Repository navigation
the release exists, and the only place saying how to cut one was a wo… #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| # A dependency becomes vulnerable on the day the advisory lands, not on | |
| # the day someone next touches the code. Pushes alone would mean a | |
| # quiet week is indistinguishable from a clean one, so the audit gets a | |
| # heartbeat. The image job opts out of it below: nothing it builds | |
| # changes while the tree sits still. | |
| schedule: | |
| - cron: "0 6 * * 1" | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| # The gate that runs on every push. It covers everything checkable | |
| # without a machine to run on, including the cheap tier of the smoke | |
| # tests: every committed example parses, validates, and compiles to an | |
| # image that keeps kuma's floor (greenboot, the lint, the baked | |
| # declaration, a greeter check on every desktop). | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy, rustfmt | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo fmt --check | |
| - run: cargo test --locked --all-targets | |
| - run: cargo clippy --locked --all-targets -- -D warnings | |
| - run: cargo build --locked --release | |
| - name: shellcheck | |
| run: shellcheck scripts/smoke.sh | |
| # A workflow can be valid YAML and still be nonsense to Actions, | |
| # which only says so by refusing to run any job at all. That is a | |
| # slow way to find out, and it already cost one push here: a | |
| # `branches:` key one level too high parsed fine everywhere except | |
| # GitHub. actionlint reads the event schema, and shellchecks the | |
| # inline run blocks that the step above cannot see. | |
| - name: actionlint | |
| uses: docker://rhysd/actionlint:latest | |
| with: | |
| args: -color | |
| # The image stage: actually build a declaration with podman and inspect | |
| # the result. Only the minimal example, deliberately. A desktop image is | |
| # ~4.5 GB plus its layers, which does not fit a hosted runner's disk with | |
| # room to spare, and a smoke test that flakes on ENOSPC teaches nobody | |
| # anything. Desktop images are covered by the boot stage, which needs | |
| # KVM and sudo and runs locally: `scripts/smoke.sh --boot`. | |
| image: | |
| runs-on: ubuntu-latest | |
| # Skipped on the weekly run: this builds a real image with podman, and | |
| # the tree it builds from is the same one it built last week. | |
| if: github.event_name != 'schedule' | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo build --locked | |
| - name: smoke (check + image) | |
| run: ./scripts/smoke.sh minimal | |
| # Nothing else here asks whether the dependencies have known holes. | |
| # Clippy reads our code and the tests read our behavior; neither has an | |
| # opinion about an advisory against a crate we merely depend on. This | |
| # reads Cargo.lock against the RustSec database, which is the other | |
| # reason that lock is committed rather than only pinning our builds. | |
| # | |
| # Plain `cargo audit` fails on vulnerabilities and reports unmaintained | |
| # or yanked crates without failing. That split is deliberate: a crate | |
| # losing its maintainer is worth hearing about on a Monday, and is not | |
| # worth blocking a push over. | |
| audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-audit | |
| - run: cargo audit |