mirrors/arti.git/.gitlab-ci.yml, branch arti-v1.2.6

CI: Only preserve rust-recent artifacts, don't process rust-latest ones

2024-07-31T15:42:02Z

The -latest jobs don't actually have artifacts. But: In the -latest jobs this can cause errors due to duplication: the artifacts from the -recent jobs in the same pipeline result in EEXIST errors.

CI: Use YAML anchors rather than .extends for rust-recent/rust-latest

2024-07-31T15:41:40Z

This will let us make the artifact processing only happen when we want to save artifacts.

CI: Add TODOs about rethinking matrix_test.

2024-07-30T18:16:15Z

Prompted by https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/2275#note_3054040

CI: Add cli-test job.

2024-07-30T14:49:48Z

CI: Rename "latest" jobs to "recent"; pin them; and replace them.

2024-07-29T11:42:11Z

We replace uses of `amd64/rust:bookworm` in the `recent-*` jobs. We add new latest-* jobs which * aren't used for artifacts * occur later in the pipeline * only run on main, since we don't want them to block MRs This is done with templates, to reuse the script parts.

CI: Use RECENT_RUST_IMAGE instead of unpinned Rust, in most jobs

2024-07-29T10:47:32Z

Replace almost all the open-coded occurrences of `amd64/rust:bookworm`. This rewinds us to Rust 1.79. We can update after https://github.com/rustsec/rustsec/issues/1217 is fixed upstream. We're going to handle the rust-latest-* jobs specially. There are still a few other images that look, from the name, like they might be uncontrolled inputs into our CI, but they don't look risky. Let's leave them for now.

CI: Introduce RECENT_RUST_IMAGE variable

2024-07-29T10:35:29Z

So far only used by the cargo-audit job.

Use a pinned compiler version to run cargo audit

2024-07-29T08:50:20Z

This avoids CI failures like this https://gitlab.torproject.org/nickm/arti/-/jobs/617654 arising from situations like this cargo-audit install fails with rust 1.80 https://github.com/rustsec/rustsec/issues/1217 error[E0282]: type annotations needed for Box<_> https://github.com/time-rs/time/issues/693 IMO we should pin many of the other images too but I suspect that may be controversial. I'm hoping that pinning this one to get CI working is uncontroversial (perhaps only on a temporary basis). The other way to solve this would be to remove --locked which IMO is going in the wrong direction, by exposing us to more rather than fewer uncontrolled inputs from our upstreams.

Run update-shell-includes, to forbid cwd-dependent script includes

2024-07-16T11:49:29Z

Switch to maint/common/forbid-script-extensions

2024-07-16T11:43:33Z