mirror of
https://github.com/fastfetch-cli/fastfetch.git
synced 2026-09-13 02:42:09 +02:00
Thibaud-Vdb
b6d95a0ce5
Jobs without a permissions block get the repository's default token scope, and reusable workflow calls pass the caller's grants straight through. Scopes are now derived from what each workflow actually does with the token: - every build workflow declares contents: read; none of them writes through the GITHUB_TOKEN. - build-linux-hosts.yml keeps security-events: write for the CodeQL upload; the other callers had that grant too but never upload scanning results, so they drop it. - build-windows-hosts.yml gets actions: read, which the SignPath action documents needing to read job details and download the unsigned artifact. - build-release.yml declares contents: write, matching the grant its caller already makes for creating the release. Runs that execute pull request code now hold a token that can do nothing but read the repository.
108 lines
3.9 KiB
YAML
108 lines
3.9 KiB
YAML
name: Reusable Linux Hosts
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
arch:
|
|
required: true
|
|
type: string
|
|
runs-on:
|
|
required: true
|
|
type: string
|
|
outputs:
|
|
ffversion:
|
|
description: fastfetch version from linux host build
|
|
value: ${{ jobs.build.outputs.ffversion }}
|
|
|
|
permissions:
|
|
security-events: write
|
|
contents: read
|
|
|
|
env:
|
|
CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ${{ inputs.runs-on }}
|
|
outputs:
|
|
ffversion: ${{ steps.ffversion.outputs.ffversion }}
|
|
steps:
|
|
- name: checkout repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: uname -a
|
|
run: uname -a
|
|
|
|
- name: cat /etc/os-release
|
|
run: cat /etc/os-release
|
|
|
|
- name: cat /proc/cpuinfo
|
|
run: cat /proc/cpuinfo
|
|
|
|
- name: add gcc-13 repo
|
|
run: sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
|
|
|
|
- name: install required packages
|
|
run: sudo apt-get update && sudo apt-get install -y gcc-13 libvulkan-dev libwayland-dev libxrandr-dev libxcb-randr0-dev libdconf-dev libdbus-1-dev libmagickcore-dev libsqlite3-dev librpm-dev libegl-dev libglx-dev ocl-icd-opencl-dev libpulse-dev libdrm-dev libelf-dev libddcutil-dev libefl-all-dev libunwind-dev liblua5.4-dev libvdpau-dev libva-dev rpm ninja-build
|
|
|
|
- name: install linuxbrew packages
|
|
run: |
|
|
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
|
|
/home/linuxbrew/.linuxbrew/bin/brew install imagemagick chafa quickjs-ng --ignore-dependencies
|
|
|
|
- name: Initialize CodeQL
|
|
if: inputs.arch == 'amd64'
|
|
uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
|
|
with:
|
|
languages: c
|
|
|
|
- name: configure project
|
|
run: CC=gcc-13 CMAKE_PREFIX_PATH=/home/linuxbrew/.linuxbrew PKG_CONFIG_PATH=/home/linuxbrew/.linuxbrew/lib/pkgconfig:$PKG_CONFIG_PATH cmake -GNinja -DSET_TWEAK=Off -DBUILD_TESTS=On -DENABLE_EMBEDDED_PCIIDS=On -DENABLE_EMBEDDED_AMDGPUIDS=On -DCMAKE_INSTALL_PREFIX=/usr .
|
|
|
|
- name: build project
|
|
run: cmake --build . --target package --verbose -j4
|
|
|
|
- name: perform CodeQL analysis
|
|
if: inputs.arch == 'amd64'
|
|
uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
|
|
|
|
- name: list features
|
|
run: ./fastfetch --list-features
|
|
|
|
- name: run fastfetch
|
|
run: time ./fastfetch -c presets/ci.jsonc --stat false
|
|
|
|
- name: run fastfetch --format json
|
|
run: time ./fastfetch -c presets/ci.jsonc --format json
|
|
|
|
- name: run flashfetch
|
|
run: time ./flashfetch
|
|
|
|
- name: print dependencies
|
|
run: ldd fastfetch
|
|
|
|
- name: run tests
|
|
run: ctest --output-on-failure
|
|
|
|
- name: get fastfetch version
|
|
id: ffversion
|
|
run: echo "ffversion=$(./fastfetch --version-raw)" >> $GITHUB_OUTPUT
|
|
|
|
- name: polyfill glibc
|
|
run: |
|
|
wget https://github.com/CarterLi/polyfill-glibc/releases/download/v0.0.1/polyfill-glibc-${{ inputs.arch }} -O polyfill-glibc
|
|
chmod +x polyfill-glibc
|
|
strip fastfetch && ./polyfill-glibc fastfetch --target-glibc=2.17
|
|
strip flashfetch && ./polyfill-glibc flashfetch --target-glibc=2.17
|
|
echo 'set(CPACK_PACKAGE_FILE_NAME "${CPACK_PACKAGE_FILE_NAME}-polyfilled")' >> CPackConfig.cmake
|
|
echo 'set(CPACK_PACKAGE_RELOCATABLE OFF)' >> CPackConfig.cmake
|
|
echo 'set(CPACK_DEBIAN_PACKAGE_DEPENDS "libc6 (>= 2.17)")' >> CPackConfig.cmake
|
|
echo 'set(CPACK_RPM_SPEC_MORE_DEFINE "%global __os_install_post %{nil}")' >> CPackConfig.cmake
|
|
cpack -V
|
|
|
|
- name: upload artifacts
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: fastfetch-linux-${{ inputs.arch }}
|
|
path: ./fastfetch-*.*
|