Commit 4b8f95941f

4b8f95941ffd757c0f5d4946605bbec16925ca9f

parent: 6456f24e96

Unsigned

cmc <hello@cleberg.net> · 2026-03-19 01:51 UTC

implement security scans in builds

Layout: unified · split

.build.yml +34 −3
@@ -1,14 +1,45 @@
11image: alpine/edge
22oauth: pages.sr.ht/PAGES:RW
3
34packages:
45 - hut
6 - git
7 - ca-certificates
8 - gitleaks
9 - swift
10
511sources:
612 - https://git.sr.ht/~ccleberg/Hutch
13
714environment:
815 site: hutch.cleberg.net
16
917tasks:
10 - package: |
18 - security-secrets: |
19 set -euo pipefail
20 cd Hutch
21 gitleaks git --redact --verbose .
22
23 - security-deps-lockfile: |
24 set -euo pipefail
25 cd Hutch
26 swift package resolve --only-use-versions-from-resolved-file
27
28 - test: |
29 set -euo pipefail
30 cd Hutch
31 swift test --parallel
32
33 - build: |
34 set -euo pipefail
35 cd Hutch
36 swift build -c release
37
38 - package-site: |
39 set -euo pipefail
1140 cd Hutch/website
1241 tar -cvz . > ../../site.tar.gz
13 - upload: |
14 hut pages publish -d $site site.tar.gz
42
43 - upload-site: |
44 set -euo pipefail
45 hut pages publish -d "$site" site.tar.gz