chore: release v0.20.0 #968
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - "**.md" | |
| - "docs/**" | |
| - "assets/**" | |
| - "LICENSE" | |
| - ".gitignore" | |
| pull_request: | |
| branches: [main] | |
| paths-ignore: | |
| - "**.md" | |
| - "docs/**" | |
| - "assets/**" | |
| - "LICENSE" | |
| - ".gitignore" | |
| permissions: {} | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: -Dwarnings | |
| jobs: | |
| check: | |
| name: Check | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| # Runners already ship `rustup`; install + override the | |
| # workspace's MSRV pin with stable for this job inline rather | |
| # than via a third-party action. | |
| - name: Install Rust stable | |
| run: | | |
| rustup toolchain install stable --profile minimal --no-self-update | |
| rustup override set stable | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| # Write the cache only from main; PRs restore it but never save. This | |
| # drops the slow per-PR cache upload (notably ~3 min on the Windows | |
| # runner) and keeps the shared cache from thrashing across branches. | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| - run: cargo check --workspace --all-targets --all-features --locked | |
| wasm: | |
| name: WASM build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read # read repo | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust stable with WASM target | |
| run: | | |
| rustup toolchain install stable --profile minimal --no-self-update | |
| rustup override set stable | |
| rustup target add wasm32-unknown-unknown | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| # Compile the embeddable crates for wasm without default features. This | |
| # catches any dependency (tokio, rayon, a C-building crate, ...) that | |
| # would break the WASM build before it ships. | |
| - run: cargo build --release --target wasm32-unknown-unknown -p rsigma-parser -p rsigma-eval --no-default-features --locked | |
| # Prove the crates actually run under a JavaScript-free host. The fixture | |
| # links parser + eval into a cdylib and self-tests parse/compile/evaluate; | |
| # a transitive `wasm-bindgen` import would fail instantiation here, and a | |
| # semantic regression would trap the module. | |
| - name: Install Wasmtime | |
| uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 | |
| with: | |
| tool: wasmtime | |
| - name: Instantiate the WASM module in a host-neutral runtime | |
| run: | | |
| cargo build --release --target wasm32-unknown-unknown \ | |
| --manifest-path ci/wasm-smoke/Cargo.toml \ | |
| --target-dir "${RUNNER_TEMP}/wasm-smoke-target" --locked | |
| wasmtime run --invoke run_selftest \ | |
| "${RUNNER_TEMP}/wasm-smoke-target/wasm32-unknown-unknown/release/rsigma_wasm_smoke.wasm" | |
| msrv: | |
| name: MSRV (1.88.0) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read # read repo | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| # Install MSRV inline. No `rustup override set` here because the | |
| # workspace's `rust-toolchain.toml` already pins to 1.88.0, so | |
| # `cargo` will pick that toolchain automatically once it is | |
| # installed. | |
| - name: Install Rust 1.88.0 | |
| run: rustup toolchain install 1.88.0 --profile minimal --no-self-update | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| # `--all-targets` so tests, examples, and benches compile against | |
| # the MSRV too. Without it a contributor can add a test-only | |
| # dependency that requires a newer Rust without anyone noticing. | |
| - run: cargo check --workspace --all-targets --all-features --locked | |
| fmt: | |
| name: Format | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust stable with rustfmt | |
| run: | | |
| rustup toolchain install stable --profile minimal --component rustfmt --no-self-update | |
| rustup override set stable | |
| - run: cargo fmt --all -- --check | |
| clippy: | |
| name: Clippy | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust stable with clippy | |
| run: | | |
| rustup toolchain install stable --profile minimal --component clippy --no-self-update | |
| rustup override set stable | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| - run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings | |
| rstix-lean-features: | |
| name: rstix lean features | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust stable with clippy | |
| run: | | |
| rustup toolchain install stable --profile minimal --component clippy --no-self-update | |
| rustup override set stable | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| # rstix default features include serde; these combos catch lean-build drift. | |
| - run: cargo check -p rstix --no-default-features --locked | |
| - run: cargo clippy -p rstix --no-default-features --all-targets --locked -- -D warnings | |
| - run: cargo check -p rstix --no-default-features --features pattern --locked | |
| test: | |
| name: Test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| permissions: | |
| contents: read | |
| env: | |
| # Drop full debuginfo down to line tables: cuts codegen and, on | |
| # Windows, the expensive PDB generation/link step, while keeping panic | |
| # file:line in CI logs. Disable incremental compilation: it adds | |
| # overhead and bloats the cache for no benefit in from-scratch CI runs. | |
| CARGO_PROFILE_DEV_DEBUG: line-tables-only | |
| CARGO_PROFILE_TEST_DEBUG: line-tables-only | |
| CARGO_INCREMENTAL: "0" | |
| # Link with LLVM's lld-link instead of MSVC link.exe on the Windows | |
| # target (the windows-latest runner ships LLVM on PATH). LLD roughly | |
| # halves MSVC link time, which dominates this job. The var only affects | |
| # the windows-msvc target, so it is a no-op on the Linux/macOS legs and | |
| # never touches the release-binary builds. | |
| CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER: lld-link.exe | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust stable | |
| shell: bash | |
| run: | | |
| rustup toolchain install stable --profile minimal --no-self-update | |
| rustup override set stable | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| - run: cargo test --workspace --all-features --locked | |
| coverage: | |
| name: Coverage | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust stable with llvm-tools-preview | |
| run: | | |
| rustup toolchain install stable --profile minimal --component llvm-tools-preview --no-self-update | |
| rustup override set stable | |
| - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 | |
| with: | |
| tool: cargo-llvm-cov | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| - name: Generate coverage | |
| run: | | |
| cargo llvm-cov --workspace --all-features --locked --lcov --output-path lcov.info | |
| echo '## Coverage Report' >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| cargo llvm-cov report --summary-only 2>&1 >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| # Upload the lcov report so external coverage trackers (Codecov, | |
| # Coveralls, …) can ingest it without re-running the suite, and | |
| # so PR reviewers can download the raw file from the run summary. | |
| - name: Upload lcov report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: coverage-lcov | |
| path: lcov.info | |
| if-no-files-found: error | |
| retention-days: 14 | |
| doc: | |
| name: Doc | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust stable | |
| run: | | |
| rustup toolchain install stable --profile minimal --no-self-update | |
| rustup override set stable | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| # Fail the build on broken intra-doc links and any other rustdoc | |
| # warning. `--no-deps` keeps the work bounded to first-party | |
| # crates so this job does not chase a transitive dep's doc | |
| # comment. | |
| - env: | |
| RUSTDOCFLAGS: "-D warnings -D rustdoc::broken-intra-doc-links" | |
| run: cargo doc --workspace --all-features --locked --no-deps | |
| sigma-corpus: | |
| name: Sigma Corpus Regression | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # Pin the upstream corpus to a specific commit so a SigmaHQ rule | |
| # tweak cannot turn a green run red without a deliberate bump | |
| # here. Update by changing the SHA in this block (and `--branch` | |
| # is not used because GitHub does not advertise `master` as a | |
| # refspec via `--depth 1`). | |
| env: | |
| SIGMA_CORPUS_SHA: "994da16651194500b607a3007186c29779e1f961" | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust stable | |
| run: | | |
| rustup toolchain install stable --profile minimal --no-self-update | |
| rustup override set stable | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| - name: Build rsigma | |
| run: cargo build --release --all-features --locked -p rsigma | |
| - name: Fetch SigmaHQ rules at pinned SHA | |
| run: | | |
| mkdir -p /tmp/sigma | |
| cd /tmp/sigma | |
| git init -q | |
| git remote add origin https://github.com/SigmaHQ/sigma.git | |
| git fetch --depth 1 origin "${SIGMA_CORPUS_SHA}" | |
| git checkout -q FETCH_HEAD | |
| echo "Checked out SigmaHQ/sigma at ${SIGMA_CORPUS_SHA}" | |
| - name: Validate and compile all Sigma rules | |
| run: ./target/release/rsigma rule validate /tmp/sigma/rules/ --verbose | |
| - name: Validate SigmaHQ corpus with dynamic pipelines | |
| run: | | |
| ./target/release/rsigma rule validate /tmp/sigma/rules/ \ | |
| --pipeline tests/fixtures/dynamic-pipelines/pipelines/field_mapping.yml \ | |
| --pipeline tests/fixtures/dynamic-pipelines/pipelines/allowlist.yml \ | |
| --pipeline tests/fixtures/dynamic-pipelines/pipelines/multi_format.yml \ | |
| --pipeline tests/fixtures/dynamic-pipelines/pipelines/extract_languages.yml \ | |
| --pipeline tests/fixtures/dynamic-pipelines/pipelines/include_expansion.yml \ | |
| --source tests/fixtures/dynamic-pipelines/source-files/ \ | |
| --resolve-sources --verbose | |
| - name: Golden file comparison for rsigma pipeline resolve | |
| run: | | |
| failed=0 | |
| for pipeline in tests/fixtures/dynamic-pipelines/pipelines/*.yml; do | |
| name=$(basename "$pipeline" .yml) | |
| golden="tests/fixtures/dynamic-pipelines/golden/${name}.json" | |
| source_file="tests/fixtures/dynamic-pipelines/source-files/${name}.yml" | |
| if [ ! -f "$golden" ]; then | |
| echo "SKIP: no golden file for ${name}" | |
| continue | |
| fi | |
| actual=$(./target/release/rsigma pipeline resolve --pipeline "$pipeline" --source-file "$source_file" --pretty) | |
| if ! diff -u "$golden" <(echo "$actual") > /tmp/diff_${name}.txt 2>&1; then | |
| echo "FAIL: ${name} resolve output differs from golden file" | |
| cat /tmp/diff_${name}.txt | |
| failed=1 | |
| else | |
| echo "OK: ${name}" | |
| fi | |
| done | |
| if [ "$failed" -ne 0 ]; then | |
| echo "::error::Golden file comparison failed. Run 'rsigma pipeline resolve' locally and update golden files." | |
| exit 1 | |
| fi | |
| mcp-smoke: | |
| name: MCP Smoke | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust stable | |
| run: | | |
| rustup toolchain install stable --profile minimal --no-self-update | |
| rustup override set stable | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| # Build the CLI with the opt-in `mcp` feature, then drive the | |
| # built binary end to end over both transports. `python3` ships | |
| # on the runner and the harness uses only the standard library. | |
| - name: Build rsigma with the mcp feature | |
| run: cargo build --locked -p rsigma --features mcp | |
| - name: Smoke-test the MCP server (stdio + HTTP) | |
| run: | | |
| python3 scripts/mcp-smoke.py --bin target/debug/rsigma | |
| python3 scripts/mcp-smoke.py --http --bin target/debug/rsigma |