Chiebot-Mirror/protobuf - protobuf - Gitea: Git with a cup of tea

Author	SHA1	Message	Date
Mike Kruskal	3221b48dfa	Fix cache cleaning workflow PiperOrigin-RevId: 571375376	1 year ago
Joyce	010fde9a18	Set top level permissions to read only on GitHub Workflows (#12971 ) Hi, here is Joyce from Google again. I'd like starting suggesting the [Token-Permission check](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) fix. Let me know if I might be missing any permission. Thanks! ### Security Reason This is needed because, by default, github grants write-all permission to all workflows, which could be exploit by an attacker in case of a compromised workflow. Limiting permissions is a simple and effective way to also limit the impact of an eventual compromised workflow. Thus, it is both a recommendation from [OpenSSF Scorecard](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) and the [Github](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions) to always use credentials that are minimally scoped. Closes #12971 COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/12971 from joycebrum:main `6d6dac5678` PiperOrigin-RevId: 537973051	2 years ago
Mike Kruskal	0e48352e6d	Expand lifetime of repository cache. These are not growing fast at all, but are taking a long time to asymptotically fill out. PiperOrigin-RevId: 512086597	2 years ago
Mike Kruskal	0ed65fd08f	Enable github caching of Bazel's repository cache. This should substantially reduce network flakes, since most builds will no longer need to download external dependencies. Because these caches actually get pretty expensive (~300 MB just from 1 openjdk dependency), we've taken some precautions: 1) The caches only get updated on push events (i.e. post-submit jobs) 2) Only a single job will push a new cache for any os/branch/commit combination. This will be whichever job finishes its bazel run first, and also has updates for the cache. Over time, the cache should expand to the full set of transitive dependencies as the quicker jobs stop pushing updates. 3) A clear_caches workflow has been introduced to reset the caches in case they grow too large. This will run monthly for now, but can also be run manually. PiperOrigin-RevId: 508133044	2 years ago