chore(security): gitleaks allowlist for synthetic test fixtures #171
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI pipeline for CLX — Rust workspace with 4 crates. | |
| # | |
| # Jobs: | |
| # check — Format + lint validation (fast gate, runs on ubuntu only) | |
| # test — Run full test suite (matrix: ubuntu + macos) | |
| # build — Compile release binaries (matrix: ubuntu + macos) | |
| # coverage — Measure line coverage with cargo-llvm-cov; fails if < 70% | |
| # Also verifies no unreviewed insta snapshots are present. | |
| # audit — Check dependencies for known vulnerabilities (ubuntu only) | |
| # | |
| # Caching: Swatinem/rust-cache caches ~/.cargo/registry, ~/.cargo/git, | |
| # and the target directory keyed on Cargo.lock + OS + toolchain. | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| # Ensure incremental compilation is disabled in CI for reproducible builds. | |
| CARGO_INCREMENTAL: 0 | |
| # Fail on any rustc warning that slips past clippy. | |
| RUSTFLAGS: "-D warnings" | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # check: fast validation — fmt + clippy | |
| # Runs on a single host (ubuntu) because style checks are platform-neutral. | |
| # --------------------------------------------------------------------------- | |
| check: | |
| name: Check (fmt + clippy) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install Rust stable (with rustfmt + clippy components) | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt, clippy | |
| - name: Cache Cargo registry and build artifacts | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Check formatting | |
| run: cargo fmt --all -- --check | |
| # -D warnings turns every clippy warning into an error. | |
| # The workspace Cargo.toml already sets clippy::pedantic + unsafe_code = "deny", | |
| # so this enforces those rules unconditionally. | |
| - name: Run Clippy | |
| run: cargo clippy --workspace --all-targets --all-features -- -D warnings | |
| # --------------------------------------------------------------------------- | |
| # test: run the full test suite on both Linux and macOS | |
| # --------------------------------------------------------------------------- | |
| test: | |
| name: Test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| needs: check | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache Cargo registry and build artifacts | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Run tests | |
| run: cargo test --workspace | |
| # --------------------------------------------------------------------------- | |
| # build: compile release binaries to verify the workspace builds cleanly | |
| # on both target platforms. | |
| # --------------------------------------------------------------------------- | |
| build: | |
| name: Build release (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| needs: check | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache Cargo registry and build artifacts | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Build release binaries | |
| run: cargo build --release --workspace | |
| # --------------------------------------------------------------------------- | |
| # coverage: measure line coverage with cargo-llvm-cov on macOS to match | |
| # the primary dev environment. Fails the build if line coverage drops | |
| # below 80%. Also verifies that no unreviewed insta snapshots exist. | |
| # | |
| # Two cargo-llvm-cov invocations are used intentionally: | |
| # 1. Generate the LCOV report for artifact upload. | |
| # 2. Re-run with --fail-under-lines to enforce the threshold as a hard | |
| # gate. A single invocation with both flags is not supported by all | |
| # versions of cargo-llvm-cov, so two passes keep this explicit. | |
| # --------------------------------------------------------------------------- | |
| coverage: | |
| name: Coverage (macOS) | |
| runs-on: macos-latest | |
| needs: check | |
| # Job-level cap. Without this, a hung instrumented test (we hit one in | |
| # PR #20: 6h5m) burns billable CI minutes. 30 min is ~6x historical | |
| # green-run wall time; genuine slowdowns still pass. | |
| timeout-minutes: 30 | |
| # Coverage is informational, not a merge gate. Decoupling it from the | |
| # PR check rollup means a single instrumentation flake does not block | |
| # user-facing fixes from merging. | |
| continue-on-error: true | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache Cargo registry and build artifacts | |
| uses: Swatinem/rust-cache@v2 | |
| # taiki-e/install-action provides a fast, pre-built install of | |
| # cargo-llvm-cov without a full `cargo install` compile step. | |
| - name: Install cargo-llvm-cov | |
| uses: taiki-e/install-action@cargo-llvm-cov | |
| # Install cargo-insta to run the snapshot check step below. | |
| - name: Install cargo-insta | |
| uses: taiki-e/install-action@cargo-insta | |
| # Verify that every insta snapshot has been reviewed (i.e. committed). | |
| # --check causes `cargo insta test` to fail if any snapshot is pending | |
| # review, preventing unreviewed snapshots from landing in main. | |
| - name: Check insta snapshots are reviewed | |
| run: cargo insta test --workspace --check | |
| # Generate the LCOV report. --all-features ensures every code path | |
| # gated behind a feature flag is included in the measurement. | |
| # Step-level timeout: hangs fail in 20 min, not 6h. | |
| - name: Generate LCOV coverage report | |
| timeout-minutes: 20 | |
| run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info | |
| # Hard gate: fail the job if line coverage is below 70%. | |
| # Threshold is 70% rather than 80% because the dashboard event loop | |
| # (event.rs, mod.rs) and complex UI render code (settings/render.rs) | |
| # are inherently untestable in CI (terminal I/O, crossterm events). | |
| - name: Enforce 70% line coverage threshold | |
| timeout-minutes: 5 | |
| run: cargo llvm-cov --all-features --workspace --fail-under-lines 70 | |
| # Upload lcov.info so it can be inspected in the Actions UI or fed | |
| # to a coverage viewer without re-running the full build. | |
| - name: Upload LCOV report artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: lcov-report | |
| path: lcov.info | |
| if-no-files-found: error | |
| retention-days: 7 | |
| # --------------------------------------------------------------------------- | |
| # audit: check dependencies for known vulnerabilities and policy violations | |
| # Runs on ubuntu only — advisory database is platform-neutral. | |
| # Gates: cargo-audit (RustSec advisories), cargo-deny (policy/licenses/sources) | |
| # --------------------------------------------------------------------------- | |
| audit: | |
| name: Audit dependencies | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache Cargo registry and build artifacts | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Install cargo-audit and cargo-deny | |
| run: cargo install cargo-audit cargo-deny --quiet | |
| - name: Run cargo audit (RustSec advisories) | |
| run: cargo audit | |
| - name: "Run cargo deny (policy, licenses, sources, bans)" | |
| run: cargo deny check |