refactor(rust-crates-advisory): split code for buildkite and report
Rename check-all-our-lock-files to tree-lock-file-report and pull out all the buildkite-specific code which makes the code less awkward. check-all-our-lock-files is then only executed in extraSteps and runs tree-lock-file-report on depot, adding it as a warning to the pipeline if it is non-empty. Change-Id: If6bd236d90cc680cba0ed4e988f2f28ddb8012d6 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5229 Tested-by: BuildkiteCI Reviewed-by: Profpatsch <mail@profpatsch.de>
This commit is contained in:
parent
de62043a74
commit
f7a0d5a3d0
1 changed files with 29 additions and 21 deletions
|
@ -4,6 +4,7 @@ let
|
||||||
|
|
||||||
bins =
|
bins =
|
||||||
depot.nix.getBins pkgs.s6-portable-utils [ "s6-ln" "s6-cat" "s6-echo" "s6-mkdir" "s6-test" "s6-touch" "s6-dirname" ]
|
depot.nix.getBins pkgs.s6-portable-utils [ "s6-ln" "s6-cat" "s6-echo" "s6-mkdir" "s6-test" "s6-touch" "s6-dirname" ]
|
||||||
|
// depot.nix.getBins pkgs.coreutils [ "printf" ]
|
||||||
// depot.nix.getBins pkgs.lr [ "lr" ]
|
// depot.nix.getBins pkgs.lr [ "lr" ]
|
||||||
// depot.nix.getBins pkgs.cargo-audit [ "cargo-audit" ]
|
// depot.nix.getBins pkgs.cargo-audit [ "cargo-audit" ]
|
||||||
// depot.nix.getBins pkgs.jq [ "jq" ]
|
// depot.nix.getBins pkgs.jq [ "jq" ]
|
||||||
|
@ -161,13 +162,16 @@ let
|
||||||
exit "''${PIPESTATUS[0]}" # inherit exit code from cargo-audit
|
exit "''${PIPESTATUS[0]}" # inherit exit code from cargo-audit
|
||||||
'';
|
'';
|
||||||
|
|
||||||
check-all-our-lock-files = depot.nix.writeExecline "check-all-our-lock-files" { } [
|
tree-lock-file-report = depot.nix.writeExecline "tree-lock-file-report"
|
||||||
|
{
|
||||||
|
readNArgs = 1;
|
||||||
|
} [
|
||||||
"backtick"
|
"backtick"
|
||||||
"-E"
|
"-E"
|
||||||
"report"
|
"report"
|
||||||
[
|
[
|
||||||
"pipeline"
|
"pipeline"
|
||||||
[ bins.find "." "-name" "Cargo.lock" "-and" "-type" "f" "-print0" ]
|
[ bins.find "$1" "-name" "Cargo.lock" "-and" "-type" "f" "-print0" ]
|
||||||
"forstdin"
|
"forstdin"
|
||||||
"-E"
|
"-E"
|
||||||
"-0"
|
"-0"
|
||||||
|
@ -187,27 +191,31 @@ let
|
||||||
"false"
|
"false"
|
||||||
]
|
]
|
||||||
"if"
|
"if"
|
||||||
[ depot.tools.eprintf "%s\n" "$report" ]
|
[ bins.printf "%s\n" "$report" ]
|
||||||
"ifelse"
|
|
||||||
[ bins.s6-test "-z" "$report" ]
|
|
||||||
# empty report implies success (no advisories)
|
# empty report implies success (no advisories)
|
||||||
[ "exit" "0" ]
|
|
||||||
# If we reach this point, we know that the report is non-empty, so we should
|
|
||||||
# only continue without one if we are running in buildkite.
|
|
||||||
"if"
|
|
||||||
[
|
|
||||||
"importas"
|
|
||||||
"-D"
|
|
||||||
""
|
|
||||||
"BUILDKITE_BUILD_ID"
|
|
||||||
"BUILDKITE_BUILD_ID"
|
|
||||||
bins.s6-test
|
bins.s6-test
|
||||||
"-n"
|
"-z"
|
||||||
"$BUILDKITE_BUILD_ID"
|
"$report"
|
||||||
|
];
|
||||||
|
|
||||||
|
check-all-our-lock-files = depot.nix.writeExecline "check-all-our-lock-files" { } [
|
||||||
|
"backtick"
|
||||||
|
"-EI"
|
||||||
|
"report"
|
||||||
|
[
|
||||||
|
tree-lock-file-report
|
||||||
|
"."
|
||||||
|
]
|
||||||
|
"ifelse"
|
||||||
|
[
|
||||||
|
bins.s6-test
|
||||||
|
"-z"
|
||||||
|
"$report"
|
||||||
|
]
|
||||||
|
[
|
||||||
|
"exit"
|
||||||
|
"0"
|
||||||
]
|
]
|
||||||
# If we're running in buildkite, annotate the pipeline run with the report
|
|
||||||
# as a warning. Only fail if something goes wrong with buildkite-agent
|
|
||||||
# which is assumed to be in PATH.
|
|
||||||
"pipeline"
|
"pipeline"
|
||||||
[
|
[
|
||||||
"printf"
|
"printf"
|
||||||
|
@ -236,7 +244,7 @@ depot.nix.readTree.drvTargets {
|
||||||
;
|
;
|
||||||
|
|
||||||
|
|
||||||
check-all-our-lock-files = check-all-our-lock-files // {
|
tree-lock-file-report = tree-lock-file-report // {
|
||||||
meta.ci.extraSteps.run = {
|
meta.ci.extraSteps.run = {
|
||||||
label = "Check Cargo.lock files in depot for advisories";
|
label = "Check Cargo.lock files in depot for advisories";
|
||||||
alwaysRun = true;
|
alwaysRun = true;
|
||||||
|
|
Loading…
Reference in a new issue