chore: prepare release #229
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| static-analysis: | |
| name: Static Analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| # In audit mode: logs unauthorized egress without blocking; promote to | |
| # `egress-policy: block` once a stable allowlist emerges from runs. | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Setup | |
| uses: ./.github/actions/setup | |
| - name: Check formatting | |
| run: mise run fmt:check | |
| - name: Lint markdown | |
| run: mise run lint:md | |
| - name: Check Rust formatting | |
| run: mise run cargo:fmt:check | |
| - name: Clippy | |
| run: mise run cargo:clippy | |
| - name: Type check | |
| run: mise run cargo:check | |
| - name: Schema drift check | |
| run: mise run schema:check | |
| # Parses knope.toml + verifies workflow references resolve, so | |
| # schema drift (typo'd fields, wrong `dependency` strings, broken | |
| # `scopes` arrays) surfaces on the PR rather than crashing the | |
| # next push-to-main mid-job. | |
| - name: Validate knope.toml | |
| run: knope --validate | |
| tests: | |
| name: Tests (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| steps: | |
| # In audit mode: logs unauthorized egress without blocking; promote to | |
| # `egress-policy: block` once a stable allowlist emerges from runs. | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Setup | |
| uses: ./.github/actions/setup | |
| - name: Run tests | |
| run: mise run cargo:test | |
| - name: Run doc tests | |
| run: mise run cargo:test:doc | |
| msrv: | |
| name: MSRV | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| # In audit mode: logs unauthorized egress without blocking; promote to | |
| # `egress-policy: block` once a stable allowlist emerges from runs. | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| # Pin to Cargo.toml's declared MSRV so the `rust-version` field | |
| # can't silently drift past what pinned-toolchain users have. | |
| - name: Extract MSRV from Cargo.toml | |
| id: msrv | |
| run: | | |
| version="$(grep '^rust-version' Cargo.toml | sed 's/.*= *"\(.*\)"/\1/')" | |
| if [ -z "$version" ]; then | |
| echo "::error::no rust-version found in Cargo.toml" | |
| exit 1 | |
| fi | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| - name: Setup Rust ${{ steps.msrv.outputs.version }} | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| with: | |
| toolchain: ${{ steps.msrv.outputs.version }} | |
| - name: Cache cargo | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - name: MSRV check | |
| run: cargo check --locked --workspace --all-targets | |
| ci-summary: | |
| name: CI Summary | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| if: always() | |
| needs: [static-analysis, tests, msrv] | |
| steps: | |
| # In audit mode: logs unauthorized egress without blocking; promote to | |
| # `egress-policy: block` once a stable allowlist emerges from runs. | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0 | |
| with: | |
| egress-policy: audit | |
| - name: Summarize results | |
| run: | | |
| { | |
| echo "## CI Summary" | |
| echo "" | |
| echo "| Job | Status | Required |" | |
| echo "| --- | --- | --- |" | |
| echo "| Static analysis | \`${{ needs.static-analysis.result }}\` | Yes |" | |
| echo "| Tests (3-OS matrix) | \`${{ needs.tests.result }}\` (per-cell status in Actions UI) | Yes |" | |
| echo "| MSRV | \`${{ needs.msrv.result }}\` | Yes |" | |
| echo "" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| fail_unless_success() { | |
| if [ "$2" != "success" ]; then | |
| echo "Job '$1' did not succeed (result: $2)" | |
| exit 1 | |
| fi | |
| } | |
| fail_unless_success "static-analysis" "${{ needs.static-analysis.result }}" | |
| fail_unless_success "tests" "${{ needs.tests.result }}" | |
| fail_unless_success "msrv" "${{ needs.msrv.result }}" |