opendefensecloud / solution-arsenal / 33746667110
80%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 89
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 80.148% (-0.03%) from 80.177%
33746667110

push

github

web-flow 
ci: use dev-kit setup-nix composite action (#792)

## What
Replace the inline nix + Cachix preamble in six workflows with dev-kit's
`setup-nix`
composite action, and put all dev-kit references on **v2.2.0**.

## Why
The installer + Cachix pair was copy-pasted at **8 call sites**.
Extracting it to dev-kit
([#30](https://github.com/opendefensecloud/dev-kit/pull/30), released in
[v2.2.0](https://github.com/opendefensecloud/dev-kit/releases/tag/v2.2.0))
means the installer
choice is changed in one place instead of fourteen once artifact-conduit
adopts the same action.

Solar also carried **three** dev-kit pins at two different versions. Now
one.

## Testing
- Solar's own `update-action-pins` check passes — every `uses:` is
SHA-pinned.
- `actionlint` clean before the pin swap; the only findings are two
pre-existing SC2086
  infos in `docker.yaml` / `release-please.yaml`, both untouched here.
- Real verification is this PR's own CI run: `golang`, `codegen`,
`helm-lint`,
`helm-publish`, `test-e2e` and `test-demo` all go through the new
action.

## Notes for reviewers
No behaviour change intended — same installer, same pins, same Cachix
cache.

- **`determinate: false` and the empty `diagnostic-endpoint` moved into
the action**, along
  with the comments explaining them. Same values as before.
- **Secrets are still passed by the caller.** Composite actions have no
`secrets` context,
so `cachix-auth-token` / `cachix-signing-key` are inputs. Both default
to `''`, which is
  the existing fork-PR read-only fallback.
- **`diff-check` and `renovate-auto-approve` moved v1.0.15 → v2.2.0.**
Both files are
  byte-identical between those tags — a pin refresh, not an upgrade.
- Go cache steps and their trust-scoping comments (#237) are untouched.
- `release-please.yaml` and `docker.yaml` keep their own setup; out of
scope.

Prepares artifact-conduit#441, which will use the same action.

## Checklist
- [ ] Tests added/updated <!-- n/a — CI config only -->
- [x] No breakin... (continued)

5515 of 6881 relevant lines covered (80.15%)

46.84 hits per line

Coverage Regressions

Lines Coverage ∆ File
2
78.26
 -0.18% pkg/controller/target_controller.go
Jobs
ID Job ID Ran Files Coverage
1 33746667110.1 89
80.15
 GitHub Action Run
Source Files on build 33746667110