Skip to content

ci: pin actions to commit SHAs (supply-chain); add yara-scan feature build/test job #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
warpedatom merged 1 commit into from
Jul 21, 2026
Merged

ci: pin actions to commit SHAs (supply-chain); add yara-scan feature build/test job #14

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 25 additions & 8 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,8 @@ jobs:
name: rustfmt
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
with:
components: rustfmt
- run: cargo fmt --all --check
Expand All @@ -23,11 +23,11 @@ jobs:
name: clippy
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
with:
components: clippy
- uses: Swatinem/rust-cache@v2
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- run: cargo clippy --all-targets -- -D warnings

test:
Expand All @@ -38,8 +38,25 @@ jobs:
matrix:
os: [ubuntu-latest, windows-latest]
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- run: cargo build --release --verbose
- run: cargo test --verbose

yara:
name: yara-scan feature
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
with:
components: clippy
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
# bindgen needs libclang; the vendored libyara compiles from source with the
# runner's C toolchain (build-essential is preinstalled on ubuntu-latest).
- name: Install clang/libclang for the vendored yara build
run: sudo apt-get update && sudo apt-get install -y clang libclang-dev
Comment on lines +58 to +59

@sourcery-ai sourcery-ai Bot Jul 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion (performance): Tighten the apt-get install to avoid pulling unnecessary packages and speed up the job.

Please switch to sudo apt-get update && sudo apt-get install -y --no-install-recommends clang libclang-dev so we don’t pull in recommended packages unnecessarily while still meeting bindgen/libyara’s requirements.

Suggested change
- name: Install clang/libclang for the vendored yara build
run: sudo apt-get update && sudo apt-get install -y clang libclang-dev
- name: Install clang/libclang for the vendored yara build
run: sudo apt-get update && sudo apt-get install -y --no-install-recommends clang libclang-dev

- run: cargo build --release --features yara-scan --verbose
- run: cargo test --features yara-scan --verbose
- run: cargo clippy --all-targets --features yara-scan -- -D warnings
14 changes: 7 additions & 7 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,17 +22,17 @@ jobs:
bin: offsetscan.exe
asset: offsetscan-windows-x86_64.exe
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- run: cargo build --release --locked
- name: Stage binary
shell: bash
run: |
mkdir -p dist
cp "target/release/${{ matrix.bin }}" "dist/${{ matrix.asset }}"
- name: Attach to GitHub Release
uses: softprops/action-gh-release@v3
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
with:
files: dist/${{ matrix.asset }}
generate_release_notes: true
Expand All @@ -44,9 +44,9 @@ jobs:
needs: build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- name: Verify the tag matches Cargo.toml version
shell: bash
run: |
Expand Down