blues / note-c / 39328771447

93%

push

github

ci: fix workflow bugs, bump actions, tighten permissions (#259)

* Fix md5srv HIL job failing with HTTP 403 while installing Bats.

- The md5srv-test job (the first job of the nightly card.binary HIL
  workflow) failed in "Setup Bats and bats libs" with
  "curl: (22) The requested URL returned error: 403". The card.binary
  hardware job needs md5srv-test, so it was skipped.
- The workflow does not pass bats-version to bats-core/bats-action, so
  the action looks up the latest Bats release through
  api.github.com/repos/bats-core/bats-core/releases/latest. The
  BATS_VERSION env var in this workflow is not read by the action.
- bats-action 3.0.0 makes that lookup without a token. Unauthenticated
  API calls share a 60 requests/hour limit per source IP, and GitHub
  answers with 403 once the limit is used up. curl -f hides the response
  body, so the log can't confirm the reason, but this is the likely one.
- bats-action 3.0.1 sends the job's GITHUB_TOKEN with the lookup and the
  tarball download. That is the upstream fix for this lookup. Bump to
  3.0.1. No other change: same inputs, same Bats version resolution, same
  libraries.
- Checked locally: actionlint reports no issues in md5srv-tests.yml, and
  the 3.0.1 install logic resolves and installs Bats v1.14.0, after which
  the md5srv bats suite passes (14 tests, 0 failures).

* Pin Bats to 1.14.0 in the md5srv HIL job.

- Pass bats-version: 1.14.0 to bats-core/bats-action. With an explicit
  version the action skips its api.github.com releases/latest lookup, so
  the install no longer depends on GitHub API rate limits at all.
- 1.14.0 is the version the nightly has been installing as "latest", so
  this does not change which Bats the tests run on.
- Remove the BATS_VERSION: 1.10.0 env var. The action never read it, and
  its value did not match the Bats version actually in use.
- Keep bats-action 3.0.1. Its token on the tarball download stays as
  defense in depth.

* ci: fix workflow bugs, bump a... (continued)

1229 of 1409 branches covered (87.22%)

Branch coverage included in aggregate %.

2526 of 2611 relevant lines covered (96.74%)

80.3 hits per line