verify #306
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: verify | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| schedule: | |
| # Mondays 06:00 UTC — refreshes the cargo-deny advisory DB and surfaces | |
| # newly-disclosed RUSTSEC advisories on pinned dependencies between PRs. | |
| - cron: '0 6 * * 1' | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| jobs: | |
| gate: | |
| # Skip scheduled runs on forks — only the upstream repo's cron should fire. | |
| if: github.event_name != 'schedule' || github.repository == 'no42-org/onmsctl' | |
| # Shared with release.yml and docker.yml — see gates.yml. | |
| uses: ./.github/workflows/gates.yml | |
| notify-on-cron-failure: | |
| # Open a tracking issue when the scheduled run fails, so a freshly-disclosed | |
| # RUSTSEC advisory does not silently rot. Only fires for the cron event. | |
| needs: gate | |
| if: failure() && github.event_name == 'schedule' && github.repository == 'no42-org/onmsctl' | |
| runs-on: ubuntu-24.04 # was ubuntu-latest | |
| permissions: | |
| issues: write | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Open tracking issue | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| run: | | |
| set -euo pipefail | |
| gh issue create \ | |
| --repo "${GITHUB_REPOSITORY}" \ | |
| --title "Scheduled verify failed: $(date -u +%Y-%m-%d)" \ | |
| --body "$(printf 'Weekly cron run failed. Likely a freshly-disclosed advisory or a transient infrastructure issue.\n\nRun: %s\n' "${RUN_URL}")" \ | |
| --label ci \ | |
| --label scheduled-failure |