CI #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # A new advisory against a static lockfile arrives without anyone pushing, and | |
| # `dtolnay/rust-toolchain@stable` moves under us between releases. Note GitHub | |
| # disables cron on a repo with 60 days of no activity (it emails first), so | |
| # this buys bounded, not unbounded, coverage. | |
| schedule: | |
| - cron: "0 6 * * 1" | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: -D warnings | |
| jobs: | |
| test: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt, clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Format | |
| run: cargo fmt --all --check | |
| - name: Clippy | |
| run: cargo clippy --workspace --all-targets | |
| # The ubuntu leg is the load-bearing half of the purity contract: goz-core | |
| # is 9.8k of the workspace's 14.3k lines and green here means none of it | |
| # *calls* a Windows API. (Only *calls*: an unused platform dep would still | |
| # link. The declared-dep half is the allowlist below.) | |
| - name: Test | |
| run: cargo test --workspace | |
| # The architecture doc comments in lib.rs are the design record, and | |
| # RUSTFLAGS above does not reach rustdoc, so their intra-doc links rot | |
| # unchecked. --document-private-items because these are internal docs. | |
| - name: Docs | |
| env: | |
| RUSTDOCFLAGS: -D warnings | |
| run: cargo doc --workspace --no-deps --document-private-items | |
| # goz-core's direct deps are a closed set, so assert the set itself: an | |
| # allowlist fails on anything unforeseen, where the denylist this replaces | |
| # named four crates and would have waved through `windows`, `winapi`, | |
| # `libc` and `nix`. `--target all` so the ubuntu leg still sees a | |
| # cfg(windows)-gated entry; `set -euo pipefail` so a cargo failure fails | |
| # the step rather than matching nothing and passing. | |
| # | |
| # The other direction (goz-winfs must not depend on goz-core) is a | |
| # `wrappers` ban in deny.toml, enforced by the `deny` job below. | |
| - name: "goz-core purity: direct deps are the allowed set" | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| expected="hashbrown memchr rayon rustc-hash serde serde_json smallvec thiserror unicode-normalization zerocopy" | |
| actual="$(cargo tree -p goz-core --edges normal --target all --depth 1 --prefix none \ | |
| | awk 'NF && $1 != "goz-core" { print $1 }' \ | |
| | sort -u | tr '\n' ' ' | sed 's/ $//')" | |
| if [ "$actual" != "$expected" ]; then | |
| echo "::error::goz-core direct dependencies changed; keep goz-core pure or update this allowlist deliberately" | |
| echo "expected: $expected" | |
| echo "actual: $actual" | |
| exit 1 | |
| fi | |
| # MSRV gate: `rust-version` in Cargo.toml is a promise, so pin exactly that | |
| # toolchain and build. The main `test` job floats on stable, which would let | |
| # the real minimum drift above the advertised one unnoticed. `cargo check` | |
| # (not test) because dev-dependencies need not honor the MSRV. | |
| msrv: | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@1.94.0 | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo check --workspace | |
| # Supply-chain gate: enforce the deny.toml policy (licenses, yanked crates, | |
| # advisories, unknown sources). cargo-deny is graph-wide and deny.toml has no | |
| # [targets] filter, so ubuntu covers the Windows-gated deps too. | |
| deny: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check advisories bans licenses sources |