mirror of
https://github.com/kucherenko/jscpd.git
synced 2026-09-19 08:11:03 +08:00
apk
d790c6c1d3
Everything belonging to the v4 TypeScript engine moves to the master-v4 branch: apps/, packages/, build-utils/, changesets, pnpm workspace, turbo, the Node.js CI workflow and the ts-* release jobs. What remains is the Rust workspace under rust/, the npm wrapper and platform packages, the GitHub Action, Docker image, flake, skills, benchmark and fixtures/. - rust.yml gains a smoke job that runs the release binary against fixtures/ (json, sarif, html) and asserts clones and reporters - release.yml keeps only the Rust jobs; pnpm removed from every workflow; audit.yml keeps cargo audit + cargo deny; dependabot drops the root npm entry - root package.json becomes a thin private package depending on the exact jscpd@5 version so the pre-commit hook keeps installing the binary; sync-version.mjs keeps it in step - .pre-commit-hooks.yaml used v4-only flags that the v5 CLI rejects; fixed - FORMATS.md is now generated from the Rust tokenizer (224 formats) - README, docs, CONTRIBUTING, SECURITY, package and crate descriptions, benchmark and skills rewritten for v5 on its own terms: no v5-vs-v4 speed multipliers anywhere, a single "Looking for v4?" pointer to master-v4
55 lines
1.5 KiB
YAML
55 lines
1.5 KiB
YAML
name: Nightly audit
|
|
|
|
# Dependency vulnerability and policy checks for the Rust engine. Runs on a
|
|
# schedule so newly published advisories surface without a code change.
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 6 * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
cargo-audit:
|
|
name: cargo audit (Rust)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
permissions:
|
|
contents: read
|
|
issues: write # rustsec/audit-check files an issue per advisory on scheduled runs
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Rust toolchain
|
|
uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
|
|
with:
|
|
toolchain: stable
|
|
|
|
- name: cargo audit
|
|
uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
working-directory: rust
|
|
|
|
cargo-deny:
|
|
name: cargo deny (Rust)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: cargo deny check
|
|
uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
|
|
with:
|
|
manifest-path: rust/Cargo.toml
|
|
command: check
|
|
arguments: --all-features
|