Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 50 additions & 24 deletions .github/workflows/ext.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@ jobs:
- uses: actions/setup-python@v5
with:
python-version: "3.9"
- uses: extractions/setup-just@v4
with:
just-version: "1.54.0"
Comment on lines +23 to +25

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Consider pinning extractions/setup-just to a commit SHA.

zizmor flags each of these extractions/setup-just@v4 uses as unpinned. This mirrors the repo's existing convention of pinning third-party actions by tag rather than SHA (e.g. actions/checkout@v4, dtolnay/rust-toolchain@v1), so it's not a regression introduced by this PR, but since these are new lines, tightening them to a hash would incrementally improve supply-chain hardening.

Also applies to: 71-73, 104-106, 155-158, 214-217, 279-281, 355-357, 413-415

🧰 Tools
🪛 zizmor (1.26.1)

[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ext.yaml around lines 23 - 25, The new
extactions/setup-just@v4 workflow steps are still referenced by moving tag
rather than a fixed SHA, so tighten them for supply-chain hardening. Update each
setup-just usage in the workflow to pin the action to a commit hash instead of
the v4 tag, keeping the existing just-version inputs unchanged. Make the change
consistently across all repeated setup-just steps in the workflow so the pinning
is uniform.

Source: Linters/SAST tools


- name: Install rustup
id: rustup
Expand All @@ -40,16 +43,16 @@ jobs:
run: pip install pytest

- name: Run ext tests
run: make -C ext test
run: cd ext && just test

- name: Run ext examples
run: make -C ext benchmarks
run: cd ext && just benchmarks

- name: Run ext examples (nassau)
run: make -C ext benchmarks-nassau
run: cd ext && just benchmarks-nassau

- name: Run ext examples (concurrent)
run: make -C ext benchmarks-concurrent
run: cd ext && just benchmarks-concurrent

- name: Benchmark executable size
run: |
Expand All @@ -65,6 +68,9 @@ jobs:

steps:
- uses: actions/checkout@v4
- uses: extractions/setup-just@v4
with:
just-version: "1.54.0"

- name: Install rustup
id: rustup
Expand All @@ -83,7 +89,7 @@ jobs:
key: miri-${{ steps.rustup.outputs.rustc_hash }}-${{ hashFiles('**/Cargo.*') }}

- name: Run miri
run: make -C ext miri
run: cd ext && just miri

lint:
if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository }}
Expand All @@ -95,6 +101,9 @@ jobs:

steps:
- uses: actions/checkout@v4
- uses: extractions/setup-just@v4
with:
just-version: "1.54.0"

- name: Install rustup
id: rustup
Expand All @@ -116,13 +125,13 @@ jobs:
key: lint-${{ steps.rustup.outputs.rustc_hash }}-${{ hashFiles('**/Cargo.*') }}

- name: Run lint
run: make -C ext lint
run: cd ext && just lint

- name: Lint sseq_gui
run: make -C web_ext/sseq_gui lint
run: cd web_ext/sseq_gui && just lint

- name: Lint sseq_gui tests
run: make -C web_ext/sseq_gui lint-selenium
run: cd web_ext/sseq_gui && just lint-selenium

# Build the wasm webserver with the default `panic=abort` configuration on
# stable/beta. This is the compatibility build; the deployed artifact is
Expand All @@ -143,6 +152,10 @@ jobs:
steps:
- uses: actions/checkout@v4

- uses: extractions/setup-just@v4
with:
just-version: "1.54.0"

- name: Install rustup
uses: dtolnay/rust-toolchain@v1
id: rustup
Expand All @@ -164,16 +177,16 @@ jobs:
run: sudo apt-get install binaryen

- name: Setup build environment
run: make -C web_ext/sseq_gui setup-wasm
run: cd web_ext/sseq_gui && just setup-wasm

- name: Lint sseq_gui wasm
run: make -C web_ext/sseq_gui lint-wasm
run: cd web_ext/sseq_gui && just lint-wasm

- name: Test worker panic handling
run: make -C web_ext/sseq_gui test-wasm-js
run: cd web_ext/sseq_gui && just test-wasm-js

- name: Build wasm
run: make -C web_ext/sseq_gui wasm
run: cd web_ext/sseq_gui && just wasm

- name: Benchmark wasm size
run: ls -l web_ext/sseq_gui/dist/sseq_gui_wasm_bg.wasm
Expand All @@ -198,6 +211,10 @@ jobs:
steps:
- uses: actions/checkout@v4

- uses: extractions/setup-just@v4
with:
just-version: "1.54.0"

- name: Install rustup
uses: dtolnay/rust-toolchain@v1
id: rustup
Expand All @@ -220,13 +237,13 @@ jobs:
run: sudo apt-get install -y binaryen wabt

- name: Setup build environment
run: make -C web_ext/sseq_gui setup-wasm
run: cd web_ext/sseq_gui && just setup-wasm

- name: Build wasm (panic=unwind)
run: make -C web_ext/sseq_gui wasm WASM_UNWIND=1
run: cd web_ext/sseq_gui && just WASM_UNWIND=1 wasm

- name: Verify wasm unwinding
run: make -C web_ext/sseq_gui test-wasm-unwind
run: cd web_ext/sseq_gui && just test-wasm-unwind

- name: Benchmark wasm size
run: ls -l web_ext/sseq_gui/dist/sseq_gui_wasm_bg.wasm
Expand Down Expand Up @@ -259,6 +276,9 @@ jobs:
continue-on-error: ${{ matrix.toolchain != 'stable' }}
steps:
- uses: actions/checkout@v4
- uses: extractions/setup-just@v4
with:
just-version: "1.54.0"

- name: Download webserver
uses: actions/download-artifact@v4
Expand Down Expand Up @@ -295,20 +315,20 @@ jobs:

- name: Test wasm
run: |
make serve-wasm &
(sleep 1 && xvfb-run -a -s "-screen 0 1280x720x24" make selenium)
just serve-wasm &
(sleep 1 && xvfb-run -a -s "-screen 0 1280x720x24" just selenium)

- name: Test local
run: |
cargo build &&
(target/debug/sseq_gui &
(sleep 1 && xvfb-run -a -s "-screen 0 1280x720x24" make selenium))
(sleep 1 && xvfb-run -a -s "-screen 0 1280x720x24" just selenium))

- name: Test local concurrent
run: |
cargo build --features concurrent &&
(target/debug/sseq_gui &
(sleep 1 && xvfb-run -a -s "-screen 0 1280x720x24" make selenium))
(sleep 1 && xvfb-run -a -s "-screen 0 1280x720x24" just selenium))

- name: Upload Artifact
if: ${{ failure() }}
Expand All @@ -332,6 +352,9 @@ jobs:
continue-on-error: ${{ matrix.toolchain != 'stable' }}
steps:
- uses: actions/checkout@v4
- uses: extractions/setup-just@v4
with:
just-version: "1.54.0"

- name: Install rustup
id: rustup
Expand All @@ -354,13 +377,13 @@ jobs:
run: sudo apt-get install binaryen

- name: Setup build environment
run: make -C web_ext/steenrod_calculator setup-wasm
run: cd web_ext/steenrod_calculator && just setup-wasm

- name: Lint sseq_gui wasm
run: make -C web_ext/steenrod_calculator lint
- name: Lint calculator wasm
run: cd web_ext/steenrod_calculator && just lint

- name: Build wasm
run: make -C web_ext/steenrod_calculator
run: cd web_ext/steenrod_calculator && just all
Comment thread
coderabbitai[bot] marked this conversation as resolved.

- name: Benchmark wasm size
run: ls -l web_ext/steenrod_calculator/dist/steenrod_calculator_wasm_bg.wasm
Expand All @@ -387,6 +410,9 @@ jobs:
continue-on-error: ${{ matrix.toolchain != 'stable' }}
steps:
- uses: actions/checkout@v4
- uses: extractions/setup-just@v4
with:
just-version: "1.54.0"

- name: Install rustup
id: rustup
Expand All @@ -405,7 +431,7 @@ jobs:
key: docs-${{ steps.rustup.outputs.rustc_hash }}-${{ hashFiles('ext/Cargo.*') }}

- name: Generate docs
run: make -C ext docs
run: cd ext && just docs

- name: Upload docs
uses: actions/upload-artifact@v4
Expand Down
81 changes: 0 additions & 81 deletions ext/Makefile

This file was deleted.

25 changes: 15 additions & 10 deletions ext/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ Documentation for both the examples and the library itself is hosted at
If documentation for a specific version of the library is sought, it can be generated by running

```shell
make docs
just docs
```

after which the documentation is placed at `target/doc/`. The link above opens
Expand All @@ -94,10 +94,15 @@ the file `target/doc/ext/index.html`.
Lint scripts can be run with

```shell
make lint
just lint
```

This runs `clippy` and `rustfmt`.
This runs `clippy` and `rustfmt`. To apply the formatting and clippy autofixes
instead of just checking, run

```shell
just fix
```

### Tests

Expand All @@ -108,7 +113,7 @@ There are multiple types of tests
These can be run by

```shell
make test
just test
```

#### Example benchmarks
Expand All @@ -121,14 +126,14 @@ the output should be.
These can be run by

```shell
make benchmarks
make benchmarks-concurrent
just benchmarks
just benchmarks-concurrent
```

Running

```shell
make fix-benchmarks
just bless-benchmarks
```

updates the outputs in all benchmark files to match the current program output.
Expand All @@ -137,7 +142,7 @@ This is useful for adding new benchmarks.
These can be run for individual benchmarks by e.g.

```shell
make examples/benchmarks/resolve-S_2
make examples/benchmarks/resolve-S_2-concurrent
make examples/benchmarks/resolve-S_2-fixed
just bench resolve-S_2
just bench-concurrent resolve-S_2
just bless-bench resolve-S_2
```
12 changes: 6 additions & 6 deletions ext/flake.nix
Original file line number Diff line number Diff line change
Expand Up @@ -44,12 +44,12 @@
export RUSTFLAGS="-D warnings"
export RUSTDOCFLAGS="-D warnings"

make lint
make test
make benchmarks
make benchmarks-nassau
make benchmarks-concurrent
make miri
just lint
just test
just benchmarks
just benchmarks-nassau
just benchmarks-concurrent
just miri
'');
};
});
Expand Down
Loading
Loading