Bump step-security/harden-runner from 2.11.1 to 2.12.0 #812
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Codacy Clang-Tidy | |
| on: | |
| push: | |
| paths: | |
| - '**.[ch]pp' | |
| - '**/codacy.yaml' | |
| pull_request: | |
| paths: | |
| - '**.[ch]pp' | |
| - '**/codacy.yaml' | |
| permissions: | |
| contents: read | |
| jobs: | |
| codacy: | |
| name: clang-tidy to Codacy | |
| runs-on: ubuntu-latest | |
| env: | |
| BUILD_DIR: build_clangtidy | |
| CCT_VERSION: 1.3.8 | |
| CCT: codacy-clang-tidy-linux | |
| CODACY_URL: https://api.codacy.com | |
| # The path for clang-tidy output. | |
| CLANG_TIDY_OUT: /tmp/clang-tidy-out | |
| CLANG_VERSION: 18 | |
| # The path for codacy-clang-tidy output. | |
| CCT_OUT: /tmp/cct-out | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| submodules: True | |
| - name: Install Dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y cmake | |
| - name: Install Dependencies (LLVM) | |
| uses: paulhuggett/install-llvm@ad897b4b1cf03f54c1218ec6d97a23ff4b10b870 # v1.0 | |
| with: | |
| version: ${{ env.CLANG_VERSION }} | |
| all: true | |
| - name: Download the codacy-clang-tidy tool | |
| env: | |
| CCT_DOWNLOAD_URL: https://github.com/codacy/codacy-clang-tidy/releases/download/${{ env.CCT_VERSION }}/${{ env.CCT }}-${{ env.CCT_VERSION }} | |
| run: | | |
| mkdir -p "$HOME/cct" | |
| curl -L "${CCT_DOWNLOAD_URL}" -o "$HOME/cct/${CCT}-${CCT_VERSION}" | |
| chmod +x "$HOME/cct/${CCT}-${CCT_VERSION}" | |
| - name: Configure | |
| run: | | |
| cmake -S . \ | |
| -B "$BUILD_DIR" \ | |
| -D CMAKE_BUILD_TYPE=Release \ | |
| -D CMAKE_EXPORT_COMPILE_COMMANDS=Yes \ | |
| -D "CMAKE_C_COMPILER=clang-$CLANG_VERSION" \ | |
| -D "CMAKE_CXX_COMPILER=clang++-$CLANG_VERSION" \ | |
| -D ICUBABY_EXAMPLES=Yes \ | |
| -D ICUBABY_STANDALONE=Yes | |
| - name: Run clang-tidy | |
| run: | | |
| find . -name "*.?pp" -not -path "./$BUILD_DIR/*" -print0 | \ | |
| xargs -0 "clang-tidy-$CLANG_VERSION" "-p=$BUILD_DIR/compile_commands.json" | \ | |
| tee -a "${{ env.CLANG_TIDY_OUT }}" | |
| # Convert the clang-tidy output to a format that the Codacy API accepts | |
| - name: Run codacy-clang-tidy | |
| run: | | |
| "$HOME/cct/${CCT}-${CCT_VERSION}" < "$CLANG_TIDY_OUT" > "$CCT_OUT" | |
| - name: Upload to the Codacy server | |
| run: | | |
| COMMIT=$(git rev-parse HEAD) | |
| # Send the results to Codacy | |
| curl -XPOST \ | |
| -L \ | |
| -H "project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}" \ | |
| -H "Content-type: application/json" \ | |
| -d "@$CCT_OUT" \ | |
| "${CODACY_URL}/2.0/commit/${COMMIT}/issuesRemoteResults" | |
| # Signal that Codacy can use the sent results and start a new analysis | |
| curl -XPOST \ | |
| -L \ | |
| -H "project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}" \ | |
| -H "Content-type: application/json" \ | |
| "${CODACY_URL}/2.0/commit/${COMMIT}/resultsFinal" |