add CodeQL, Trivy and Clippy checks #158
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Basic | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| workflow_dispatch: | |
| inputs: | |
| deploy_documentation: | |
| description: Deploy documentation | |
| required: false | |
| type: boolean | |
| default: false | |
| env: | |
| CARGO_TERM_COLOR: always | |
| permissions: | |
| contents: read | |
| jobs: | |
| build-and-test: | |
| runs-on: ["oneapi-rs", "Linux"] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Check if oneAPI is already installed | |
| id: check-oneapi | |
| run: | | |
| if [ -f /home/test-user/intel/oneapi/setvars.sh ]; then | |
| echo "installed=true" >> $GITHUB_OUTPUT | |
| source /home/test-user/intel/oneapi/setvars.sh | |
| # copy envs to github | |
| printenv | grep -E '^(PATH|LD_LIBRARY_PATH|LIBRARY_PATH|CPATH|C_INCLUDE_PATH|CPLUS_INCLUDE_PATH)=' >> $GITHUB_ENV | |
| else | |
| echo "installed=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Setup oneAPI | |
| if: steps.check-oneapi.outputs.installed != 'true' | |
| run: | | |
| installer="intel-oneapi-toolkit-2026.1.0.192_offline.sh" | |
| checksum="9d969de9cafbb698bf50f088c4b5174b50fc816f504049e685d6f6d198e10dbc17ef2cd4cfb0bc2b3d2179644a8d77d1" | |
| curl --fail --location --retry 3 --silent --show-error --output "$installer" \ | |
| "https://registrationcenter-download.intel.com/akdlm/IRC_NAS/33cb2a22-ddf1-4aa9-8d68-1f5a118acaf2/intel-oneapi-toolkit-2026.1.0.192_offline.sh" | |
| echo "$checksum $installer" | sha384sum --check | |
| sh "./$installer" -a --silent --cli --eula accept | |
| source /home/test-user/intel/oneapi/setvars.sh | |
| # copy envs to github | |
| printenv | grep -E '^(PATH|LD_LIBRARY_PATH|LIBRARY_PATH|CPATH|C_INCLUDE_PATH|CPLUS_INCLUDE_PATH)=' >> $GITHUB_ENV | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| languages: rust | |
| - name: Print system info | |
| run: | | |
| sycl-ls --verbose | |
| #- name: Check formatting | |
| # run: cargo fmt --all -- --check | |
| - name: Check C++ formatting | |
| run: | | |
| git ls-files -z -- ':(glob)**/*.cpp' ':(glob)**/*.hpp' ':(glob)**/*.h' \ | |
| | xargs -0 --no-run-if-empty clang-format --dry-run --Werror | |
| - name: Run Clippy | |
| run: cargo clippy --workspace --all-targets -- -D warnings | |
| - name: Build | |
| run: cargo build --verbose | |
| - name: Run workspace tests | |
| run: cargo test --workspace --verbose | |
| - name: Run examples | |
| run: | | |
| for example_path in sycl/sycl-rs/examples/*.rs; do | |
| example="$(basename "$example_path" .rs)" | |
| cargo run -p sycl-rs --example "$example" --verbose | |
| done | |
| - name: Analyze with CodeQL | |
| uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| - name: Generate documentation | |
| run: | | |
| cargo doc -p sycl-rs --no-deps --verbose | |
| cat > target/doc/index.html <<'HTML' | |
| <!doctype html> | |
| <html lang="en"> | |
| <head> | |
| <meta charset="utf-8"> | |
| <meta http-equiv="refresh" content="0; url=sycl_rs/"> | |
| <title>sycl-rs documentation</title> | |
| </head> | |
| <body> | |
| <p><a href="sycl_rs/">sycl-rs documentation</a></p> | |
| </body> | |
| </html> | |
| HTML | |
| - name: Upload documentation artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: documentation | |
| path: target/doc | |
| trivy: | |
| name: Trivy scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Scan repository with Trivy | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| scanners: vuln,secret,misconfig | |
| exit-code: 1 | |
| deploy-documentation: | |
| if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'workflow_dispatch' && inputs.deploy_documentation == 'true') | |
| needs: build-and-test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Download documentation artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: documentation | |
| path: target/doc | |
| - name: Configure GitHub Pages | |
| uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 | |
| - name: Upload documentation to GitHub Pages | |
| uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 | |
| with: | |
| path: target/doc | |
| - name: Deploy documentation to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 |