Skip to content

Commit 85a4565

Browse files
nam20485nam20485
authored
merge main into release (#96)
2 parents f1bde5b + f7e878f commit 85a4565

File tree

118 files changed

+6588
-258
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

118 files changed

+6588
-258
lines changed

Diff for: ‎.github/codeql-config.yml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: CodeQL Config
2+
3+
# paths-ignore only works for interpreted languages (i.e. not C/C++)
4+
5+
# paths:
6+
# - /home/runner/work/OdbDesign/OdbDesign/OdbDesignServer
7+
# - /home/runner/work/OdbDesign/OdbDesign/OdbDesignApp
8+
# - /home/runner/work/OdbDesign/OdbDesign/OdbDesignTests
9+
# - /home/runner/work/OdbDesign/OdbDesign/OdbDesignLib
10+
# - /home/runner/work/OdbDesign/OdbDesign/Utils
11+
12+
#paths-ignore:
13+
# - /home/runner/work/OdbDesign/OdbDesign/vcpkg/**/*
14+
# - /home/runner/work/OdbDesign/OdbDesign/out/build/linux-release/vcpkg_installed/**/*
15+
16+
#queries:
17+
# - uses: security
18+
#- uses: security-and-quality
19+
#- security-experimental
20+
#- security-extended

Diff for: ‎.github/codeql/codeql-config.yml

-10
This file was deleted.

Diff for: ‎.github/dependabot.yml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: daily
7+
8+
- package-ecosystem: pip
9+
directory: /PyOdbDesignServer
10+
schedule:
11+
interval: daily
12+
13+
- package-ecosystem: docker
14+
directory: /
15+
schedule:
16+
interval: daily

Diff for: ‎.github/workflows/cmake-multi-platform.yml

+73-38
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ on:
88
branches: [ "development", "main", "release" ]
99

1010
permissions:
11-
contents: write
11+
contents: read
1212

1313
env:
1414
VCPKG_ROOT: ${{ github.workspace }}/vcpkg
@@ -23,6 +23,8 @@ jobs:
2323
build:
2424
name: CMake-Multi-Platform-Build
2525
runs-on: ${{ matrix.os }}
26+
permissions:
27+
contents: write
2628

2729
strategy:
2830
# Set fail-fast to false to ensure that feedback is delivered for all matrix combinations. Consider changing this to true when your workflow is stable.
@@ -49,14 +51,14 @@ jobs:
4951
steps:
5052

5153
- name: Checkout Repository
52-
uses: actions/checkout@v3
54+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
5355

5456
# add problem matchers by compiler
5557
- name: Add Problem Matchers
56-
uses: ammaraskar/msvc-problem-matcher@master
58+
uses: ammaraskar/msvc-problem-matcher@13149ebc00eaa00eadcd81b204d7159cca5de4fd # master
5759
if: matrix.os == 'windows-2022'
5860
- name: Add Problem Matchers
59-
uses: ammaraskar/gcc-problem-matcher@master
61+
uses: ammaraskar/gcc-problem-matcher@d1fed1fac9e94d30e23b5a82dba4e2963e71d2e7 # master
6062
if: matrix.os != 'windows-2022'
6163

6264
- name: Install vcpkg Dependencies
@@ -76,12 +78,12 @@ jobs:
7678
if: matrix.os != 'windows-2022'
7779

7880
- name: Install Ninja
79-
uses: seanmiddleditch/gha-setup-ninja@master
81+
uses: seanmiddleditch/gha-setup-ninja@8b297075da4cd2a5f1fd21fe011b499edf06e9d2 # master
8082
if: matrix.os != 'windows-2022'
8183

8284
# Export vcpkg Cache Variables
8385
- name : Export vcpkg Cache Variables
84-
uses: actions/github-script@v6
86+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
8587
with:
8688
script: |
8789
core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
@@ -100,7 +102,7 @@ jobs:
100102
# os == windows-2022
101103
#
102104
- name: Setup VC Tools
103-
uses: ilammy/msvc-dev-cmd@v1
105+
uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # v1.12.1
104106
if: matrix.os == 'windows-2022'
105107

106108
- name: Patch vcpkg
@@ -174,12 +176,16 @@ jobs:
174176
Compress-Archive -Path "${{env.ARTIFACTS_DIR_WIN}}\*.dll","${{env.ARTIFACTS_DIR_WIN}}\*.exe" -DestinationPath "${{env.ARTIFACTS_DIR_WIN}}\artifacts-${{matrix.os}}.zip" -Verbose -Force
175177
176178
- name: Upload Artifacts
177-
uses: actions/upload-artifact@v2
179+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
178180
with:
179181
name: ${{ matrix.os }}-artifacts
180182
path: ${{ env.ARTIFACTS_DIR }}/artifacts-${{matrix.os}}.zip
181183
retention-days: 1
182184

185+
#
186+
# Create Release job
187+
#
188+
183189
release:
184190
# only on pushes to the release branch
185191
name: Create Release
@@ -192,13 +198,40 @@ jobs:
192198
steps:
193199

194200
- name: Checkout Repository
195-
uses: actions/checkout@v3
201+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
196202

197203
# download the artifacts
198204
- name: "Download artifacts"
199-
uses: "actions/download-artifact@v2"
205+
uses: "actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a" # v3.0.2
200206
with:
201-
path: ${{ github.workspace }}/artifacts
207+
path: ${{ github.workspace }}/artifacts
208+
209+
- name: Rename Artifacts
210+
run: |
211+
mv ${{ github.workspace }}/artifacts/ubuntu-22.04-artifacts/artifacts-ubuntu-22.04.zip ${{ github.workspace }}/artifacts/OdbDesign-Linux-x64.zip
212+
mv ${{ github.workspace }}/artifacts/windows-2022-artifacts/artifacts-windows-2022.zip ${{ github.workspace }}/artifacts/OdbDesign-Windows-x64.zip
213+
mv ${{ github.workspace }}/artifacts/macos-12-artifacts/artifacts-macos-12.zip ${{ github.workspace }}/artifacts/OdbDesign-MacOS-x64.zip
214+
215+
- name: Generate SHA256 Sums
216+
run: |
217+
# sha256
218+
cd ${{ github.workspace }}/artifacts
219+
sha256sum OdbDesign-Linux-x64.zip > OdbDesign-Linux-x64.zip.sha256sum
220+
sha256sum OdbDesign-Windows-x64.zip > OdbDesign-Windows-x64.zip.sha256sum
221+
sha256sum OdbDesign-MacOS-x64.zip > OdbDesign-MacOS-x64.zip.sha256sum
222+
223+
- name: Import GPG Key
224+
uses: crazy-max/ghaction-import-gpg@82a020f1f7f605c65dd2449b392a52c3fcfef7ef # v6.0.0
225+
with:
226+
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
227+
passphrase: ${{ secrets.PASSPHRASE }}
228+
229+
- name: Sign Binaries
230+
run: |
231+
cd ${{ github.workspace }}/artifacts
232+
gpg --batch --yes --detach-sign --armor OdbDesign-Linux-x64.zip
233+
gpg --batch --yes --detach-sign --armor OdbDesign-Windows-x64.zip
234+
gpg --batch --yes --detach-sign --armor OdbDesign-MacOS-x64.zip
202235
203236
- name: Create Release Variables
204237
run: |
@@ -209,50 +242,52 @@ jobs:
209242
export RELEASE_NAME="OdbDesign ${RELEASE_TAG}"
210243
echo "RELEASE_NAME=$RELEASE_NAME" >> $GITHUB_ENV
211244
212-
- name: Rename Artifacts
213-
run: |
214-
mv ${{ github.workspace }}/artifacts/ubuntu-22.04-artifacts/artifacts-ubuntu-22.04.zip ${{ github.workspace }}/artifacts/OdbDesign-Linux-x64.zip
215-
mv ${{ github.workspace }}/artifacts/windows-2022-artifacts/artifacts-windows-2022.zip ${{ github.workspace }}/artifacts/OdbDesign-Windows-x64.zip
216-
mv ${{ github.workspace }}/artifacts/macos-12-artifacts/artifacts-macos-12.zip ${{ github.workspace }}/artifacts/OdbDesign-MacOS-x64.zip
217-
218245
# create a release
219246
- name: "Create GitHub Release"
220-
uses: "actions/github-script@v6"
247+
uses: "actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410" # v6.4.1
221248
with:
222249
github-token: "${{ secrets.GITHUB_TOKEN }}"
223250
script: |
224-
try {
225-
const createResponse = await github.rest.repos.createRelease({
226-
generate_release_notes: true,
227-
name: process.env.RELEASE_NAME,
228-
owner: context.repo.owner,
229-
repo: context.repo.repo,
230-
tag_name: process.env.RELEASE_TAG,
231-
body: require('fs').readFileSync('${{ github.workspace }}/release/release-body.md', 'utf8'),
232-
target_commitish: '${{ github.ref_name }}'
251+
try {
252+
const createResponse = await github.rest.repos.createRelease({
253+
generate_release_notes: true,
254+
name: process.env.RELEASE_NAME,
255+
owner: context.repo.owner,
256+
repo: context.repo.repo,
257+
tag_name: process.env.RELEASE_TAG,
258+
body: require('fs').readFileSync('${{ github.workspace }}/release/release-body.md', 'utf8'),
259+
target_commitish: '${{ github.ref_name }}'
233260
});
234261
235-
const filenames = [
236-
'OdbDesign-Linux-x64.zip',
237-
'OdbDesign-Windows-x64.zip',
238-
'OdbDesign-MacOS-x64.zip'
262+
const files =
263+
[
264+
{ name: 'OdbDesign-Linux-x64.zip', contentType: 'application/zip' },
265+
{ name: 'OdbDesign-Linux-x64.zip.sha256sum', contentType: 'text/plain' },
266+
{ name: 'OdbDesign-Linux-x64.zip.asc', contentType: 'text/plain' },
267+
{ name: 'OdbDesign-Windows-x64.zip', contentType: 'application/zip' },
268+
{ name: 'OdbDesign-Windows-x64.zip.sha256sum', contentType: 'text/plain' },
269+
{ name: 'OdbDesign-Windows-x64.zip.asc', contentType: 'text/plain' },
270+
{ name: 'OdbDesign-MacOS-x64.zip', contentType: 'application/zip' },
271+
{ name: 'OdbDesign-MacOS-x64.zip.sha256sum', contentType: 'text/plain' },
272+
{ name: 'OdbDesign-MacOS-x64.zip.asc', contentType: 'text/plain' }
239273
];
274+
275+
const artifactsPath = '${{ github.workspace }}/artifacts';
240276
241-
for (const filename of filenames) {
242-
const artifactsPath = '${{ github.workspace }}/artifacts';
243-
const filePath = artifactsPath +'/' + filename;
277+
for (const file of files) {
278+
const filePath = artifactsPath +'/' + file.name;
244279
const uploadResponse = await github.rest.repos.uploadReleaseAsset({
245280
owner: context.repo.owner,
246281
repo: context.repo.repo,
247282
release_id: createResponse.data.id,
248-
name: filename,
283+
name: file.name,
249284
data: require('fs').readFileSync(filePath),
250285
headers: {
251-
'content-type': 'application/zip',
252-
'content-length': require('fs').statSync(filePath).size
286+
'content-type': file.contentType,
287+
'content-length': require('fs').statSync(filePath).size
253288
}
254289
});
255290
}
256291
} catch (error) {
257292
core.setFailed(error.message);
258-
}
293+
}

Diff for: ‎.github/workflows/codeql.yml

+10-7
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ env:
2121
VCPKG_ROOT: ${{ github.workspace }}/vcpkg
2222
VCPKG_BINARY_SOURCES: 'clear;x-gha,readwrite'
2323

24+
permissions:
25+
contents: read
26+
2427
jobs:
2528
analyze:
2629
name: CodeQL-Security-Scan
@@ -34,32 +37,32 @@ jobs:
3437
strategy:
3538
fail-fast: false
3639
matrix:
37-
language: [ 'cpp' ]
40+
language: [ 'c-cpp' ]
3841
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
3942
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
4043

4144
steps:
4245
- name: Checkout repository
43-
uses: actions/checkout@v3
46+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
4447

4548
# Initializes the CodeQL tools for scanning.
4649
- name: Initialize CodeQL
47-
uses: github/codeql-action/init@v2
50+
uses: github/codeql-action/init@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
4851
with:
4952
languages: ${{ matrix.language }}
50-
config-file: ${{ github.workspace }}/.github/codeql/codeql-config.yml
53+
config-file: ${{ github.workspace }}/.github/codeql-config.yml
5154

5255
- name: Install vcpkg
5356
run: |
5457
git clone --depth 1 https://github.com/Microsoft/vcpkg.git ${{env.VCPKG_ROOT}}
5558
"${{env.VCPKG_ROOT}}/bootstrap-vcpkg.sh"
5659
5760
- name: Install Ninja
58-
uses: seanmiddleditch/gha-setup-ninja@master
61+
uses: seanmiddleditch/gha-setup-ninja@8b297075da4cd2a5f1fd21fe011b499edf06e9d2 # master
5962

6063
# Export vcpkg Cache Variables
6164
- name : Export vcpkg Cache Variables
62-
uses: actions/github-script@v6
65+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
6366
with:
6467
script: |
6568
core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
@@ -75,6 +78,6 @@ jobs:
7578
run: cmake --build --preset linux-release
7679

7780
- name: Perform CodeQL Analysis
78-
uses: github/codeql-action/analyze@v2
81+
uses: github/codeql-action/analyze@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
7982
with:
8083
category: "/language:${{matrix.language}}"

Diff for: ‎.github/workflows/dependency-review.yml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: 'Checkout Repository'
20+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
21+
- name: 'Dependency Review'
22+
uses: actions/dependency-review-action@6c5ccdad469c9f8a2996bfecaec55a631a347034 # v3.1.0

Diff for: ‎.github/workflows/msvc.yml renamed to ‎.github/workflows/disabled/msvc.yml

+5-5
Original file line numberDiff line numberDiff line change
@@ -33,18 +33,18 @@ jobs:
3333

3434
steps:
3535
- name: Checkout repository
36-
uses: actions/checkout@v3
36+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3737

3838
# Export vcpkg Cache Variables
3939
- name : Export vcpkg Cache Variables
40-
uses: actions/github-script@v6
40+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
4141
with:
4242
script: |
4343
core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
4444
core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
4545
4646
- name: Setup VC Tools
47-
uses: ilammy/msvc-dev-cmd@v1
47+
uses: ilammy/msvc-dev-cmd@7315a94840631165970262a99c72cfb48a65d25d # v1.12.0
4848

4949
- name: Patch vcpkg
5050
run: scripts/patch-vcpkg-install.ps1
@@ -73,13 +73,13 @@ jobs:
7373

7474
# Upload SARIF file to GitHub Code Scanning Alerts
7575
- name: Upload SARIF to GitHub
76-
uses: github/codeql-action/upload-sarif@v2
76+
uses: github/codeql-action/upload-sarif@49abf0ba24d0b7953cb586944e918a0b92074c80 # v2.22.4
7777
with:
7878
sarif_file: ${{ steps.run-analysis.outputs.sarif }}
7979

8080
# Upload SARIF file as an Artifact to download and view
8181
- name: Upload SARIF as an Artifact
82-
uses: actions/upload-artifact@v3
82+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
8383
with:
8484
name: sarif-file
8585
path: ${{ steps.run-analysis.outputs.sarif }}

Diff for: ‎.github/workflows/python-publish.yml renamed to ‎.github/workflows/disabled/python-publish.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,9 @@ jobs:
2828
working-directory: PyOdbDesignLib
2929

3030
steps:
31-
- uses: actions/checkout@v3
31+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3232
- name: Set up Python
33-
uses: actions/setup-python@v3
33+
uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3.1.4
3434
with:
3535
python-version: '3.x'
3636
- name: Install dependencies

0 commit comments

Comments
 (0)