ci: add OSV scan and setup-dune CI, locked with gh actions-lock

.github/workflows/actions.lock

@@ -0,0 +1,47 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'ocaml-dune/setup-dune@v2.1.0'
+    '.github/workflows/osv.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'lmdexpr/dune-lock-osv@main'
+dependencies:
+    'actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7':
+        ref: 'v5.0.2'
+        commit: 'sha1-8b402f58fbc84540c8b491a91e594a4576fec3d7'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3':
+        ref: 'v9.0.0'
+        commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f':
+        ref: 'v6.0.0'
+        commit: 'sha1-b7c566a772e6b6bfb58ed0dc250532a479d7789f'
+        owner_id: 44036562
+        repo_id: 192625955
+    'lmdexpr/dune-lock-osv@main':
+        ref: 'main'
+        commit: 'sha1-7f1568fa0114081c2e949c4b07e1c01386adeea5'
+        owner_id: 4951592
+        repo_id: 1399418780
+        uses:
+            - 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3'
+    'ocaml-dune/setup-dune@v2.1.0':
+        ref: 'v2.1.0'
+        commit: 'sha1-2201fa80f49561672943e7960e5f918c887ab0dc'
+        owner_id: 62877882
+        repo_id: 955896475
+        uses:
+            - 'actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7'
+            - 'actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f'

.github/workflows/ci.yml

@@ -1,73 +1,41 @@
+# This workflow is managed by gh actions-lock.
+
 name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [ main ]
   pull_request:
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    env:
-      # Persist dune's content-addressed build cache so that the locked
-      # dependencies (compiler included) are not rebuilt from source every run.
-      DUNE_CACHE: enabled
-      DUNE_CACHE_STORAGE_MODE: copy
+permissions:
+  contents: read
 
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        # dune.lock is solved for linux and macos only
+        runs-on: [ ubuntu-latest, macos-latest ]
+    runs-on: ${{ matrix.runs-on }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      # Only the bootstrap `dune` binary lives in the opam switch; every project
-      # dependency is built hermetically from dune.lock/ by dune's package
-      # management, and ocamlformat is a dune tool.
-      - name: Install opam
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends opam bubblewrap
-
-      - name: Cache opam (dune bootstrap)
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ~/.opam
-          key: opam-bootstrap-${{ runner.os }}-dune3.24
-
-      - name: Cache dune toolchain (OCaml compiler)
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      - uses: actions/checkout@v7.0.1
         with:
-          path: ~/.cache/dune/toolchains
-          key: dune-toolchain-v1-${{ runner.os }}-${{ hashFiles('dune.lock/ocaml.*.pkg', 'dune.lock/ocaml-compiler.*.pkg', 'dune.lock/ocaml-base-compiler.*.pkg', 'dune.lock/ocaml-config.*.pkg') }}
-
-      - name: Cache dune (build cache + git repos + _build)
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+          persist-credentials: false
+      - uses: ocaml-dune/setup-dune@v2.1.0
         with:
-          path: |
-            ~/.cache/dune/db
-            ~/.cache/dune/git-repo
-            _build
-          key: dune-cache-v1-${{ runner.os }}-${{ hashFiles('dune.lock/**') }}
-          restore-keys: |
-            dune-cache-v1-${{ runner.os }}-
-
-      - name: Set up dune
-        run: |
-          opam init --disable-sandboxing -y
-          opam install dune -y
-
-      - name: Build
-        run: opam exec -- dune build @all
-
+          # Keep in sync with the local dune; nightly would make dune.lock churn
+          version: 3.24.2
+      # Run here rather than in a separate job: @fmt needs the locked compiler
+      # this job already built, and a second job would race on the same cache key.
       - name: Check formatting
+        if: runner.os == 'Linux'
         run: |
-          opam exec -- dune tools install ocamlformat
-          opam exec -- dune build @fmt
-
-      - name: Run tests
-        run: opam exec -- dune runtest
-
-      - name: Trim dune build cache
-        run: opam exec -- dune cache trim --size 3GB
+          dune tools install ocamlformat
+          eval "$(dune tools env)"
+          dune build @fmt

.github/workflows/osv.yml

@@ -0,0 +1,31 @@
+# This workflow is managed by gh actions-lock.
+
+name: OSV
+
+on:
+  push:
+    branches: [ main ]
+    paths: [ 'dune.lock/**', '.github/workflows/osv.yml', '.github/workflows/actions.lock' ]
+  pull_request:
+    paths: [ 'dune.lock/**', '.github/workflows/osv.yml', '.github/workflows/actions.lock' ]
+  schedule:
+    # New advisories land without any change on our side, so rescan daily.
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  osv:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write # only for create-issue on schedule
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - uses: lmdexpr/dune-lock-osv@main
+        with:
+          create-issue: ${{ github.event_name == 'schedule' }}

dune-project

@@ -18,14 +18,14 @@
 ;; sigv4 / sigv4-cohttp-eio are not yet published to the opam repository; pin them ; straight from the upstream repo.
 (pin
  (url
-  "git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926")
+  "git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda")
  (package
   (name sigv4)
   (version "dev")))
 
 (pin
  (url
-  "git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926")
+  "git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda")
  (package
   (name sigv4-cohttp-eio)
   (version "dev")))

dune.lock/eio.1.5.pkg → dune.lock/eio.1.6.pkg

@@ -1,4 +1,4 @@
-(version 1.5)
+(version 1.6)
 
 (build
  (all_platforms
@@ -21,6 +21,6 @@
 (source
  (fetch
   (url
-   https://github.com/ocaml-multicore/eio/releases/download/v1.5/eio-1.5.tbz)
+   https://github.com/ocaml-multicore/eio/releases/download/v1.6/eio-1.6.tbz)
   (checksum
-   sha512=4582ac2fb2f8616b3d8ae9670eb7913a78085899b14044408801b30a34fed6c4d32971ba72eedb0cbc3d82c057610cf81c482090e75e2985330fcde96478ac5e)))
+   sha512=92ed8cf20300b8a4e0141bdbc373c0803c5a24530cb65852637d905fff4a5b956a8859a00a424034ff78c1112da9b0391194bcd558326168bdebd1ce683a8890)))

dune.lock/eio_linux.1.5.pkg → dune.lock/eio_linux.1.6.pkg

@@ -1,4 +1,4 @@
-(version 1.5)
+(version 1.6)
 
 (build
  (choice
@@ -20,9 +20,9 @@
 (source
  (fetch
   (url
-   https://github.com/ocaml-multicore/eio/releases/download/v1.5/eio-1.5.tbz)
+   https://github.com/ocaml-multicore/eio/releases/download/v1.6/eio-1.6.tbz)
   (checksum
-   sha512=4582ac2fb2f8616b3d8ae9670eb7913a78085899b14044408801b30a34fed6c4d32971ba72eedb0cbc3d82c057610cf81c482090e75e2985330fcde96478ac5e)))
+   sha512=92ed8cf20300b8a4e0141bdbc373c0803c5a24530cb65852637d905fff4a5b956a8859a00a424034ff78c1112da9b0391194bcd558326168bdebd1ce683a8890)))
 
 (enabled_on_platforms
  (only

dune.lock/eio_main.1.5.pkg → dune.lock/eio_main.1.6.pkg

@@ -1,4 +1,4 @@
-(version 1.5)
+(version 1.6)
 
 (build
  (all_platforms
@@ -20,6 +20,6 @@
 (source
  (fetch
   (url
-   https://github.com/ocaml-multicore/eio/releases/download/v1.5/eio-1.5.tbz)
+   https://github.com/ocaml-multicore/eio/releases/download/v1.6/eio-1.6.tbz)
   (checksum
-   sha512=4582ac2fb2f8616b3d8ae9670eb7913a78085899b14044408801b30a34fed6c4d32971ba72eedb0cbc3d82c057610cf81c482090e75e2985330fcde96478ac5e)))
+   sha512=92ed8cf20300b8a4e0141bdbc373c0803c5a24530cb65852637d905fff4a5b956a8859a00a424034ff78c1112da9b0391194bcd558326168bdebd1ce683a8890)))

dune.lock/eio_posix.1.6.pkg

@@ -0,0 +1,16 @@
+(version 1.6)
+
+(build
+ (all_platforms
+  ((action (run dune build -p %{pkg-self:name} -j %{jobs} @install)))))
+
+(depends
+ (all_platforms
+  (dune eio iomux fmt)))
+
+(source
+ (fetch
+  (url
+   https://github.com/ocaml-multicore/eio/releases/download/v1.6/eio-1.6.tbz)
+  (checksum
+   sha512=92ed8cf20300b8a4e0141bdbc373c0803c5a24530cb65852637d905fff4a5b956a8859a00a424034ff78c1112da9b0391194bcd558326168bdebd1ce683a8890)))

dune.lock/lock.dune

@@ -12,7 +12,7 @@
   ((source
     https://github.com/ocaml-dune/opam-repository-relocatable.git#d64df82c7e16de819a770cabf4066a06243ed80b))
   ((source
-    https://github.com/ocaml/opam-repository.git#275b0f5c38c9deb316b61205aa2f4995774f9360))))
+    https://github.com/ocaml/opam-repository.git#6f927382c92d816a9b54225f9aeae9c52d0e5e10))))
 
 (expanded_solver_variable_bindings
  (variable_values

dune.lock/sigv4-cohttp-eio.dev.pkg

@@ -10,6 +10,6 @@
 (source
  (fetch
   (url
-   git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926)))
+   git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda)))
 
 (dev)

dune.lock/sigv4.dev.pkg

@@ -10,6 +10,6 @@
 (source
  (fetch
   (url
-   git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926)))
+   git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda)))
 
 (dev)

dynamodb-cohttp-eio.opam

@@ -41,6 +41,6 @@ dev-repo: "git+https://github.com/lmdexpr/dynamodb.ml.git"
 x-maintenance-intent: ["(latest)"]
 # sigv4 is not on the opam repository yet.
 pin-depends: [
-  ["sigv4.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926"]
-  ["sigv4-cohttp-eio.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926"]
+  ["sigv4.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda"]
+  ["sigv4-cohttp-eio.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda"]
 ]

dynamodb-cohttp-eio.opam.template

@@ -1,5 +1,5 @@
 # sigv4 is not on the opam repository yet.
 pin-depends: [
-  ["sigv4.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926"]
-  ["sigv4-cohttp-eio.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926"]
+  ["sigv4.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda"]
+  ["sigv4-cohttp-eio.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda"]
 ]