Enable ci disable cd - #1162
Merged
Merged
Conversation
…et-using CD Ports the CD half of runtimeverification/evm-semantics#2878. CD is removed rather than converted: version bumping, release cutting, Cachix publishing, the Docker Hub and ghcr.io image pushes, and the dependency-bump automation all read repository secrets. Release automation is reinstated in a follow-up PR, so until then dependency syncing and releases are manual. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…s via env Composite action inputs were interpolated straight into the shell script, which is a template-injection surface on self-hosted runners; they now arrive as env vars and every expansion is quoted. Drops the subdir/os/distro inputs and the BASE_DISTRO build arg, which nothing read, and the `type:` keys, which are not valid on composite action inputs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…rmissions Pins every action to a commit SHA with a version comment, sets a read-only workflow token (plus packages:read on the jobs that pull ghcr.io/foundry-rs/ foundry), and stops persisting credentials in the checkout. Docker teardown becomes `docker stop --timeout=0 ... || true` so a container that was never created cannot mask the step that actually failed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…en files as an artifact The job pushed the regenerated files straight to the branch, which required a push-capable PAT. Since it checks out and runs the dispatched branch's own composite action in the same job, anyone with write access could exfiltrate that PAT; it was also the last secret left in the repository. The files now go up via actions/upload-artifact with a 7-day retention, and the README documents the download-and-commit step. `if-no-files-found: error` guards against a silently empty upload, since every test step here ends in `|| true`. Drops the `github.ref != master` guard along with the push it protected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
….md: add workflow linting Runs actionlint and zizmor over .github/ on every PR, so the SHA pinning and permission scoping added in this branch stay enforced. The actionlint release is pinned by version and verified by checksum; actionlint.yaml declares the self-hosted runner labels it cannot discover on its own. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
tothtamas28
reviewed
Aug 12, 2026
tothtamas28
reviewed
Aug 12, 2026
Co-authored-by: Tamás Tóth <tothtamas28@users.noreply.github.com>
tothtamas28
approved these changes
Aug 12, 2026
…uter cachix-action failed on the self-hosted runner with "Cachix Auth token CACHIX_WEB_PRIVATE_TOKEN has been revoked": the cachix CLI validates whatever token is left in the runner's own config before registering a cache, so leftover state from the removed CD workflows broke a step that passes no token at all. k-framework is public, so the cache is declared directly in extra_nix_config and the CLI drops out of the path. Also drops cache.iog.io, which could never be used because its public key was not in trusted-public-keys, and switches cache.nixos.org to https. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-enables CI and removes every use of repository secrets.
Changes:
Delete the secret-using CD workflows:
master-push.yml,release.yml,update-version.yml,kontrol-push-fixed-deps.yml,kontrol-push-unfixed-deps.yml, and.github/scripts/check-cachix-pin.sh.update-expected-output.ymlpublishes the regenerated golden files as a 7-day artifact instead of pushing them with a PAT; the README documents the download-and-commit step.with-dockerpasses composite action inputs throughenv:instead of interpolating them into the shell script, drops the unusedsubdir/os/distroinputs and theBASE_DISTRObuild arg, and quotes every expansion.test-pr.yml: actions pinned to commit SHAs, workflow token scoped tocontents: read(pluspackages: readwhere the CI image is built),persist-credentials: false, and Docker teardown no longer masks the step that actually failed.The Nix job declares the public
k-frameworkcache as a substituter directly instead of going throughcachix-action, which validates whatever token is in the runner's own cachix config and so failed on revoked leftover state. Also dropscache.iog.io, unusable because its public key was never intrusted-public-keys.New
lint-workflows.ymlrunsactionlint(checksum-pinned) andzizmorover.github/on every PR;.github/actionlint.yamldeclares the self-hosted runner labels.actionlintexits with code 0, andzizmor --no-online-auditsreports no findings and no ignores across the whole branch.rg 'secrets\.' .github/returns nothing.Kept
cachix/install-nix-actionat v31.2.0 andcachix/cachix-actionat v16, SHA-pinned at their current versions rather than bumped, to avoid changing Nix-job behavior on the self-hosted runners in the same PR that re-enables CI. Neither uses an auth token.Follow-ups (not in this PR):