Pull requests and CI¶

Run the check on every pull request, so a pull request fails only when it adds a problem or makes one worse.

GitHub Actions¶

The action installs the release that matches its tag, so the uses line pins the version. Save this as .github/workflows/lumioguard-cc.yml:

name: lumioguard CC

on:
  pull_request:

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0            # the comparison needs the target branch

      - uses: lumioguard/[email protected]

On a pull request the action compares with the target branch. The summary appears in the job log, and the job fails when a blocking finding is new or worse.

The action's exit-code output holds 0, 1 or 2, so a later step can act on it.

Code scanning with SARIF¶

To see each finding on the pull request diff and in the repository's Security tab, write a SARIF file and upload it. The upload step needs security-events: write and if: always(), because the check step fails the job when a finding blocks:

permissions:
  contents: read
  security-events: write

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: lumioguard/[email protected]
        with:
          sarif-file: lumioguard-cc.sarif

      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: lumioguard-cc.sarif

Code scanning matches findings between runs by their IDs, so a pull request shows only the findings it adds. SARIF output lists what the file holds.

Without the action¶

Any workflow can install a release itself. Verify the download against SHA256SUMS, and pin the version so that an upgrade never changes results unnoticed:

      - name: Install lumioguard CC
        env:
          VERSION: 0.1.0
        run: |
          NAME="lumioguard-cc_${VERSION}_linux_amd64"
          BASE="https://github.com/lumioguard/lumioguard-cc/releases/download/v$VERSION"
          curl -fsSLO "$BASE/$NAME.tar.gz"
          curl -fsSLO "$BASE/SHA256SUMS"
          grep " $NAME.tar.gz\$" SHA256SUMS | sha256sum -c -
          tar -xzf "$NAME.tar.gz"
          echo "$PWD/$NAME" >> "$GITHUB_PATH"

      - name: Check what this pull request changed
        env:
          TARGET: ${{ github.base_ref }}
        run: lumioguard-cc check --base "origin/$TARGET"

Other CI systems¶

Any CI works the same way:

1. Fetch enough history to include the target branch. A shallow clone cannot find the merge base.
2. Install a pinned version and verify it against SHA256SUMS, as in Install.
3. Run lumioguard-cc check --base <target branch> and let the exit code decide the job. Add --format sarif if the CI system reads SARIF:

Choose what fails the build¶

Only rules with "block": true can fail a pull request. The defaults make size and complexity rules advisory, so start by making blocking the rules your team agrees on. See Configuration.