chore(security): suppress dev-only im/lru osv advisories #121
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2026 ResQ Software | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # | |
| # Thin CI wrapper. Dispatches to the org-wide reusable rust-ci workflow | |
| # in resq-software/.github; the top-level `required` job aggregates the | |
| # result into a single status-check context consumed by the org ruleset | |
| # `default-branch-baseline`. | |
| # | |
| # Security scanning runs separately in security.yml. | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| rust: | |
| uses: resq-software/.github/.github/workflows/rust-ci.yml@40fa987f5bc78d7569b9b76274f24d032ac0d7c8 | |
| with: | |
| toolchain: stable | |
| run-fmt: true | |
| run-clippy: true | |
| run-test: true | |
| run-deny: false | |
| run-coverage: false | |
| required: | |
| name: required | |
| runs-on: ubuntu-latest | |
| needs: [rust] | |
| if: always() | |
| steps: | |
| - name: Aggregate | |
| env: | |
| RUST_RESULT: ${{ needs.rust.result }} | |
| run: | | |
| set -eu | |
| case "$RUST_RESULT" in | |
| success|skipped|"") echo "ok: rust=$RUST_RESULT" ;; | |
| *) echo "::error::rust reusable returned: $RUST_RESULT"; exit 1 ;; | |
| esac | |
| # Publish a GitHub Release per v* tag so resq-software/landing's changelog | |
| # aggregator picks the version up — the aggregator ingests GitHub *Releases*, | |
| # not git tags. Runs only on a tag push, after the `required` gate passes. | |
| release: | |
| name: GitHub Release | |
| needs: [required] | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # create the release | |
| steps: | |
| - name: Create GitHub Release from the tag | |
| # `gh` reads $GH_TOKEN and $GITHUB_REPOSITORY automatically; the tag is | |
| # passed via env (never `${{ }}` inside run:) to avoid zizmor template | |
| # injection. --generate-notes builds notes from merged PRs since the | |
| # previous tag; --verify-tag asserts the ref is a real tag first. | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TAG: ${{ github.ref_name }} | |
| run: > | |
| gh release create "$TAG" | |
| --title "$TAG" | |
| --generate-notes | |
| --verify-tag |