test(identify): cover the protobuf structure-scoring branch #29
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_INCREMENTAL: "0" | |
| jobs: | |
| test: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| # Pin to the same toolchain as rust-toolchain.toml (blob-decoder's app/CLI | |
| # is built and tested with the pinned stable). Do not float `stable`. | |
| - uses: dtolnay/rust-toolchain@1.96.0 | |
| with: | |
| components: clippy, rustfmt | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - run: cargo test --all-features | |
| - run: cargo clippy --all-targets --all-features -- -D warnings | |
| - run: cargo fmt --check | |
| msrv: | |
| # Dedicated MSRV job: the LIBRARY must build on its declared floor (1.88.0, | |
| # forced by plist 1.10 -> time 0.3.53). Builds the lib without default | |
| # features (the downstream-library surface; the CLI's clap is not part of it). | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: dtolnay/rust-toolchain@1.88.0 | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - name: Build library on MSRV (no default features) | |
| run: cargo build --lib --no-default-features | |
| lean-build: | |
| # Gate: a library consumer doing `default-features = false` must NOT pull in | |
| # clap (a CLI-only dep behind the `cli` feature). | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: dtolnay/rust-toolchain@1.96.0 | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - name: Lean lib build (no default features) | |
| run: cargo build --no-default-features | |
| - name: Assert clap absent from the lean tree | |
| run: | | |
| cargo tree --no-default-features -e no-dev --prefix none > /tmp/lean-tree.txt | |
| if grep -qE '^clap ' /tmp/lean-tree.txt; then | |
| echo "FAIL: clap present in the lean (no-default-features) build:" | |
| grep -E '^clap ' /tmp/lean-tree.txt | |
| exit 1 | |
| fi | |
| coverage: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: dtolnay/rust-toolchain@1.96.0 | |
| with: | |
| components: llvm-tools-preview | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - uses: taiki-e/install-action@a402910a723481c4c80d006d75298c796a9c8695 # cargo-llvm-cov | |
| with: | |
| tool: cargo-llvm-cov | |
| # All test targets, all features. The gate requires 100% LINE and function | |
| # coverage of the LIBRARY (ADR-0008), honoring `// cov:unreachable` markers | |
| # on provably-dead defensive arms; main.rs (the Humble CLI shell) is | |
| # excluded by the script. | |
| - name: Coverage + 100% line/function gate | |
| run: | | |
| cargo llvm-cov --all-features --json --output-path cov.json | |
| cargo llvm-cov report --lcov --output-path lcov.info | |
| python3 scripts/coverage-gate.py cov.json lcov.info | |
| - name: Upload to Codecov | |
| uses: codecov/codecov-action@0f8570b1a125f4937846a11fcfa3bcd548bd8c97 # v4.6.0 | |
| with: | |
| files: lcov.info | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| fail_ci_if_error: false | |
| secrets: | |
| name: Secret Scan (gitleaks) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install gitleaks | |
| run: | | |
| VERSION=8.30.1 | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \ | |
| | tar xz -C /tmp gitleaks | |
| - name: Run gitleaks | |
| run: /tmp/gitleaks detect --source . --config .gitleaks.toml | |
| deny: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| - name: Install cargo-deny | |
| uses: taiki-e/install-action@a402910a723481c4c80d006d75298c796a9c8695 | |
| with: | |
| tool: cargo-deny | |
| - name: Check advisories, licenses, bans, sources | |
| run: cargo deny check | |
| freshness: | |
| # Advisory dependency-freshness gate: fails if the committed Cargo.lock is | |
| # stale relative to the requirements (see CLAUDE.md "Dependency Freshness"). | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| - run: cargo update --locked | |
| vet: | |
| name: Cargo Vet (supply-chain) | |
| runs-on: ubuntu-latest | |
| # Complements `deny` (known-bad advisories/licenses) with the supply-chain- | |
| # injection layer: every dependency version must be human-source-reviewed or | |
| # covered by an imported aggregate audit set (Google/Mozilla/Bytecode-Alliance/ | |
| # Embark). Config in supply-chain/{config,audits,imports}.toml. | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: Install cargo-vet | |
| uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6 | |
| with: | |
| tool: cargo-vet | |
| - name: Fetch dependencies | |
| run: cargo fetch | |
| - name: Check supply chain | |
| run: cargo vet --locked |