From b0ba8268a32695ce3ebf59d150bb8450bfd07e3f Mon Sep 17 00:00:00 2001 From: lmdexpr Date: Thu, 1 Oct 2026 17:37:12 +0900 Subject: [PATCH 1/3] ci: add CI and OSV scan, locked with gh actions-lock Build and run the test suite on Linux and macOS using dune package management, pinned to dune 3.24.0, and check formatting with the ocamlformat dev tool. Scan dune.lock with lmdexpr/dune-lock-osv on lock changes and daily (scheduled runs open/update an issue when vulnerabilities are found). Workflow dependencies, including transitive ones from composite actions, are locked with gh actions-lock. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/actions.lock | 47 ++++++++++++++++++++++++++++++++++ .github/workflows/ci.yml | 44 +++++++++++++++++++++++++++++++ .github/workflows/osv.yml | 31 ++++++++++++++++++++++ 3 files changed, 122 insertions(+) create mode 100644 .github/workflows/actions.lock create mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/osv.yml diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..e669197 --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,47 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/ci.yml': + - 'actions/checkout@v7.0.1' + - 'ocaml-dune/setup-dune@v2.1.0' + '.github/workflows/osv.yml': + - 'actions/checkout@v7.0.1' + - 'lmdexpr/dune-lock-osv@main' +dependencies: + 'actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7': + ref: 'v5.0.2' + commit: 'sha1-8b402f58fbc84540c8b491a91e594a4576fec3d7' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3': + ref: 'v9.0.0' + commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3' + owner_id: 44036562 + repo_id: 205262760 + 'actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f': + ref: 'v6.0.0' + commit: 'sha1-b7c566a772e6b6bfb58ed0dc250532a479d7789f' + owner_id: 44036562 + repo_id: 192625955 + 'lmdexpr/dune-lock-osv@main': + ref: 'main' + commit: 'sha1-7f1568fa0114081c2e949c4b07e1c01386adeea5' + owner_id: 4951592 + repo_id: 1399418780 + uses: + - 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3' + 'ocaml-dune/setup-dune@v2.1.0': + ref: 'v2.1.0' + commit: 'sha1-2201fa80f49561672943e7960e5f918c887ab0dc' + owner_id: 62877882 + repo_id: 955896475 + uses: + - 'actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7' + - 'actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f' diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..041261f --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,44 @@ +# This workflow is managed by gh actions-lock. + +name: CI + +on: + push: + branches: [ main ] + pull_request: + workflow_dispatch: + +permissions: + contents: read + +jobs: + test: + strategy: + fail-fast: false + matrix: + # dune.lock is solved for linux and macos only + runs-on: [ ubuntu-latest, macos-latest ] + runs-on: ${{ matrix.runs-on }} + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - uses: ocaml-dune/setup-dune@v2.1.0 + with: + # Keep in sync with the local dune; nightly would make dune.lock churn + version: 3.24.0 + + fmt: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - uses: ocaml-dune/setup-dune@v2.1.0 + with: + version: 3.24.0 + steps: install-dune enable-pkg + - run: dune tools install ocamlformat + - run: | + eval "$(dune tools env)" + dune build @fmt diff --git a/.github/workflows/osv.yml b/.github/workflows/osv.yml new file mode 100644 index 0000000..8713a6f --- /dev/null +++ b/.github/workflows/osv.yml @@ -0,0 +1,31 @@ +# This workflow is managed by gh actions-lock. + +name: OSV + +on: + push: + branches: [ main ] + paths: [ 'dune.lock/**', '.github/workflows/osv.yml', '.github/workflows/actions.lock' ] + pull_request: + paths: [ 'dune.lock/**', '.github/workflows/osv.yml', '.github/workflows/actions.lock' ] + schedule: + # New advisories land without any change on our side, so rescan daily. + - cron: '0 0 * * *' + workflow_dispatch: + +permissions: + contents: read + +jobs: + osv: + runs-on: ubuntu-latest + permissions: + contents: read + issues: write # only for create-issue on schedule + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - uses: lmdexpr/dune-lock-osv@main + with: + create-issue: ${{ github.event_name == 'schedule' }} From 74686d8f17c1e3995c236105deea0a4b12a2a30e Mon Sep 17 00:00:00 2001 From: lmdexpr Date: Thu, 1 Oct 2026 17:50:42 +0900 Subject: [PATCH 2/3] ci: run format check in the Linux test job The standalone fmt job took ~10 minutes: @fmt needs the locked compiler, so it rebuilt the project's compiler on top of the ocamlformat dev tool, and its dune cache never saved because it raced the Linux test job on the same key. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/ci.yml | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 041261f..d6270b8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,18 +27,11 @@ jobs: with: # Keep in sync with the local dune; nightly would make dune.lock churn version: 3.24.0 - - fmt: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7.0.1 - with: - persist-credentials: false - - uses: ocaml-dune/setup-dune@v2.1.0 - with: - version: 3.24.0 - steps: install-dune enable-pkg - - run: dune tools install ocamlformat - - run: | + # Run here rather than in a separate job: @fmt needs the locked compiler + # this job already built, and a second job would race on the same cache key. + - name: Check formatting + if: runner.os == 'Linux' + run: | + dune tools install ocamlformat eval "$(dune tools env)" dune build @fmt From 29684f2e94cdca471bf960d54a0af1ea411d4c0e Mon Sep 17 00:00:00 2001 From: lmdexpr Date: Thu, 1 Oct 2026 17:55:13 +0900 Subject: [PATCH 3/3] build: bump dune lang to 3.24 to match CI CI pins dune 3.24.0; align the project's language version (and the generated opam lower bounds) with it. Co-Authored-By: Claude Opus 5.5 (1M context) --- aws-lambda-eio.opam | 2 +- aws-lambda.opam | 2 +- dune-project | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/aws-lambda-eio.opam b/aws-lambda-eio.opam index a52d5e3..92935b2 100644 --- a/aws-lambda-eio.opam +++ b/aws-lambda-eio.opam @@ -12,7 +12,7 @@ homepage: "https://github.com/lmdexpr/aws-lambda.ml" bug-reports: "https://github.com/lmdexpr/aws-lambda.ml/issues" depends: [ "ocaml" {>= "5.3.0"} - "dune" {>= "3.23"} + "dune" {>= "3.24"} "aws-lambda" {= version} "eio" "cohttp-eio" diff --git a/aws-lambda.opam b/aws-lambda.opam index eb84bfa..676eb61 100644 --- a/aws-lambda.opam +++ b/aws-lambda.opam @@ -14,7 +14,7 @@ homepage: "https://github.com/lmdexpr/aws-lambda.ml" bug-reports: "https://github.com/lmdexpr/aws-lambda.ml/issues" depends: [ "ocaml" {>= "5.3.0"} - "dune" {>= "3.23"} + "dune" {>= "3.24"} "alcotest" {with-test} "odoc" {with-doc} ] diff --git a/dune-project b/dune-project index af2fa1a..ef6c498 100644 --- a/dune-project +++ b/dune-project @@ -1,4 +1,4 @@ -(lang dune 3.23) +(lang dune 3.24) (implicit_transitive_deps false)