/.crates2.json\"; do\n[ ! -L \"$f\" ] || exit 1;\nrm -f \"$f\";\ndone" diff --git a/.github/actions/velnor-tools-prelude-u26/action.yml b/.github/actions/velnor-tools-prelude-u26/action.yml index b0fe9c6..9871134 100644 --- a/.github/actions/velnor-tools-prelude-u26/action.yml +++ b/.github/actions/velnor-tools-prelude-u26/action.yml @@ -1,4 +1,4 @@ -# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate. +# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate. name: Velnor hosted tools prelude description: Qualify the hosted image and copy a matching tool seed. inputs: @@ -10,6 +10,8 @@ outputs: value: ${{ steps.v2.outputs.enabled }} identity: value: ${{ steps.v2.outputs.identity }} + seed_admitted: + value: ${{ steps.seed.outputs.seed_admitted }} runs: using: composite steps: @@ -19,6 +21,7 @@ runs: with: d: ${{ inputs.d }} - name: Restore Velnor tool seed + id: seed if: steps.v2.outputs.enabled == 'true' uses: ./.github/actions/velnor-tool-seed # zizmor: ignore[self-repository] with: diff --git a/.github/scripts/velnor-tools-cache-identity.sh b/.github/scripts/velnor-tools-cache-identity.sh index 870638a..825c029 100644 --- a/.github/scripts/velnor-tools-cache-identity.sh +++ b/.github/scripts/velnor-tools-cache-identity.sh @@ -1,2 +1,2 @@ -# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate. +# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate. export LC_ALL=C; set -eu; umask 077; : "${GITHUB_OUTPUT:?missing GITHUB_OUTPUT}"; scratch_root=; scratch_dir=; runner_os=${RUNNER_OS-}; runner_arch=${RUNNER_ARCH-}; image_os=${ImageOS-}; image_version=${ImageVersion-}; home=${HOME-}; runner_temp=${RUNNER_TEMP-}; mise_rustup=${MISE_RUSTUP_HOME-}; rustup_home=${RUSTUP_HOME-}; mise_cargo=${MISE_CARGO_HOME-}; cargo_home=${CARGO_HOME-}; valid_path() { value=$1; case "$value" in /*) ;; *) return 1 ;; esac; [ "$value" != / ] || return 1; case "$value" in *[![:print:]]*|*//*|*/./*|*/../*|*/.|*/..) return 1 ;; esac; remaining=${value#/}; prefix=; while [ -n "$remaining" ]; do case "$remaining" in */*) part=${remaining%%/*}; remaining=${remaining#*/} ;; *) part=$remaining; remaining= ;; esac; [ -n "$part" ] || return 1; prefix="$prefix/$part"; [ ! -L "$prefix" ] || return 1; done; }; cleanup_scratch() { [ -n "$scratch_dir" ] || return 0; case "$scratch_dir" in "$scratch_root"/runtime-identity.*) ;; *) return 1 ;; esac; [ -d "$scratch_dir" ] && [ ! -L "$scratch_dir" ] || return 1; rm -rf -- "$scratch_dir" || return 1; scratch_dir=; }; on_exit() { status=$1; trap - EXIT; if ! cleanup_scratch; then status=1; fi; exit "$status"; }; trap 'status=$?; on_exit "$status"' EXIT; trap 'exit 129' HUP; trap 'exit 130' INT; trap 'exit 143' TERM; disable() { reason=$1; if ! cleanup_scratch; then printf 'enabled=false\nreason=identity_scratch_cleanup_failed\n' >> "$GITHUB_OUTPUT"; exit 1; fi; printf 'enabled=false\nreason=%s\n' "$reason" >> "$GITHUB_OUTPUT"; exit 0; }; case "$VELNOR_CACHE_LANE" in scale-set:*) disable scale_set_image_unqualified ;; esac; case "$VELNOR_CACHE_LANE" in ubuntu-22.04) expected_image_os=ubuntu22 ;; ubuntu-24.04) expected_image_os=ubuntu24 ;; ubuntu-26.04) expected_image_os=ubuntu26 ;; *) disable lane_image_unqualified ;; esac; expected_arch=X64; expected_target=x86_64-unknown-linux-gnu; [ -n "$runner_os" ] || disable runner_os_missing; [ "$runner_os" = Linux ] || disable runner_os_mismatch; [ -n "$runner_arch" ] || disable runner_arch_missing; [ "$runner_arch" = "$expected_arch" ] || disable runner_arch_mismatch; [ -n "$image_os" ] || disable image_os_missing; [ "$image_os" = "$expected_image_os" ] || disable image_os_mismatch; [ -n "$image_version" ] || disable image_version_missing; case "$image_version" in *[!0-9.]*) disable image_version_invalid ;; esac; case "$image_version" in *[0-9]*) ;; *) disable image_version_invalid ;; esac; [ -n "$home" ] && [ -d "$home" ] || disable home_missing; [ -n "$runner_temp" ] && [ -d "$runner_temp" ] || disable runner_temp_missing; valid_path "$home" || disable home_aliased; valid_path "$runner_temp" || disable runner_temp_aliased; expected_mise="$home/.local/share/mise"; effective_mise=${MISE_DATA_DIR-}; if [ -z "$effective_mise" ]; then if [ -n "${XDG_DATA_HOME-}" ]; then effective_mise="$XDG_DATA_HOME/mise"; else effective_mise=$expected_mise; fi; fi; valid_path "$expected_mise" || disable mise_root_aliased; valid_path "$effective_mise" || disable mise_root_invalid; [ "$effective_mise" = "$expected_mise" ] || disable mise_root_not_archived; expected_rustup="$runner_temp/velnor/rustup"; expected_cargo="$runner_temp/velnor/cargo"; [ "$mise_rustup" = "$expected_rustup" ] || disable mise_rustup_home_mismatch; [ "$rustup_home" = "$expected_rustup" ] || disable rustup_home_mismatch; [ "$mise_cargo" = "$expected_cargo" ] || disable mise_cargo_home_mismatch; [ "$cargo_home" = "$expected_cargo" ] || disable cargo_home_mismatch; valid_path "$expected_rustup" || disable rustup_root_invalid; valid_path "$expected_cargo" || disable cargo_root_invalid; scratch_root="$runner_temp/velnor"; valid_path "$scratch_root" || disable cache_scratch_aliased; mkdir -p "$scratch_root" || disable cache_scratch_unavailable; [ -d "$scratch_root" ] && [ ! -L "$scratch_root" ] || disable cache_scratch_invalid; scratch_dir="$scratch_root/runtime-identity.$$"; if ! mkdir -m 700 "$scratch_dir"; then scratch_dir=; disable identity_scratch_unavailable; fi; case "$scratch_dir" in "$scratch_root"/runtime-identity.*) ;; *) disable cache_scratch_invalid ;; esac; valid_path "$scratch_dir" && [ -d "$scratch_dir" ] && [ ! -L "$scratch_dir" ] || disable cache_scratch_invalid; identity_file="$scratch_dir/preimage"; sum_file="$scratch_dir/digest"; set -C; if ! : > "$identity_file"; then set +C; disable identity_file_unavailable; fi; if ! : > "$sum_file"; then set +C; disable identity_file_unavailable; fi; set +C; valid_path "$identity_file" && [ -f "$identity_file" ] && [ ! -L "$identity_file" ] || disable identity_file_invalid; valid_path "$sum_file" && [ -f "$sum_file" ] && [ ! -L "$sum_file" ] || disable identity_file_invalid; for value in "velnor-tools-runtime-v2" "$VELNOR_CACHE_STATIC_DIGEST" "$VELNOR_CACHE_LANE" "$expected_target" "$runner_os" "$runner_arch" "$image_os" "$image_version" "$home" "$runner_temp" "$effective_mise" "$expected_rustup" "$expected_cargo"; do if ! printf '%s:%s\n' "${#value}" "$value" >> "$identity_file"; then disable identity_file_write_failed; fi; done; if command -v sha256sum >/dev/null 2>&1; then if ! sha256sum < "$identity_file" > "$sum_file"; then disable identity_hash_failed; fi; elif command -v shasum >/dev/null 2>&1; then if ! shasum -a 256 < "$identity_file" > "$sum_file"; then disable identity_hash_failed; fi; else disable sha256_tool_missing; fi; if ! IFS=' ' read -r fingerprint _ < "$sum_file"; then disable fingerprint_missing; fi; [ ${#fingerprint} -eq 64 ] || disable fingerprint_invalid; case "$fingerprint" in *[!0-9a-f]*) disable fingerprint_invalid ;; esac; if ! cleanup_scratch; then disable identity_scratch_cleanup_failed; fi; printf 'identity=%s\nenabled=true\nreason=qualified_hosted_image\n' "$fingerprint" >> "$GITHUB_OUTPUT" \ No newline at end of file diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ad71e10..57402bf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,4 +1,4 @@ -# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate. +# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate. name: CI "on": pull_request: @@ -29,6 +29,7 @@ env: MISE_NO_CONFIG: "1" MISE_NO_ENV: "1" MISE_NO_HOOKS: "1" + MISE_QUIET: "1" NODE_AUTH_TOKEN: "" NPM_TOKEN: "" concurrency: @@ -48,21 +49,22 @@ jobs: id: v2 uses: ./.github/actions/velnor-tools-prelude-u26 # zizmor: ignore[self-repository] with: - d: e370bd368b58262d774e5f0c13ab43e7fbafaf445dd1ad4263c70221ad2a15a4 + d: 9d90371d425335330150a44ddd82153a0f76ae85f2523f9e2af30607ea568f1e - name: Restore Mise tools if: steps.v2.outputs.enabled == 'true' uses: ./.github/actions/velnor-tools-cache-restore # zizmor: ignore[self-repository] with: key: mise-tools-v2-${{steps.v2.outputs.identity}} + seed-admitted: ${{ steps.v2.outputs.seed_admitted }} - name: Setup Mise - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca + uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 with: cache: "false" cache_save: "false" env: "false" install: "false" - sha256: 3f44343eebc7e0d6623bcea46e304864f02dff648edd75c82871b53cc697b366 - version: 2026.10.6 + sha256: c72477ae6c3a8e7d817a322f43da70e4643e75ee5c21265f1c19c894273b7428 + version: 2026.10.8 - name: Prepare pinned tools run: mise --no-config --no-env --no-hooks install actionlint@1.7.12 shellcheck@0.11.0 - name: Run actionlint @@ -78,9 +80,9 @@ jobs: runs-on: ubuntu-26.04 timeout-minutes: 20 env: - VELNOR_ASSET_SHA256: 411db6702e5f627ba106f5a5f1d2b324d32844e6520bd7b3c00139b0029b12d1 - VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-x86_64-unknown-linux-gnu - VELNOR_RELEASE_COMMIT: e0cebf8ea523589a335d3cbc3699c973ce1e18a4 + VELNOR_ASSET_SHA256: 6cd0fb8b096d49f1d02b713428da04fabbe836dd3b7113d483ffbe59db96fa8e + VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.9/velnor-actions-0.1.9-x86_64-unknown-linux-gnu + VELNOR_RELEASE_COMMIT: a7d49aa6b0af3b1ccb5cac3d93147eba82eba4f9 outputs: covered_tasks: ${{ steps.plan.outputs.covered_tasks }} qualification_campaign: ${{ steps.plan.outputs.qualification_campaign }} @@ -98,38 +100,39 @@ jobs: id: v2 uses: ./.github/actions/velnor-tools-prelude-u26 # zizmor: ignore[self-repository] with: - d: 6a3893cbcdceacb96419ede57ddc9a61a54dd4b84c7d0cb1cbf7bd101df5af0f + d: 6fea16f7a0dab96764f23a49a0ce173be7da56accce8b76f3ef48538cc7597ea - name: Restore Mise tools if: steps.v2.outputs.enabled == 'true' uses: ./.github/actions/velnor-tools-cache-restore # zizmor: ignore[self-repository] with: key: mise-tools-v2-${{steps.v2.outputs.identity}} + seed-admitted: ${{ steps.v2.outputs.seed_admitted }} - name: Setup Mise - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca + uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 with: cache: "false" cache_save: "false" env: "false" install: "false" - sha256: 3f44343eebc7e0d6623bcea46e304864f02dff648edd75c82871b53cc697b366 - version: 2026.10.6 + sha256: c72477ae6c3a8e7d817a322f43da70e4643e75ee5c21265f1c19c894273b7428 + version: 2026.10.8 - name: Prepare pinned tools run: mise --no-config --no-env --no-hooks install actionlint@1.7.12 shellcheck@0.11.0 zizmor@1.30.1 opentofu@1.13.1 - name: Acquire Velnor - run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; d=\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"&&mkdir -p \"${d%/*}\"&&s=\"/opt/velnor/seed/generator/${d##*/}\"&&p=\"$VELNOR_ASSET_SHA256 \"&&if [ -f \"$s\" ]&&echo \"$p$s\"|sha256sum -c -;then cp \"$s\" \"$d\";else curl -fsSL --retry 5 --retry-all-errors --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$d\"&&echo \"$p$d\"|sha256sum -c -;fi&&chmod +x \"$d\"'" + run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; d=\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.9\"&&mkdir -p \"${d%/*}\"&&s=\"/opt/velnor/seed/generator/${d##*/}\"&&p=\"$VELNOR_ASSET_SHA256 \"&&if [ -f \"$s\" ]&&echo \"$p$s\"|sha256sum -c -;then cp \"$s\" \"$d\";else curl -fsSL --retry 5 --retry-all-errors --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$d\"&&echo \"$p$d\"|sha256sum -c -;fi&&chmod +x \"$d\"'" - name: Write request env: VELNOR_INTERNAL_OP: write-request-v1 VELNOR_REQUEST_FILE: ${{ runner.temp }}/velnor/request/plan-v1-request.json - run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'" + run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.9'" - name: Check generated files - run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; $RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6 generate --output-dir \"$RUNNER_TEMP/velnor-actions-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}\" && diff -r --brief .github \"$RUNNER_TEMP/velnor-actions-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/.github\"'" + run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; $RUNNER_TEMP/velnor/bin/velnor-actions-0.1.9 generate --output-dir \"$RUNNER_TEMP/velnor-actions-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}\" && diff -r --brief .github \"$RUNNER_TEMP/velnor-actions-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/.github\"'" - name: Plan id: plan env: VELNOR_INTERNAL_OP: plan-v1 VELNOR_REQUEST_FILE: ${{ runner.temp }}/velnor/request/plan-v1-request.json - run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'" + run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.9'" - name: Publish plan if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a @@ -149,15 +152,15 @@ jobs: runs-on: ubuntu-26.04 timeout-minutes: 10 env: - VELNOR_ASSET_SHA256: 411db6702e5f627ba106f5a5f1d2b324d32844e6520bd7b3c00139b0029b12d1 - VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-x86_64-unknown-linux-gnu - VELNOR_RELEASE_COMMIT: e0cebf8ea523589a335d3cbc3699c973ce1e18a4 + VELNOR_ASSET_SHA256: 6cd0fb8b096d49f1d02b713428da04fabbe836dd3b7113d483ffbe59db96fa8e + VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.9/velnor-actions-0.1.9-x86_64-unknown-linux-gnu + VELNOR_RELEASE_COMMIT: a7d49aa6b0af3b1ccb5cac3d93147eba82eba4f9 needs: - required if: github.event_name == 'push' && github.ref == 'refs/heads/main' steps: - name: Acquire Velnor - run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; d=\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"&&mkdir -p \"${d%/*}\"&&s=\"/opt/velnor/seed/generator/${d##*/}\"&&p=\"$VELNOR_ASSET_SHA256 \"&&if [ -f \"$s\" ]&&echo \"$p$s\"|sha256sum -c -;then cp \"$s\" \"$d\";else curl -fsSL --retry 5 --retry-all-errors --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$d\"&&echo \"$p$d\"|sha256sum -c -;fi&&chmod +x \"$d\"'" + run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; d=\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.9\"&&mkdir -p \"${d%/*}\"&&s=\"/opt/velnor/seed/generator/${d##*/}\"&&p=\"$VELNOR_ASSET_SHA256 \"&&if [ -f \"$s\" ]&&echo \"$p$s\"|sha256sum -c -;then cp \"$s\" \"$d\";else curl -fsSL --retry 5 --retry-all-errors --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$d\"&&echo \"$p$d\"|sha256sum -c -;fi&&chmod +x \"$d\"'" - name: Download plan uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with: @@ -167,13 +170,13 @@ jobs: env: VELNOR_INTERNAL_OP: write-request-v1 VELNOR_REQUEST_FILE: ${{ runner.temp }}/velnor/request/publish-baseline-v1-request.json - run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'" + run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.9'" - name: Publish baseline id: publish-baseline env: VELNOR_INTERNAL_OP: publish-baseline-v1 VELNOR_REQUEST_FILE: ${{ runner.temp }}/velnor/request/publish-baseline-v1-request.json - run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'" + run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.9'" - name: Upload baseline if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a @@ -188,9 +191,9 @@ jobs: timeout-minutes: 10 env: RUSTUP_TOOLCHAIN: 1.98.1 - VELNOR_ASSET_SHA256: 411db6702e5f627ba106f5a5f1d2b324d32844e6520bd7b3c00139b0029b12d1 - VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-x86_64-unknown-linux-gnu - VELNOR_RELEASE_COMMIT: e0cebf8ea523589a335d3cbc3699c973ce1e18a4 + VELNOR_ASSET_SHA256: 6cd0fb8b096d49f1d02b713428da04fabbe836dd3b7113d483ffbe59db96fa8e + VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.9/velnor-actions-0.1.9-x86_64-unknown-linux-gnu + VELNOR_RELEASE_COMMIT: a7d49aa6b0af3b1ccb5cac3d93147eba82eba4f9 permissions: contents: read actions: read @@ -201,16 +204,16 @@ jobs: if: always() steps: - name: Setup Mise - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca + uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 with: cache: "false" cache_save: "false" env: "false" install: "false" - sha256: 3f44343eebc7e0d6623bcea46e304864f02dff648edd75c82871b53cc697b366 - version: 2026.10.6 + sha256: c72477ae6c3a8e7d817a322f43da70e4643e75ee5c21265f1c19c894273b7428 + version: 2026.10.8 - name: Acquire Velnor - run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; d=\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"&&mkdir -p \"${d%/*}\"&&s=\"/opt/velnor/seed/generator/${d##*/}\"&&p=\"$VELNOR_ASSET_SHA256 \"&&if [ -f \"$s\" ]&&echo \"$p$s\"|sha256sum -c -;then cp \"$s\" \"$d\";else curl -fsSL --retry 5 --retry-all-errors --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$d\"&&echo \"$p$d\"|sha256sum -c -;fi&&chmod +x \"$d\"'" + run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; d=\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.9\"&&mkdir -p \"${d%/*}\"&&s=\"/opt/velnor/seed/generator/${d##*/}\"&&p=\"$VELNOR_ASSET_SHA256 \"&&if [ -f \"$s\" ]&&echo \"$p$s\"|sha256sum -c -;then cp \"$s\" \"$d\";else curl -fsSL --retry 5 --retry-all-errors --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$d\"&&echo \"$p$d\"|sha256sum -c -;fi&&chmod +x \"$d\"'" - name: Prepare pinned tools env: MISE_CARGO_HOME: ${{ runner.temp }}/velnor/cargo @@ -227,21 +230,21 @@ jobs: GH_REPO: ${{ github.repository }} GH_TOKEN: ${{ github.token }} VELNOR_INTERNAL_OP: fetch-reports-v1 - run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'" + run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.9'" - name: Write request env: VELNOR_INTERNAL_OP: write-request-v1 VELNOR_NEEDS_JSON: ${{ toJSON(needs) }} VELNOR_NEEDS_EXPECTED: "[\"actionlint\",\"plan\",\"tofu-workspace\"]" VELNOR_REQUEST_FILE: ${{ runner.temp }}/velnor/request/merge-v1-request.json - run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'" + run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.9'" - name: Merge reports env: VELNOR_INTERNAL_OP: merge-v1 VELNOR_NEEDS_JSON: ${{ toJSON(needs) }} VELNOR_NEEDS_EXPECTED: "[\"actionlint\",\"plan\",\"tofu-workspace\"]" VELNOR_REQUEST_FILE: ${{ runner.temp }}/velnor/request/merge-v1-request.json - run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'" + run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.9'" - name: Publish final report if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a @@ -255,9 +258,9 @@ jobs: runs-on: ubuntu-26.04 timeout-minutes: 30 env: - VELNOR_ASSET_SHA256: 411db6702e5f627ba106f5a5f1d2b324d32844e6520bd7b3c00139b0029b12d1 - VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-x86_64-unknown-linux-gnu - VELNOR_RELEASE_COMMIT: e0cebf8ea523589a335d3cbc3699c973ce1e18a4 + VELNOR_ASSET_SHA256: 6cd0fb8b096d49f1d02b713428da04fabbe836dd3b7113d483ffbe59db96fa8e + VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.9/velnor-actions-0.1.9-x86_64-unknown-linux-gnu + VELNOR_RELEASE_COMMIT: a7d49aa6b0af3b1ccb5cac3d93147eba82eba4f9 needs: - plan strategy: @@ -271,23 +274,24 @@ jobs: id: v2 uses: ./.github/actions/velnor-tools-prelude-u26 # zizmor: ignore[self-repository] with: - d: 6a3893cbcdceacb96419ede57ddc9a61a54dd4b84c7d0cb1cbf7bd101df5af0f + d: 6fea16f7a0dab96764f23a49a0ce173be7da56accce8b76f3ef48538cc7597ea - name: Restore Mise tools if: steps.v2.outputs.enabled == 'true' uses: ./.github/actions/velnor-tools-cache-restore # zizmor: ignore[self-repository] with: key: mise-tools-v2-${{steps.v2.outputs.identity}} + seed-admitted: ${{ steps.v2.outputs.seed_admitted }} - name: Setup Mise - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca + uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 with: cache: "false" cache_save: "false" env: "false" install: "false" - sha256: 3f44343eebc7e0d6623bcea46e304864f02dff648edd75c82871b53cc697b366 - version: 2026.10.6 + sha256: c72477ae6c3a8e7d817a322f43da70e4643e75ee5c21265f1c19c894273b7428 + version: 2026.10.8 - name: Acquire Velnor - run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; d=\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"&&mkdir -p \"${d%/*}\"&&s=\"/opt/velnor/seed/generator/${d##*/}\"&&p=\"$VELNOR_ASSET_SHA256 \"&&if [ -f \"$s\" ]&&echo \"$p$s\"|sha256sum -c -;then cp \"$s\" \"$d\";else curl -fsSL --retry 5 --retry-all-errors --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$d\"&&echo \"$p$d\"|sha256sum -c -;fi&&chmod +x \"$d\"'" + run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; d=\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.9\"&&mkdir -p \"${d%/*}\"&&s=\"/opt/velnor/seed/generator/${d##*/}\"&&p=\"$VELNOR_ASSET_SHA256 \"&&if [ -f \"$s\" ]&&echo \"$p$s\"|sha256sum -c -;then cp \"$s\" \"$d\";else curl -fsSL --retry 5 --retry-all-errors --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$d\"&&echo \"$p$d\"|sha256sum -c -;fi&&chmod +x \"$d\"'" - name: Download plan uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with: @@ -312,7 +316,7 @@ jobs: VELNOR_MATRIX_KEY: m-3c8679d9275e8dda VELNOR_TASK_DIGEST: b3-31fb3885e2c8c470833d4bccfd842757a4c93d268142f89d70c4ddbc3d3dd565 VELNOR_TASK_ID: stack/tofu/dir-/fmt/default - run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; s=$(date +%s%3N); mise --no-config --no-env --no-hooks exec opentofu@1.13.1 -- tofu fmt -check -recursive -no-color; code=$?; VELNOR_EXIT_CODE=\"$code\" VELNOR_START_MS=\"$s\" VELNOR_INTERNAL_OP=write-task-report-v1 \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"; helper_code=$?; if [ \"$code\" -ne 0 ]; then exit \"$code\"; fi; exit \"$helper_code\"'" + run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; s=$(date +%s%3N); mise --no-config --no-env --no-hooks exec opentofu@1.13.1 -- tofu fmt -check -recursive -no-color; code=$?; VELNOR_EXIT_CODE=\"$code\" VELNOR_START_MS=\"$s\" VELNOR_INTERNAL_OP=write-task-report-v1 \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.9\"; helper_code=$?; if [ \"$code\" -ne 0 ]; then exit \"$code\"; fi; exit \"$helper_code\"'" - name: Init for validate if: "!contains(needs.plan.outputs.covered_tasks, ',stack/tofu/dir-/init/default,')" env: @@ -324,7 +328,7 @@ jobs: VELNOR_MATRIX_KEY: m-dd8cb3a035daf865 VELNOR_TASK_DIGEST: b3-5ec299f3808a7018d7b433404d75005f0da6af0d189053e01407a9bdecdea694 VELNOR_TASK_ID: stack/tofu/dir-/init/default - run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; s=$(date +%s%3N); mise --no-config --no-env --no-hooks exec opentofu@1.13.1 -- tofu init -backend=false -input=false -lockfile=readonly -no-color; code=$?; VELNOR_EXIT_CODE=\"$code\" VELNOR_START_MS=\"$s\" VELNOR_INTERNAL_OP=write-task-report-v1 \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"; helper_code=$?; if [ \"$code\" -ne 0 ]; then exit \"$code\"; fi; exit \"$helper_code\"'" + run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; s=$(date +%s%3N); mise --no-config --no-env --no-hooks exec opentofu@1.13.1 -- tofu init -backend=false -input=false -lockfile=readonly -no-color; code=$?; VELNOR_EXIT_CODE=\"$code\" VELNOR_START_MS=\"$s\" VELNOR_INTERNAL_OP=write-task-report-v1 \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.9\"; helper_code=$?; if [ \"$code\" -ne 0 ]; then exit \"$code\"; fi; exit \"$helper_code\"'" - name: Validate if: "!contains(needs.plan.outputs.covered_tasks, ',stack/tofu/dir-/validate/default,')" env: @@ -336,7 +340,7 @@ jobs: VELNOR_MATRIX_KEY: m-4cb0c782e5cd0eb9 VELNOR_TASK_DIGEST: b3-b9ea8471b2e348a63462488325d31787568b7cce6bdb27dfb951a95c331efd3a VELNOR_TASK_ID: stack/tofu/dir-/validate/default - run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; s=$(date +%s%3N); mise --no-config --no-env --no-hooks exec opentofu@1.13.1 -- tofu validate -no-color; code=$?; VELNOR_EXIT_CODE=\"$code\" VELNOR_START_MS=\"$s\" VELNOR_INTERNAL_OP=write-task-report-v1 \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"; helper_code=$?; if [ \"$code\" -ne 0 ]; then exit \"$code\"; fi; exit \"$helper_code\"'" + run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; s=$(date +%s%3N); mise --no-config --no-env --no-hooks exec opentofu@1.13.1 -- tofu validate -no-color; code=$?; VELNOR_EXIT_CODE=\"$code\" VELNOR_START_MS=\"$s\" VELNOR_INTERNAL_OP=write-task-report-v1 \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.9\"; helper_code=$?; if [ \"$code\" -ne 0 ]; then exit \"$code\"; fi; exit \"$helper_code\"'" - name: Upload crate reports if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a diff --git a/.velnor/release-manifest.json b/.velnor/release-manifest.json index 4abb380..4b46d47 100644 --- a/.velnor/release-manifest.json +++ b/.velnor/release-manifest.json @@ -1,23 +1,23 @@ { "schema": 1, - "version": "0.1.6", + "version": "0.1.9", "repository": "tailrocks/velnor-new", - "commit": "e0cebf8ea523589a335d3cbc3699c973ce1e18a4", + "commit": "a7d49aa6b0af3b1ccb5cac3d93147eba82eba4f9", "targets": [ { "target": "x86_64-unknown-linux-gnu", - "artifact": "https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-x86_64-unknown-linux-gnu", - "sha256": "411db6702e5f627ba106f5a5f1d2b324d32844e6520bd7b3c00139b0029b12d1" + "artifact": "https://github.com/tailrocks/velnor-new/releases/download/v0.1.9/velnor-actions-0.1.9-x86_64-unknown-linux-gnu", + "sha256": "6cd0fb8b096d49f1d02b713428da04fabbe836dd3b7113d483ffbe59db96fa8e" }, { "target": "aarch64-apple-darwin", - "artifact": "https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-aarch64-apple-darwin", - "sha256": "3774bb8a96eae0e029d37a1f0710b12d9478bc56b9ffed3a5e7c0eefed34fdfb" + "artifact": "https://github.com/tailrocks/velnor-new/releases/download/v0.1.9/velnor-actions-0.1.9-aarch64-apple-darwin", + "sha256": "1df65f6b47781e4ced14087e1fea4e5869a9e6a92d5a453dcc260ac92dde0690" }, { "target": "x86_64-apple-darwin", - "artifact": "https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-x86_64-apple-darwin", - "sha256": "a73dcd07673337b44de9a33425e5e1bfdd57fc38018f5ad7853fcb16795bab20" + "artifact": "https://github.com/tailrocks/velnor-new/releases/download/v0.1.9/velnor-actions-0.1.9-x86_64-apple-darwin", + "sha256": "2a3e70d7115917982b7de5f316930655f350570a5f6986c0251f3efb325dfb68" } ] }