77b6ff700b
Bump actions/checkout from 6.0.0 to 7.0.0 ( #4835 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-01 09:07:12 -07:00
5ea06b13fe
Exclude the build tree from the source package
...
The .gitignore-derived `build/` pattern does not actually prune the build
directory or its contents from the CPack source package, so an empty build/
(and, once docs were built in CI, build/doc-html) leaked into the zip. Ignore
the whole build tree in CPACK_SOURCE_IGNORE_FILES.
2026-06-16 07:04:03 +02:00
11ddbcb789
Build docs in the release workflow so the source zip includes doc-html
...
The source-zip build moved to CI, which configured out-of-source and never
ran the doc target, so the pre-rendered HTML docs (doc-html/) silently
dropped out of the package. Install the doc toolchain, build the docs, and
stage them into the source tree before package_source so CPack picks them up.
2026-06-12 17:01:05 +02:00
e60274b29c
Run lint workflow on all PRs to fix stuck required checks
...
The lint workflow was path-filtered to source files, so PRs that didn't
touch them never ran clang-format/cmake-format. Since those checks are
required, such PRs were blocked forever waiting for a status that never
came. Drop the paths filter so the workflow always reports a status.
2026-06-09 15:56:50 +02:00
87bb05d3b2
Fix release workflow startup failure from insufficient permissions
...
The provenance job called the SLSA generator with contents: read, but the
generator's upload-assets job declares contents: write. A reusable
workflow's job permissions may not exceed the caller's, so GitHub failed
the run at startup. Grant contents: write; the upload-assets job is still
skipped at runtime since upload-assets is false.
2026-06-09 15:48:28 +02:00
1ccba0cf80
Attach SLSA provenance to the draft instead of a new release
...
With upload-assets the SLSA generator created and published its own
release (and tag) to host the attestation, duplicating the draft. Disable
upload-assets and add a job that downloads the provenance artifact and
attaches it to the draft alongside the source zip.
2026-06-09 06:23:34 +02:00
841040e781
Attach release artifacts to draft via workflow_dispatch
...
Draft releases do not fire the `release: created` event, so the release
workflow never ran and the source zip and SLSA provenance were not
attached to the draft. Trigger the workflow explicitly from release.py
via workflow_dispatch, passing the tag to attach to and the ref to build
from, and resolve the tag/ref in the workflow for both event types.
2026-06-08 07:48:52 +02:00
57563a7ebd
Bump github/codeql-action from 4.35.1 to 4.36.1 ( #4793 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.35.1 to 4.36.1.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...87557b9c84dde89fdd9b10e88954ac2f4248e463 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.36.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-02 15:15:23 -07:00
a597d06854
Bump slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml ( #4792 )
...
Bumps [slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml](https://github.com/slsa-framework/slsa-github-generator ) from 2.0.0 to 2.1.0.
- [Release notes](https://github.com/slsa-framework/slsa-github-generator/releases )
- [Changelog](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md )
- [Commits](https://github.com/slsa-framework/slsa-github-generator/compare/v2.0.0...v2.1.0 )
---
updated-dependencies:
- dependency-name: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml
dependency-version: 2.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-02 15:14:38 -07:00
b6248c5bc0
Fix doc deploy condition for main branch
2026-06-01 15:22:36 -07:00
6b2d7f9726
Rename CIFuzz workflow to fuzz
...
Match the naming convention used by the other workflows: lowercase,
single-word names that describe what the workflow does rather than the
tool it uses. Also rename the job from Fuzzing to fuzz for consistency.
2026-06-01 12:03:52 -07:00
2538c89e71
Scope CodeQL write permissions to the analyze job
2026-06-01 10:53:29 -07:00
b18919cb38
Clean up supply-chain workflow
2026-06-01 10:22:33 -07:00
3046d2ca7e
Add CodeQL workflow
2026-06-01 09:31:01 -07:00
95390170a9
Rename scorecard workflow to supply-chain
2026-06-01 08:54:54 -07:00
1c98a69c66
Move security policy from README to .github/SECURITY.md
2026-06-01 06:51:41 -07:00
ed5d7ec5a3
Add CODEOWNERS
2026-05-31 21:45:33 -07:00
1f0533a923
Pin clang-20 install
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-05-31 21:23:21 -07:00
e48f8a9070
Pin clang-format install
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-05-31 20:56:33 -07:00
6a1d56c425
Pin doc deps
2026-05-31 20:14:10 -07:00
49780cabbe
Pin deps
2026-05-31 19:10:01 -07:00
a9e889e161
Build release artifacts and SLSA provenance in CI
...
Adds .github/workflows/release.yml, triggered on `release: created`, which:
- checks out the release's target_commitish,
- builds the source zip via CMake/CPack (`package_source`),
- uploads the zip to the draft release,
- calls slsa-framework/slsa-github-generator to produce a
SLSA v1.0 *.intoto.jsonl provenance file and attach it to the
same draft release.
After CI completes, the draft has both the zip and the provenance attached,
and the maintainer reviews and publishes as before.
Updates support/release.py to stop building and uploading the zip locally;
that work has moved to CI so the SLSA provenance attests to the actual
build environment that produced the artifact, not to a hash observed
after the fact. The script still builds docs locally because the
subsequent mkdocs deploy step depends on them.
2026-05-31 18:16:07 -07:00
d079860923
Remove a temporary workflow
2026-05-31 18:15:24 -07:00
da081318af
Add workflow_dispatch trigger to scorecard.yml
2026-05-31 15:01:24 -07:00
2a24d1ae2e
Add a temporary workflow to backfill SLSA provenance for existing releases
2026-05-31 09:16:32 -07:00
7aabdcf0ba
Workaround apt-add-repository timeouts
2026-05-03 07:25:47 -07:00
382609a920
Cleanup module test and CI config
2026-04-14 12:30:21 -07:00
8783c3c2d4
enable fmt_module tests by updating module-test.cc ( #4702 )
...
- Update g++ module testing to use g++ version 15 instead of 14.
The module support in version 14 isn't very stable and the module
testing was not working due to unresolved locale symbols.
- Update CI for linux and macos to add verbosity so its consistent with
windows.
- Refactor test/CMakeLists.txt to enable testing for modules
- The tests in `module-test.cc` seem to not have been updated in some
time despite changes in the main library.
- Wide String versions of several tests appear to be deprecated so have
been removed.
- Refactored tests related to `fmt::format_args` that now requires lvalue
references as opposed to direct values.
- Remove the none-working code identified in the `module-test.cc` file
while updating.
2026-04-12 10:07:16 -07:00
907f002f8e
Cleanup CI
2026-04-02 16:30:52 -07:00
579587bee3
Bump github/codeql-action from 4.32.0 to 4.35.1 ( #4727 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.32.0 to 4.35.1.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/b20883b0cd1f46c72ae0ba6d1090936928f9fa30...c10b8064de6f491fea524254123dbe5e09572f13 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 15:20:10 -07:00
8572a24603
Cleanup CI config
2026-04-02 15:04:00 -07:00
cdb8dc76d9
Add C++-Modules Based Linux CI workflow ( #4708 )
...
- This adds a set of CI tests for linux that include compilers that
support modules
- This CI workflow uses ninja as the build system generator
- Can be integrated with the other linux workflow after successful
testing
Co-authored-by: Mathew Benson <mathew@benson.co.ke >
2026-03-28 09:45:56 -07:00
dc05bee307
Don't assume nul termination in printf
...
Thanks ZUENS2020 for reporting.
2026-03-23 13:28:26 -07:00
7733f4c136
Add cmake-format job
2026-03-14 13:51:29 -07:00
04434416a4
Remove unnecessary CI change
2026-03-03 12:35:39 -08:00
fca0445565
Bump actions/upload-artifact from 6.0.0 to 7.0.0 ( #4691 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-01 13:06:20 -08:00
88c5a91487
Fix CI ( #4690 )
2026-02-28 08:37:13 -08:00
afd51d1041
Bump github/codeql-action from 4.31.2 to 4.32.0 ( #4664 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.2 to 4.32.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/0499de31b99561a6d14a36a5f662c2a54f91beee...b20883b0cd1f46c72ae0ba6d1090936928f9fa30 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.32.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-01 08:21:38 -08:00
bf3babfd7c
Bump actions/upload-artifact from 5.0.0 to 6.0.0 ( #4642 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/330a01c490aca151604b8cf639adc76d48f6c5d4...b7c566a772e6b6bfb58ed0dc250532a479d7789f )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-01 13:10:42 -08:00
95ba44311c
Add funding configuration for GitHub
2025-12-31 09:21:49 -08:00
7bce22571a
Make it work on newer mkdocstrings, fix deprecation warnings ( #4626 )
...
* Make it work on newer mkdocstrings, fix deprecation warnings
* Bump documentation dependency versions
2025-12-14 08:36:41 -08:00
d6712ff2c0
Bump actions/checkout from 5.0.0 to 6.0.0 ( #4621 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/08c6903cd8c0fde910a37f88322edcfb5dd907a8...1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-01 09:04:20 -08:00
5bc56e24a9
Update clang-format to version 21
2025-11-28 20:05:18 -08:00
62f57b2496
Fix the macOS build
2025-11-04 09:12:57 -10:00
a195dd6b37
Bump github/codeql-action from 3.30.5 to 4.31.2 ( #4599 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.30.5 to 4.31.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/3599b3baa15b485a2e49ef411a7a4bb2452e7f93...0499de31b99561a6d14a36a5f662c2a54f91beee )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-03 08:53:27 -08:00
b6cd356196
Bump actions/upload-artifact from 4.6.0 to 5.0.0 ( #4598 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.6.0 to 5.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08...330a01c490aca151604b8cf639adc76d48f6c5d4 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-01 09:39:15 -07:00
d13e5d048d
Bump github/codeql-action from 3.29.7 to 3.30.5 ( #4558 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.7 to 3.30.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/51f77329afa6477de8c49fc9c7046c15b9a4e79d...3599b3baa15b485a2e49ef411a7a4bb2452e7f93 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.30.5
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-02 06:08:07 -07:00
f17b9aa44c
Bump actions/checkout from 4.2.0 to 5.0.0 ( #4523 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.2.0 to 5.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/d632683dd7b4114ad314bca15554477dd762a938...08c6903cd8c0fde910a37f88322edcfb5dd907a8 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-02 09:04:42 -07:00
814f51eab6
Bump github/codeql-action from 3.28.16 to 3.29.5 ( #4510 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.16 to 3.29.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/28deaeda66b76a05916b6923827895f2b14ab387...51f77329afa6477de8c49fc9c7046c15b9a4e79d )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.5
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-01 11:52:42 -07:00
fc8d07cfe5
Bump msys2/setup-msys2 from 2.27.0 to 2.28.0 ( #4485 )
...
Bumps [msys2/setup-msys2](https://github.com/msys2/setup-msys2 ) from 2.27.0 to 2.28.0.
- [Release notes](https://github.com/msys2/setup-msys2/releases )
- [Changelog](https://github.com/msys2/setup-msys2/blob/main/CHANGELOG.md )
- [Commits](https://github.com/msys2/setup-msys2/compare/61f9e5e925871ba6c9e3e8da24ede83ea27fa91f...40677d36a502eb2cf0fb808cc9dec31bf6152638 )
---
updated-dependencies:
- dependency-name: msys2/setup-msys2
dependency-version: 2.28.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-01 08:42:01 -07:00
dependabot[bot]
Victor Zverovich
Mathew Benson
Mathew Benson
Zephyr Lykos
Victor Zverovich