Conversation
Fixes #23891 Signed-off-by: Keith Smiley <keithbsmiley@gmail.com>
|
trying to fix bazelbuild/continuous-integration#1502 |
|
@meteorcloudy can you test with this one? |
|
/retest |
|
Retrying Azure Pipelines: |
|
@keith https://buildkite.com/bazel/envoy/builds/2129#_ |
| - "wget https://apt.llvm.org/llvm.sh && sudo bash llvm.sh 10" | ||
| - "bazel/setup_clang.sh /usr/lib/llvm-10" | ||
| - "wget https://apt.llvm.org/llvm.sh && sudo bash llvm.sh 14" | ||
| - "bazel/setup_clang.sh /usr/lib/llvm-14" |
There was a problem hiding this comment.
im wondering if we need to comment all the places that the llvm version is set/used to say update these together
There was a problem hiding this comment.
IMO we should consider using https://github.com/grailbio/bazel-toolchain as well, so it's all done in bazel
There was a problem hiding this comment.
wow - i think that would resolve a load of issues
There was a problem hiding this comment.
That does look interesting. Not a great OSSF Scorecard score but maybe we could encourage them to improve
scorecard --repo=https://github.com/grailbio/bazel-toolchain
RESULTS
-------
Aggregate score: 4.7 / 10
Check scores:
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| SCORE | NAME | REASON | DOCUMENTATION/REMEDIATION |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 10 / 10 | Binary-Artifacts | no binaries found in the repo | https://github.com/ossf/scorecard/blob/main/docs/checks.md#binary-artifacts |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 0 / 10 | Branch-Protection | branch protection not enabled | https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection |
| | | on development/release | |
| | | branches | |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 4 / 10 | CI-Tests | 5 out of 11 merged PRs | https://github.com/ossf/scorecard/blob/main/docs/checks.md#ci-tests |
| | | checked by a CI test -- score | |
| | | normalized to 4 | |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 0 / 10 | CII-Best-Practices | no badge detected | https://github.com/ossf/scorecard/blob/main/docs/checks.md#cii-best-practices |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 3 / 10 | Code-Review | 11 out of last 30 changesets | https://github.com/ossf/scorecard/blob/main/docs/checks.md#code-review |
| | | reviewed before merge -- score | |
| | | normalized to 3 | |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 10 / 10 | Contributors | 3 different organizations | https://github.com/ossf/scorecard/blob/main/docs/checks.md#contributors |
| | | found -- score normalized to | |
| | | 10 | |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 10 / 10 | Dangerous-Workflow | no dangerous workflow patterns | https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow |
| | | detected | |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 0 / 10 | Dependency-Update-Tool | no update tool detected | https://github.com/ossf/scorecard/blob/main/docs/checks.md#dependency-update-tool |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 0 / 10 | Fuzzing | project is not fuzzed | https://github.com/ossf/scorecard/blob/main/docs/checks.md#fuzzing |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 10 / 10 | License | license file detected | https://github.com/ossf/scorecard/blob/main/docs/checks.md#license |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 8 / 10 | Maintained | 6 commit(s) out of 30 and 4 | https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained |
| | | issue activity out of 30 found | |
| | | in the last 90 days -- score | |
| | | normalized to 8 | |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| ? | Packaging | no published package detected | https://github.com/ossf/scorecard/blob/main/docs/checks.md#packaging |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 9 / 10 | Pinned-Dependencies | dependency not pinned by hash | https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies |
| | | detected -- score normalized | |
| | | to 9 | |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 0 / 10 | SAST | SAST tool is not run on all | https://github.com/ossf/scorecard/blob/main/docs/checks.md#sast |
| | | commits -- score normalized to | |
| | | 0 | |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 0 / 10 | Security-Policy | security policy file not | https://github.com/ossf/scorecard/blob/main/docs/checks.md#security-policy |
| | | detected | |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| ? | Signed-Releases | no releases found | https://github.com/ossf/scorecard/blob/main/docs/checks.md#signed-releases |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 0 / 10 | Token-Permissions | non read-only tokens detected | https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions |
| | | in GitHub workflows | |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
| 10 / 10 | Vulnerabilities | no vulnerabilities detected | https://github.com/ossf/scorecard/blob/main/docs/checks.md#vulnerabilities |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------|
…/docs/sphinx-5.3.0 * origin/main: (50 commits) ci: Bump mobile build images (#24317) ci: update llvm on bazel CI (#24296) ci: Fix flaky coverage limit (#24320) ci: Fix change detection (part 2) (#24264) Start slow start window on first successful HC, make slow start re-enterable (#23946) contrib-sipproxy: rework sipproxy stats (#24165) build(deps): bump github/codeql-action from 2.1.32 to 2.1.35 (#24292) build(deps): bump node from `c59fb39` to `80844b6` in /examples/ext_authz/auth/http-service (#24274) build(deps): bump actions/upload-artifact from 2 to 3 (#24121) build(deps): bump mysql from `96439dd` to `66efaaa` in /examples/mysql (#24273) build(deps): bump grpcio from 1.50.0 to 1.51.1 in /examples/grpc-bridge/client (#24272) Allow mobile/library/common/jni/ to be built on non-Android platforms. (#24299) generic proxy: added drain support to generic proxy to doing graceful closes on connections when possible (#24220) Reduce Route/VirtualHost memory utilization by avoiding RateLimitPolicy instances when not needed (#24243) Reduce VirtualHost memory utilization by avoiding CatchAllVirtualCluster when not needed (#24182) Fix mobile/tools/check_format.sh to re-apply #2698 (#24300) upstream: don't require `source_address` in `upstream_bind_config` (#24250) Quiche roll 20221201150327 (#24290) Cleanup threading/ownership semantics of PlatformBridgeCertValidator (#2713) Add unit tests of the PlatformBridgeCertValidator (#2704) ... Signed-off-by: JP Simard <jp@jpsim.com>
…/docs/pygments-2.13.0 * origin/main: (25 commits) ci: Bump mobile build images (#24317) ci: update llvm on bazel CI (#24296) ci: Fix flaky coverage limit (#24320) ci: Fix change detection (part 2) (#24264) Start slow start window on first successful HC, make slow start re-enterable (#23946) contrib-sipproxy: rework sipproxy stats (#24165) build(deps): bump github/codeql-action from 2.1.32 to 2.1.35 (#24292) build(deps): bump node from `c59fb39` to `80844b6` in /examples/ext_authz/auth/http-service (#24274) build(deps): bump actions/upload-artifact from 2 to 3 (#24121) build(deps): bump mysql from `96439dd` to `66efaaa` in /examples/mysql (#24273) build(deps): bump grpcio from 1.50.0 to 1.51.1 in /examples/grpc-bridge/client (#24272) Allow mobile/library/common/jni/ to be built on non-Android platforms. (#24299) generic proxy: added drain support to generic proxy to doing graceful closes on connections when possible (#24220) Reduce Route/VirtualHost memory utilization by avoiding RateLimitPolicy instances when not needed (#24243) Reduce VirtualHost memory utilization by avoiding CatchAllVirtualCluster when not needed (#24182) Fix mobile/tools/check_format.sh to re-apply #2698 (#24300) upstream: don't require `source_address` in `upstream_bind_config` (#24250) Quiche roll 20221201150327 (#24290) Cleanup threading/ownership semantics of PlatformBridgeCertValidator (#2713) Add unit tests of the PlatformBridgeCertValidator (#2704) ... Signed-off-by: JP Simard <jp@jpsim.com>
Fixes #23891
Signed-off-by: Keith Smiley keithbsmiley@gmail.com