Repository navigation
139 lines (116 loc) · 3.8 KB
/
Copy pathci.yml
File metadata and controls
139 lines (116 loc) · 3.8 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
name: CI
on:
push:
branches: [main, master]
pull_request:
workflow_call:
workflow_dispatch:
permissions:
contents: read
concurrency:
group: ci-${{ github.event_name }}-${{ github.ref }}
cancel-in-progress: true
jobs:
test:
name: Test (${{ matrix.os }}, Rust ${{ matrix.rust }})
runs-on: ${{ matrix.os }}
timeout-minutes: 20
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest]
# 1.98 is the minimum supported version (rust-version in Cargo.toml).
rust: ["1.98", stable]
exclude:
- os: windows-latest
rust: "1.98"
- os: macos-latest
rust: "1.98"
steps:
- name: Checkout code
uses: actions/checkout@v7
with:
ref: ${{ github.event.release.tag_name || github.sha }}
persist-credentials: false
- name: Set up Rust
uses: actions-rust-lang/setup-rust-toolchain@v1
with:
toolchain: ${{ matrix.rust }}
components: rustfmt, clippy
- name: Set release version
if: github.event_name == 'release'
shell: bash
env:
RELEASE_TAG: ${{ github.event.release.tag_name }}
run: .github/scripts/set-release-version.sh
- name: Check formatting
if: runner.os == 'Linux' && matrix.rust == 'stable'
run: cargo fmt --all -- --check
# The generator is private; without it the script checks the generated headers.
- name: Check generated code
if: runner.os == 'Linux'
shell: bash
run: scripts/generate.sh --check
- name: Run Clippy
if: runner.os == 'Linux' && matrix.rust == 'stable'
run: cargo clippy --all-targets --all-features --locked -- -D warnings
- name: Run tests
run: cargo test --all-features --locked
- name: Check documentation
if: runner.os == 'Linux' && matrix.rust == 'stable'
env:
RUSTDOCFLAGS: -D warnings
run: cargo doc --all-features --no-deps --locked
security:
name: Security
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- name: Checkout code
uses: actions/checkout@v7
with:
ref: ${{ github.event.release.tag_name || github.sha }}
persist-credentials: false
- name: Set up Rust
uses: actions-rust-lang/setup-rust-toolchain@v1
with:
toolchain: stable
- name: Run dependency audit
run: |
cargo install cargo-audit --locked
cargo audit
- name: Scan for common secret patterns
run: |
! grep -REn \
'AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|sk_(live|test)_[A-Za-z0-9]+|ghp_[A-Za-z0-9_]+|github_pat_[A-Za-z0-9_]+|xox[baprs]-[A-Za-z0-9-]+|-----BEGIN (RSA|DSA|EC|OPENSSH|PRIVATE) KEY' \
src tests README.md UPGRADE.md CHANGELOG.md Cargo.toml
build:
name: Build package
needs: [test, security]
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- name: Checkout code
uses: actions/checkout@v7
with:
ref: ${{ github.event.release.tag_name || github.sha }}
persist-credentials: false
- name: Set up Rust
uses: actions-rust-lang/setup-rust-toolchain@v1
with:
toolchain: stable
- name: Set release version
if: github.event_name == 'release'
shell: bash
env:
RELEASE_TAG: ${{ github.event.release.tag_name }}
run: .github/scripts/set-release-version.sh
- name: Build package
run: cargo package --locked --allow-dirty
- name: Upload package
uses: actions/upload-artifact@v7
with:
name: package
path: target/package/lettermint-*.crate
if-no-files-found: error
retention-days: 30