Commit ce9f6b7c8d
Unsigned
Layout: unified · split
builds/swift-ci.yml +62 −16
| @@ -1,35 +1,81 @@ | ||
| 1 | image: swift:5.10 | |
| 1 | image: ubuntu/lts | |
| 2 | 2 | |
| 3 | 3 | packages: |
| 4 | - git | |
| 5 | 4 | - ca-certificates |
| 5 | - curl | |
| 6 | - git | |
| 7 | - gnupg2 | |
| 8 | - libcurl4-openssl-dev | |
| 9 | - libncurses6 | |
| 10 | - libpython3-dev | |
| 11 | - libsqlite3-0 | |
| 12 | - libxml2-dev | |
| 13 | - libz3-dev | |
| 14 | - pkg-config | |
| 15 | - zlib1g-dev | |
| 6 | 16 | |
| 7 | 17 | sources: |
| 8 | 18 | - https://git.sr.ht/~ccleberg/Hutch |
| 9 | 19 | |
| 20 | environment: | |
| 21 | SWIFT_VERSION: 6.2.4 | |
| 22 | SWIFT_DIR: ubuntu2404 | |
| 23 | SWIFT_LABEL: ubuntu24.04 | |
| 24 | SWIFT_BASE: swift-6.2.4-RELEASE-ubuntu24.04 | |
| 25 | SWIFT_HOME: /home/build/.local/swift/swift-6.2.4-RELEASE-ubuntu24.04 | |
| 26 | ||
| 10 | 27 | tasks: |
| 28 | - install-swift: | | |
| 29 | set -euo pipefail | |
| 30 | cd /tmp | |
| 31 | ||
| 32 | SWIFT_URL="https://download.swift.org/swift-${SWIFT_VERSION}-release/${SWIFT_DIR}/swift-${SWIFT_VERSION}-RELEASE/${SWIFT_BASE}.tar.gz" | |
| 33 | SIG_URL="${SWIFT_URL}.sig" | |
| 34 | ||
| 35 | curl -fL -o swift.tar.gz "$SWIFT_URL" | |
| 36 | curl -fL -o swift.tar.gz.sig "$SIG_URL" | |
| 37 | ||
| 38 | # Import Swift 6.x release signing key | |
| 39 | gpg --batch --keyserver hkp://keyserver.ubuntu.com --recv-keys \ | |
| 40 | '52BB7E3DE28A71BE22EC05FFEF80A866B47A981F' | |
| 41 | ||
| 42 | gpg --verify swift.tar.gz.sig swift.tar.gz | |
| 43 | ||
| 44 | mkdir -p "$HOME/.local/swift" | |
| 45 | tar -xzf swift.tar.gz -C "$HOME/.local/swift" | |
| 46 | ||
| 47 | export PATH="${SWIFT_HOME}/usr/bin:$PATH" | |
| 48 | swift --version | |
| 49 | ||
| 11 | 50 | - security-secrets: | |
| 12 | 51 | set -euo pipefail |
| 13 | cd Hutch | |
| 52 | ||
| 14 | 53 | VERSION=8.24.2 |
| 15 | 54 | ARCHIVE="gitleaks_${VERSION}_linux_x64.tar.gz" |
| 16 | 55 | URL="https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/${ARCHIVE}" |
| 17 | curl -fsSLo /tmp/gitleaks.tar.gz "$URL" | |
| 18 | tar -xzf /tmp/gitleaks.tar.gz -C /tmp | |
| 19 | install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks | |
| 56 | ||
| 57 | mkdir -p "$HOME/.local/bin" | |
| 58 | ||
| 59 | cd /tmp | |
| 60 | curl -fL -o gitleaks.tar.gz "$URL" | |
| 61 | tar -xzf gitleaks.tar.gz | |
| 62 | install -m 0755 gitleaks "$HOME/.local/bin/gitleaks" | |
| 63 | ||
| 64 | export PATH="$HOME/.local/bin:$PATH" | |
| 65 | ||
| 66 | cd "$HOME/Hutch" | |
| 20 | 67 | gitleaks git --redact --verbose . |
| 21 | 68 | |
| 22 | - security-deps-lockfile: | | |
| 69 | - repo-structure-check: | | |
| 23 | 70 | set -euo pipefail |
| 24 | cd Hutch | |
| 25 | swift package resolve --only-use-versions-from-resolved-file | |
| 71 | cd "$HOME/Hutch" | |
| 26 | 72 | |
| 27 | - test: | | |
| 28 | set -euo pipefail | |
| 29 | cd Hutch | |
| 30 | swift test --parallel | |
| 73 | test -f "Hutch.xcodeproj/project.pbxproj" | |
| 74 | test -d "website" | |
| 75 | test -f "README.md" | |
| 31 | 76 | |
| 32 | - build: | | |
| 77 | - xcode-project-check: | | |
| 33 | 78 | set -euo pipefail |
| 34 | cd Hutch | |
| 35 | swift build -c release | |
| 79 | cd "$HOME/Hutch" | |
| 80 | ||
| 81 | grep -q "PBXProject" Hutch.xcodeproj/project.pbxproj | |