mirror of
https://github.com/HDFGroup/hdf5.git
synced 2026-09-25 04:09:44 +03:00
3131956eb0
* Harden workflow checkout credential hygiene + permissions Address zizmor static-analysis findings: - artipacked: add `persist-credentials: false` to actions/checkout steps in codeql.yml (2), test-binary-installation.yml (2), clang-format-check.yml, freebsd.yml, h5py.yml, openbsd.yml, signed-plugins.yml, and update-progress.yml. None of these jobs push to git, so dropping the persisted checkout credential is safe. - excessive-permissions: restrict call-workflows.yml top-level permissions to `contents: read`, and grant `packages: write` / `pull-requests: write` only on the two jobs that call the maven-staging reusable workflow (which declares those needs). No behavioral change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Removed extra blank lines. --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
102 lines
2.9 KiB
YAML
102 lines
2.9 KiB
YAML
name: OpenBSD CI
|
|
|
|
# Triggers the workflow on push or pull request or on demand
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
paths-ignore:
|
|
- '.github/CODEOWNERS'
|
|
- '.github/FUNDING.yml'
|
|
- 'docs/**'
|
|
- 'release_docs/**'
|
|
- 'ACKNOWLEDGEMENTS'
|
|
- 'LICENSE**'
|
|
- '**.md'
|
|
pull_request:
|
|
branches: [ develop ]
|
|
paths-ignore:
|
|
- '.github/CODEOWNERS'
|
|
- '.github/FUNDING.yml'
|
|
- 'docs/**'
|
|
- 'release_docs/**'
|
|
- 'ACKNOWLEDGEMENTS'
|
|
- 'LICENSE**'
|
|
- '**.md'
|
|
|
|
# Using concurrency to cancel any in-progress job or run
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
CTEST_OUTPUT_ON_FAILURE: 1
|
|
|
|
jobs:
|
|
openbsd-build-and-test:
|
|
runs-on: ubuntu-latest
|
|
name: OpenBSD ${{ matrix.openbsd-version }} Build and Test
|
|
|
|
# Don't run the action if the commit message says to skip CI
|
|
if: "!contains(github.event.head_commit.message, 'skip-ci')"
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
openbsd-version: ['7.9']
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Build and test on OpenBSD
|
|
uses: vmactions/openbsd-vm@c941015845c0f0c429676840963dc63b226d4f69
|
|
with:
|
|
release: ${{ matrix.openbsd-version }}
|
|
usesh: true
|
|
prepare: |
|
|
echo "https://ftp.openbsd.org/pub/OpenBSD" > /etc/installurl
|
|
pkg_add cmake pkgconf curl
|
|
run: |
|
|
set -e
|
|
|
|
# Get number of processors (OpenBSD uses sysctl in /sbin)
|
|
NPROC=$(/sbin/sysctl -n hw.ncpu)
|
|
echo "Number of processors: $NPROC"
|
|
|
|
# Configure the build
|
|
mkdir build
|
|
cd build
|
|
cmake -C ../config/cmake/cacheinit.cmake \
|
|
--log-level=VERBOSE \
|
|
-DCMAKE_BUILD_TYPE=Release \
|
|
-DBUILD_SHARED_LIBS:BOOL=ON \
|
|
-DHDF5_ENABLE_ALL_WARNINGS:BOOL=ON \
|
|
-DHDF5_ENABLE_PARALLEL:BOOL=OFF \
|
|
-DHDF5_BUILD_CPP_LIB:BOOL=OFF \
|
|
-DHDF5_BUILD_FORTRAN:BOOL=OFF \
|
|
-DHDF5_BUILD_JAVA:BOOL=OFF \
|
|
-DHDF5_BUILD_DOC:BOOL=OFF \
|
|
-DHDF5_BUILD_HL_LIB:BOOL=OFF \
|
|
-DHDF5_ENABLE_ZLIB_SUPPORT:BOOL=ON \
|
|
-DHDF5_ENABLE_SZIP_SUPPORT:BOOL=ON \
|
|
-DLIBAEC_USE_LOCALCONTENT:BOOL=OFF \
|
|
-DZLIB_USE_LOCALCONTENT:BOOL=OFF \
|
|
-DHDF5_TEST_API:BOOL=ON \
|
|
-DHDF5_TEST_SHELL_SCRIPTS:BOOL=OFF \
|
|
-DENABLE_EXTENDED_TESTS:BOOL=OFF \
|
|
..
|
|
echo ""
|
|
|
|
# Build
|
|
cmake --build . --parallel $NPROC
|
|
echo ""
|
|
|
|
# Run tests
|
|
ctest . --parallel $NPROC
|
|
echo ""
|