feat(sqlcipher): decrypt SQLCipher pages into the reader's stream #142
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| # Retained for the repo-specific jobs BELOW `ci:` only — a called workflow does | |
| # not inherit the caller's `env:`, so this block governs nothing in `ci:`. The | |
| # old ci.yml ran the coverage/package/geiger jobs under `-D warnings`; dropping | |
| # it here would quietly relax them. | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: -D warnings | |
| jobs: | |
| ci: | |
| uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@f9802dca64a95eb881fd05dd3f4f16e53b97f2b3 | |
| with: | |
| # The old coverage job gated on FUNCTIONS (`--fail-under-functions 100`), | |
| # which no input here can express — a line gate is a different assertion, | |
| # and inheriting the `strict` default would impose a 100%-LINE gate this | |
| # repo has never met (measured 97.02% lines / 100% functions). The original | |
| # job is preserved verbatim below; turning the shared one off keeps it the | |
| # single coverage gate, exactly as before. | |
| coverage-gate: "off" | |
| # --------------------------------------------------------------------------- | |
| # Copied VERBATIM from the pre-adoption ci.yml. Each expresses something the | |
| # shared workflow has no input for. | |
| # --------------------------------------------------------------------------- | |
| coverage: | |
| name: Coverage | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: llvm-tools-preview | |
| - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 | |
| - uses: taiki-e/install-action@v2 # renovate: pin digest | |
| with: | |
| tool: cargo-llvm-cov | |
| # Every function across the libraries AND the CLI binary must be covered. | |
| # Line % reads below 100 where generic code is monomorphized per type — | |
| # the function gate is the meaningful invariant. | |
| - run: cargo llvm-cov --all-features --fail-under-functions 100 --show-missing-lines | |
| # crates.io only gates description + license fields, not the README/LICENSE | |
| # files — assert every publishable crate actually packages both. | |
| package: | |
| name: Package completeness | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: README + LICENSE packaged in every published crate | |
| run: | | |
| set -euo pipefail | |
| pkgs=$(cargo metadata --no-deps --format-version 1 \ | |
| | python3 -c "import sys,json;[print(p['name']) for p in json.load(sys.stdin)['packages'] if p.get('publish') != []]") | |
| for p in $pkgs; do | |
| list=$(cargo package -p "$p" --list) | |
| echo "$list" | grep -qx 'README.md' || { echo "::error::$p does not package README.md"; exit 1; } | |
| echo "$list" | grep -q '^LICENSE' || { echo "::error::$p does not package a LICENSE file"; exit 1; } | |
| echo "✓ $p packages README.md + LICENSE" | |
| done | |
| geiger: | |
| name: Unsafe Audit (cargo-geiger) | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 | |
| - run: cargo install cargo-geiger --locked | |
| - run: cargo geiger 2>&1 || true |