Update construction.yml

ftmazzone · Nov 8, 2024 · 9bac5b8 · 9bac5b8
1 parent a42af4b
commit 9bac5b8
Showing 1 changed file with 66 additions and 14 deletions.
diff --git a/.github/workflows/construction.yml b/.github/workflows/construction.yml
@@ -7,40 +7,69 @@ on:
     branches: [ "master" ]
   schedule:
     - cron: '0 0 15 * *'
+
+permissions:
+  id-token: write
+  contents: read
+  attestations: write
+
 env:
   CARGO_HOME:  /tmp/cache/cargo
+  RUSTUP_HOME: /tmp/cache/.rustup
   BRANCHE_GIT: ${{ github.head_ref || github.ref_name }}
 jobs:
-  construire:
+  construire-amd64:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     # if: github.ref == 'refs/heads/master'
     steps:
       - uses: actions/checkout@v4
+      - name: Rechercher si le répertoire rustup est en mémoire temporaire
+        id: rustup
+        uses: actions/cache@v4
+        with:
+          path: ${{ env.RUSTUP_HOME }}
+          key: ${{ runner.os }}-rustup-amd64-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-rustup-amd64
       - name: Rechercher si le répertoire des dépendances est en mémoire temporaire
-        id: registry-cargo
+        id: cargo
         uses: actions/cache@v4
         with:
           path: ${{ env.CARGO_HOME }}
-          key: ${{ runner.os }}-${{ hashFiles('Cargo.lock') }}-registry-Cargo.lock
+          key: ${{ runner.os }}-cargo-amd64-${{ hashFiles('Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-registry-Cargo.lock
+            ${{ runner.os }}-cargo-amd64
       - name: Rechercher si le répertoire de construction est en mémoire temporaire
-        id: target-cargo
+        id: target
         uses: actions/cache@v4
         with:
           path: ./target
-          key: ${{ runner.os }}-${{ hashFiles('Cargo.lock') }}-target-Cargo.lock
+          key: ${{ runner.os }}-target-amd64-${{ hashFiles('Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-target-Cargo.lock
+            ${{ runner.os }}-target-amd64
+      - name: Installer rustup
+        if: steps.rustup.outputs.cache-hit != 'true'
+        run: |
+          wget -O - https://sh.rustup.rs | sh -s -- -y
       - name: Construire l'application
         run:  |
           rustup --version
           cargo --version
           cargo build --release --example lire_temperature
+      - script: |
+        cargo install cargo-audit --locked
+        cargo audit
+        displayName: Auditer les dépendances
+      - name: Attester l'origine des exécutables
+        if: ${{ github.ref == 'refs/heads/master' }} 
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: |
+            ./target/release/examples/lire_temperature
       - uses: actions/upload-artifact@v4
         with:
-          name: lire_temperature
+          name: lire_temperature_amd64
           path: ./target/release/examples/lire_temperature
           retention-days: 31
           if-no-files-found: error
@@ -69,27 +98,50 @@ jobs:
           git clone https://github.com/abhiTronix/raspberry-pi-cross-compilers.git
           tar -xf $COMPILATEUR_CROISE
           mv .cargo/config-compilation-croisee .cargo/config
+      - name: Rechercher si le répertoire rustup est en mémoire temporaire
+        id: rustup
+        uses: actions/cache@v4
+        with:
+          path: ${{ env.RUSTUP_HOME }}
+          key: ${{ runner.os }}-rustup-armv6-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-rustup-armv6
       - name: Rechercher si le répertoire des dépendances est en mémoire temporaire
-        id: registry-cargo
+        id: cargo
         uses: actions/cache@v4
         with:
           path: ${{ env.CARGO_HOME }}
-          key: ${{ runner.os }}-${{ env.COMPILATEUR_CROISE }}-${{ hashFiles('Cargo.lock') }}-registry-Cargo.lock
+          key: ${{ runner.os }}-cargo-armv6-${{ hashFiles('Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-${{ env.COMPILATEUR_CROISE }}-registry-Cargo.lock
+            ${{ runner.os }}-cargo-armv6
       - name: Rechercher si le répertoire de construction est en mémoire temporaire
-        id: target-cargo
+        id: target
         uses: actions/cache@v4
         with:
           path: ./target
-          key: ${{ runner.os }}-${{ env.COMPILATEUR_CROISE }}-${{ hashFiles('Cargo.lock') }}-target-Cargo.lock
+          key: ${{ runner.os }}-target-armv6-${{ hashFiles('Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-${{ env.COMPILATEUR_CROISE }}-target-Cargo.lock
+            ${{ runner.os }}-target-armv6
+      - name: Installer rustup
+        if: steps.rustup.outputs.cache-hit != 'true'
+        run: |
+          wget -O - https://sh.rustup.rs | sh -s -- -y
+          rustup target add arm-unknown-linux-gnueabihf
       - name: Construire l'application
         run:  |
           rustup --version
           cargo --version
           cargo build --release --target arm-unknown-linux-gnueabihf --example lire_temperature
+      - script: |
+          cargo install cargo-audit --locked
+          cargo audit
+          displayName: Auditer les dépendances
+      - name: Attester l'origine des exécutables
+        if: ${{ github.ref == 'refs/heads/master' }} 
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: |
+            ./target/arm-unknown-linux-gnueabihf/release/examples/lire_temperature
       - uses: actions/upload-artifact@v4
         with:
           name: lire_temperature_armv6