pouch/.github/workflows/rust.yml at main · qkniep/pouch · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
name: Rust

# Least privilege: every job here only reads the repo. Scope up per-job if one
# ever needs to write (e.g. commit, comment, or push).
permissions:
  contents: read

on:
  push:
    branches: ["main"]
  pull_request:

concurrency:
  group: rust-${{ github.ref }}
  cancel-in-progress: true

# This is the always-on core suite. Optional checks live in their own workflow
# files (coverage.yml, msrv.yml, semver.yml, bench-gating.yml, miri.yml,
# sanitizers.yml, careful.yml, scorecard.yml, no-std.yml) so a project can drop
# one by deleting a single file.
jobs:
  # Cheap checks grouped onto one runner so they share a single boot + checkout.
  # Need nightly with rustfmt for fmt; typos and actionlint need no toolchain.
  # Reports failure only after each step ran (`if: ${{ !cancelled() }}`).
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./.github/actions/rust-setup
        with:
          toolchain: nightly
          components: rustfmt

      - name: Check formatting
        run: cargo +nightly fmt --all -- --check

      - name: Check spelling
        if: ${{ !cancelled() }}
        uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0

      # Lints these workflow files for syntax errors, bad expressions, and (via the
      # runner's preinstalled shellcheck) issues in `run:` scripts. Pinned to a
      # release rather than a marketplace action to keep the dependency auditable;
      # the tarball is checksum-verified before extraction.
      - name: actionlint
        if: ${{ !cancelled() }}
        env:
          ACTIONLINT_VERSION: "1.7.7"
          ACTIONLINT_SHA256: "023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757"
        run: |
          curl -fsSL -o actionlint.tar.gz \
            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          echo "${ACTIONLINT_SHA256}  actionlint.tar.gz" | sha256sum -c -
          tar -xz -f actionlint.tar.gz actionlint
          ./actionlint -color

  clippy:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./.github/actions/rust-setup

      - name: Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./.github/actions/rust-setup
        with:
          tools: nextest

      - name: Tests
        run: cargo nextest run --all-targets --all-features --locked

      # nextest doesn't run doctests, so run them separately to match `just check`.
      - name: Doctests
        run: cargo test --doc --all-features --locked

  build:
    # Release-only: debug compilation of all targets is already covered by `test`,
    # and release-only breakage is rare, so this runs on main pushes rather than
    # every PR. `push` only fires on main (see triggers above).
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./.github/actions/rust-setup

      - name: Build (release)
        run: cargo build --all-targets --release --locked

  security:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./.github/actions/rust-setup
        with:
          tools: cargo-deny,cargo-machete

      - name: Cargo deny (advisories, licenses, bans, sources)
        run: cargo deny check

      - name: Unused deps
        run: cargo machete

  docs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./.github/actions/rust-setup

      - name: Build docs
        run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features --document-private-items --locked