Skip to content

ci(shared): bump vendored ci files #910

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
galoybot-app wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci(shared): bump vendored ci files #910

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 5 additions & 13 deletions .github/workflows/audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,25 +1,17 @@
#! Auto synced from Shared CI Resources repository
#! Don't change this file, instead change it in github.com/GaloyMoney/galoy-concourse-shared
#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared

name: Audit

on:
pull_request:
branches: [ main ]

permissions:
contents: read

jobs:
security_audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install cargo-audit
run: cargo install cargo-audit --locked
- name: Audit dependencies
run: |
if [ ! -f Cargo.lock ]; then
cargo generate-lockfile
fi
cargo audit --file Cargo.lock
- uses: actions/checkout@v3
- uses: actions-rs/audit-check@v1
with:
token: ${{ secrets.GITHUB_TOKEN }}

@cursor cursor Bot Oct 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Audit workflow reverts to archived action

High Severity

The Audit workflow drops the direct cargo audit run and switches back to archived actions-rs/audit-check@v1, while also removing permissions: contents: read. That action reports through the legacy Checks API and is the path the previous vendor pin existed to avoid, so pull-request security audits can fail or stop reporting vulnerabilities.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 46052e4. Configure here.

11 changes: 7 additions & 4 deletions .github/workflows/check-code.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,25 @@
#! Auto synced from Shared CI Resources repository
#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared
#! Don't change this file, instead change it in github.com/GaloyMoney/galoy-concourse-shared

name: Check Code

on:
pull_request:
branches: [main]

permissions:
contents: read

jobs:
check-code:
name: Check Code
runs-on: ubuntu-latest
steps:
- name: Install Nix
uses: DeterminateSystems/nix-installer-action@v4
uses: DeterminateSystems/nix-installer-action@v23
- name: Run the Magic Nix Cache
uses: DeterminateSystems/magic-nix-cache-action@v8
- uses: actions/checkout@v4
uses: DeterminateSystems/magic-nix-cache-action@v15
- uses: actions/checkout@v7
- name: Run check code
run: |
check_code_command=$(make -s --no-print-directory -n check-code)
Expand Down
7 changes: 5 additions & 2 deletions .github/workflows/spelling.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,22 @@
#! Auto synced from Shared CI Resources repository
#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared
#! Don't change this file, instead change it in github.com/GaloyMoney/galoy-concourse-shared

name: Spelling

on:
pull_request:
branches: [ main ]

permissions:
contents: read

jobs:
spelling:
name: Spell Check with Typos
runs-on: ubuntu-latest
steps:
- name: Checkout Actions Repository
uses: actions/checkout@v3
uses: actions/checkout@v7
- name: Spell Check Repo
uses: crate-ci/typos@v1
with:
Expand Down
18 changes: 5 additions & 13 deletions .github/workflows/vendor/rust-audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,25 +1,17 @@
#! Auto synced from Shared CI Resources repository
#! Don't change this file, instead change it in github.com/GaloyMoney/galoy-concourse-shared
#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared

name: Audit

on:
pull_request:
branches: [ main ]

permissions:
contents: read

jobs:
security_audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install cargo-audit
run: cargo install cargo-audit --locked
- name: Audit dependencies
run: |
if [ ! -f Cargo.lock ]; then
cargo generate-lockfile
fi
cargo audit --file Cargo.lock
- uses: actions/checkout@v3
- uses: actions-rs/audit-check@v1
with:
token: ${{ secrets.GITHUB_TOKEN }}
11 changes: 7 additions & 4 deletions .github/workflows/vendor/rust-check-code.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,25 @@
#! Auto synced from Shared CI Resources repository
#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared
#! Don't change this file, instead change it in github.com/GaloyMoney/galoy-concourse-shared

name: Check Code

on:
pull_request:
branches: [main]

permissions:
contents: read

jobs:
check-code:
name: Check Code
runs-on: ubuntu-latest
steps:
- name: Install Nix
uses: DeterminateSystems/nix-installer-action@v4
uses: DeterminateSystems/nix-installer-action@v23
- name: Run the Magic Nix Cache
uses: DeterminateSystems/magic-nix-cache-action@v8
- uses: actions/checkout@v4
uses: DeterminateSystems/magic-nix-cache-action@v15
- uses: actions/checkout@v7
- name: Run check code
run: |
check_code_command=$(make -s --no-print-directory -n check-code)
Expand Down
7 changes: 5 additions & 2 deletions .github/workflows/vendor/spelling.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,22 @@
#! Auto synced from Shared CI Resources repository
#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared
#! Don't change this file, instead change it in github.com/GaloyMoney/galoy-concourse-shared

name: Spelling

on:
pull_request:
branches: [ main ]

permissions:
contents: read

jobs:
spelling:
name: Spell Check with Typos
runs-on: ubuntu-latest
steps:
- name: Checkout Actions Repository
uses: actions/checkout@v3
uses: actions/checkout@v7
- name: Spell Check Repo
uses: crate-ci/typos@v1
with:
Expand Down
8 changes: 4 additions & 4 deletions ci/vendir.lock.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,14 @@ apiVersion: vendir.k14s.io/v1alpha1
directories:
- contents:
- git:
commitTitle: 'fix: run Rust audits without the legacy Checks API reporter'
sha: 5277f7cecf66f07065e4c3d41518b53909d3d5cb
commitTitle: 'Merge pull request #33 from GaloyMoney/feat--bump-shared-actions...'
sha: e70b475dc5f1bda2f33f22f9de59b35c534c419b
path: .
path: ../.github/workflows/vendor
- contents:
- git:
commitTitle: 'fix: run Rust audits without the legacy Checks API reporter'
sha: 5277f7cecf66f07065e4c3d41518b53909d3d5cb
commitTitle: 'Merge pull request #33 from GaloyMoney/feat--bump-shared-actions...'
sha: e70b475dc5f1bda2f33f22f9de59b35c534c419b
path: .
path: vendor
kind: LockConfig
4 changes: 2 additions & 2 deletions ci/vendir.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ directories:
- path: . # Copy this folder out to ..
git:
url: https://github.com/GaloyMoney/galoy-concourse-shared.git
ref: 5277f7cecf66f07065e4c3d41518b53909d3d5cb
ref: e70b475dc5f1bda2f33f22f9de59b35c534c419b
includePaths:
- shared/actions/*
excludePaths:
Expand All @@ -22,7 +22,7 @@ directories:
- path: .
git:
url: https://github.com/GaloyMoney/galoy-concourse-shared.git
ref: 5277f7cecf66f07065e4c3d41518b53909d3d5cb
ref: e70b475dc5f1bda2f33f22f9de59b35c534c419b
includePaths:
- shared/ci/**/*
excludePaths:
Expand Down
2 changes: 1 addition & 1 deletion ci/vendor/config/git-cliff.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#! Auto synced from Shared CI Resources repository
#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared
#! Don't change this file, instead change it in github.com/GaloyMoney/galoy-concourse-shared

# configuration file for git-cliff (0.1.0)

Expand Down
2 changes: 1 addition & 1 deletion ci/vendor/tasks/check-code.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/usr/bin/env bash

#! Auto synced from Shared CI Resources repository
#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared
#! Don't change this file, instead change it in github.com/GaloyMoney/galoy-concourse-shared

set -euo pipefail

Expand Down
2 changes: 1 addition & 1 deletion ci/vendor/tasks/helpers.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/bin/bash

#! Auto synced from Shared CI Resources repository
#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared
#! Don't change this file, instead change it in github.com/GaloyMoney/galoy-concourse-shared

if [[ -z $(git config --global user.email) ]]; then
git config --global user.email "bot@galoy.io"
Expand Down
2 changes: 1 addition & 1 deletion ci/vendor/tasks/prep-release-src.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/bin/bash

#! Auto synced from Shared CI Resources repository
#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared
#! Don't change this file, instead change it in github.com/GaloyMoney/galoy-concourse-shared

set -eu

Expand Down
2 changes: 1 addition & 1 deletion ci/vendor/tasks/test-integration.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/usr/bin/env bash

#! Auto synced from Shared CI Resources repository
#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared
#! Don't change this file, instead change it in github.com/GaloyMoney/galoy-concourse-shared

set -euo pipefail

Expand Down
Loading