TirSystem/github-action
0
1
Fork 0
Code Issues 5 Pull Requests 1 Actions Packages Projects Releases 3 Wiki Activity

Review and accept ADR-0008

Browse Source
This commit is contained in:
Tirsvad
2026-10-11 12:43:40 +08:00
parent ac6925e21a
commit 9e7aeddb11
4 changed files with 71 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/adr/adr-0008-cpp-csharp-quality-check-contract.md
+12 -5
View File
@@ -9,7 +9,8 @@
## Version History
| Date | Status | Author | Reviewer | Change | Commit |
| --- | --- | --- | --- | --- | --- |
| 2026-10-11 | Proposed | Jens Tirsvad Nielsen | S01 | Initial version | [11cba35] |
| 2026-10-11 | Deprecated | Jens Tirsvad Nielsen | S01 | Initial version | [11cba35] |
| 2026-10-11 | Accepted | Jens Tirsvad Nielsen | S01 | Reviewed (RC-054): abbreviations expanded at first use and the security impact of downloading tools named | pending |
Allowed Status values: `Proposed`, `Accepted`, `Rejected`, `Deprecated`, `Superseded by ADR-NNNN`.
@@ -30,12 +31,12 @@ on 2026-10-11 and bound the decision:
Facts (MIL-007 task 2, runs 692 and 699 on `ubuntu-latest`, Ubuntu 24.04,
root, `gcc`/`g++` 13.3 present):
- `clang-format` 23.1.3 and `clang-tidy` 22.1.8 install from PyPI in a few
seconds with an exact version.
- `clang-format` 23.1.3 and `clang-tidy` 22.1.8 install from the Python Package
Index (PyPI) in a few seconds with an exact version.
- `cppcheck` is only available as an old version (apt 2.13.0; the latest
release is 2.22.0; the PyPI package of that name is another project).
- The .NET SDK 10.0.401 installs with the official `dotnet-install.sh` in about
20 s with an exact `--version`; apt gives an older band (10.0.112).
- The .NET software development kit (SDK) 10.0.401 installs with the official
`dotnet-install.sh` in about 20 s with an exact `--version`; apt gives an older band (10.0.112).
- A `clang-tidy` run needs flags or a compile database, and a C# format check
and build need the project's package restore, which needs the network.
@@ -118,6 +119,12 @@ The rules that follow from it:
change and costs a major version (ADR-0006).
- A caller pinned to an exact tag is pinned completely only when `tools-ref`
names the same tag (as for `quality-checks.yml`).
- Security: each run downloads and executes code from outside the repository
(wheels from PyPI and the `dotnet-install.sh` script from `dot.net`, and for
C# the NuGet packages of the project). Exact versions limit what can change
but are not verified against a hash, so a compromised package index or
download host would reach the run. The jobs get `contents: read` and no
secret, which limits what such code can do.
## Affected Artifacts