trailofbits / .github Goto Github PK

#6 will add an initial reusable linting workflow. Here are some of the languages/ecosystems we'd like to eventually support:

• Go (#6)
• Rust (#6)
• Python via make lint (#6)
• C and C++
  • CMake via cmake-format
• Ethereum (maybe?)
• Haskell (maybe?)
• Generic make lint (#6)
• Ruby (maybe?)
• Markdown linting with markdownlint-cli + markdown-link-check (#12)
  • Possible follow-on for markdown-link-check

This is a prime candidate for a reusable workflow, since it boils down to:

      - uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.x'

      - name: Build distributions
        run: make dist

      - name: Publish a Python distribution to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_TOKEN }}

This flow will be even nicer when PyPI supports reusable workflows for publishing, which is something we're working on.

It'd be nice if we had a default template for sigstore/gh-action-sigstore-python, so that all of our projects (at least the ones that do releases via GitHub) can gain codesigning for free.

Some catches:

• This might not be a good fit for a workflow template, since the signing step is conceptually a job within a larger "release" workflow rather than a standalone workflow

just, a rust-based tools installed using Cargo, can take a long time to build on GitHub Actions runners.

We should look into a way to download pre-built tools in a way that supports multiple platforms (Linux, Windows, macOS) to speed up this installation process.

just has a Releases page with pre-built binaries, so we could pull from there, as long as the naming stays somewhat consistent.

Originally posted by @ekilmer in #10 (comment)