c0mpute/.github/workflows/rust.yml at master · profullstack/c0mpute · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: rust

# The Rust build/test gate.
#
# Until this existed, CI ran only security scanners (CodeQL, ThreatCrush,
# gitleaks, semgrep, Socket, bun audit) — nothing compiled the workspace or ran
# a test. A PR could break every crate in the tree and still show all-green.
#
# `build-and-test` is the gate and must stay blocking. `lint` is advisory for
# now: the tree does not currently satisfy `cargo fmt --check`, and clippy has
# pre-existing warnings in c0mpute-net and c0mpute-update. Making either
# blocking today would redden every PR for reasons unrelated to its diff. Once
# the tree is clean, drop the `continue-on-error` lines and they become real
# gates — that is the point of running them now rather than waiting.

on:
  pull_request:
  push:
    branches: [master, main]

# A new push supersedes an in-flight run for the same ref. Rust builds are the
# most expensive job in this repo; there is no value in finishing one for a
# commit that has already been replaced.
concurrency:
  group: rust-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  # Fail on warnings only where we opt in below; see the lint job.
  RUST_BACKTRACE: 1

jobs:
  build-and-test:
    name: build + test
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v5

      # The toolchain version is read out of .mise.toml rather than pinned
      # here, so CI cannot silently drift from what contributors run locally
      # (DIP-0004 pins the contributor toolchain via mise). If the two were
      # written in two places, they would disagree eventually and CI would be
      # testing a compiler nobody uses.
      - name: Resolve the pinned toolchain
        id: toolchain
        run: |
          version=$(grep -E '^rust\s*=' .mise.toml | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
          if [ -z "$version" ]; then
            echo "::error::could not read the rust version from .mise.toml"
            exit 1
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "Using Rust $version (from .mise.toml)"

      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ steps.toolchain.outputs.version }}

      - uses: Swatinem/rust-cache@v2

      # Build before testing so a compile error is reported as a compile
      # error, rather than as an opaque failure inside `cargo test`.
      - name: Build
        run: cargo build --workspace --all-targets --locked

      - name: Test
        run: cargo test --workspace --locked

      # Blocking, unlike the lint job: this invariant has no legacy debt to
      # work through, and it is cheap to keep green from the start.
      #
      # It re-canonicalizes every envelope shown in docs/protocol/ using
      # Python's json.dumps(sort_keys=True) and compares byte-for-byte against
      # what c0mpute-envelope produced. That catches a spec page going stale,
      # and — the reason it is worth a CI slot — it checks that the canonical
      # form is reproducible by a second implementation in another language,
      # which is what every hash and signature on the network depends on.
      - name: Protocol docs match the implementation
        run: python3 scripts/check-protocol-docs.py

  lint:
    name: fmt + clippy (advisory)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    # Advisory until the tree is clean — see the header comment. The result is
    # still visible on every PR, so the backlog cannot quietly grow.
    continue-on-error: true

    steps:
      - uses: actions/checkout@v5

      - name: Resolve the pinned toolchain
        id: toolchain
        run: |
          version=$(grep -E '^rust\s*=' .mise.toml | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
          echo "version=${version:-stable}" >> "$GITHUB_OUTPUT"

      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ steps.toolchain.outputs.version }}
          components: rustfmt, clippy

      - uses: Swatinem/rust-cache@v2

      - name: cargo fmt --check
        continue-on-error: true
        run: cargo fmt --all -- --check

      - name: cargo clippy
        continue-on-error: true
        run: cargo clippy --workspace --all-targets

      # Report what the two steps found in one place, so the advisory result is
      # legible without opening the log.
      - name: Summarise
        if: always()
        run: |
          {
            echo "## Rust lint (advisory)"
            echo
            echo "Not blocking yet: the tree has pre-existing \`cargo fmt\` diffs and"
            echo "clippy warnings in \`c0mpute-net\` and \`c0mpute-update\`. Clear those and"
            echo "remove the \`continue-on-error\` lines in \`.github/workflows/rust.yml\`"
            echo "to turn this into a real gate."
          } >> "$GITHUB_STEP_SUMMARY"