opendefensecloud / artifact-conduit / 34348575121
86%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 12
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 85.762%. Remained the same
34348575121

push

github

web-flow 
ci: run workflows in the nix dev shell (#477)

## What
Run all six tool-installing workflows inside the nix dev shell, so CI
and local
development share one toolchain definition.

Closes #441

## Why
CI installed `kind`/`kubectl`/`helm` by curl, Go via `setup-go`, helm
via
`azure/setup-helm`, and `sed`-grepped the Go version out of `flake.nix`
— while the
flake already pinned all of them. The nix preamble comes from dev-kit's
`setup-nix`
action
([dev-kit#30](https://github.com/opendefensecloud/dev-kit/pull/30),
v2.2.0),
proven in solution-arsenal#792.

## Testing
- **`make test` green** on dev-kit's sideload script — 6 suites, 67
specs. This
needed real verification: ARC's own script was 43 lines behind and had
never run
  that code path.
- **kind spike** — nixpkgs `kind v0.32.0` stood up a real
`kindest/node:v1.36.1`
cluster and scheduled a pod. `kubectl v1.36.3` vs a `v1.36.1` server is
inside skew.
- `actionlint` clean (one pre-existing SC2086 in untouched
`docker.yaml`);
`update-action-pins` passes; dev shell resolves
go/kind/kubectl/helm/shellcheck.
- **Needs this PR's CI:** `test-e2e` (it is `workflow_call`, driven by
`docker.yaml`)
  and cachix cold-start cost.

## Notes for reviewers

**Two developer-visible changes.**

- **Committing no longer runs an osv-scanner scan** — inherited from
dev-kit v2.0.0's
`feat!: disable osv-scanner pre-commit hook by default`. Its condition
holds here:
`osv-scanner.yml` still scans every PR, every push to main, and weekly.
`make scan`
  runs it locally.
- **`kubectl` moves off floating `stable.txt`** to the nixpkgs pin
(1.36.3).
Unavoidable when sourcing from nix, and better than a version that can
drift ahead
  of the server. `helm` is a true no-op — v4.2.4 both before and after.

**cosign is unchanged.** `pkgs.cosign` is dropped from the flake because
it was unused
and would have shadowed `cosign-installer` under a nix shell, silently
changing which
cosign signs releases. The installer stays in all three sig... (continued)

1030 of 1201 relevant lines covered (85.76%)

1118.7 hits per line

Coverage Regressions

Lines Coverage ∆ File
2
83.67
 -1.02% pkg/controller/artifactworkflow_controller.go
Jobs
ID Job ID Ran Files Coverage
1 34348575121.1 12
85.76
 GitHub Action Run
Source Files on build 34348575121