diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 591a263..0c377e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,142 +6,30 @@ on: pull_request: branches: [main] -env: - CARGO_TERM_COLOR: always - RUSTFLAGS: -D warnings +permissions: + contents: read jobs: - fmt: - name: Format - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - with: - components: rustfmt - - run: cargo fmt --check - - clippy: - name: Clippy - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - with: - components: clippy - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo clippy --workspace --all-targets --all-features -- -D warnings - - test: - name: Test (${{ matrix.os }}) - runs-on: ${{ matrix.os }} - strategy: - matrix: - os: [ubuntu-latest, macos-latest, windows-latest] - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo test --workspace --all-features - - msrv: - name: MSRV (1.81) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@1.81 - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo build --workspace - - coverage: - name: Coverage (100% lines) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - with: - components: llvm-tools-preview - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6 - with: - tool: cargo-llvm-cov - # Each executable source line must be hit at least once. + # fmt · clippy · test (3 OS) · MSRV · cargo-deny · cargo-vet · secret scan · + # fuzz build-check · rustdoc · 100% per-line coverage · path-dep gate. + # + # No inputs: this repo already enforced a 100% per-line gate at + # `--workspace --all-features`, which is exactly the shared workflow's default, + # and MSRV is read from rust-version. Anything that needed configuring would be + # a behaviour change smuggled in by an adoption PR, so there is nothing here. + ci: + uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@a62ab10603151071744cec0b4e3638aa6406d4e4 + with: + # CARRIED ACROSS. The replaced gate ran `cargo llvm-cov --workspace --lcov` + # with NO --all-features. The shared default turns it on, compiling + # feature-gated code this repo has never measured: line coverage falls + # 100% -> 89.70% on identical source, and the strict gate then fails. # - # Exception — panic-free defence in depth: a line carrying a - # `// cov:unreachable` marker is unreachable under a dominating invariant, - # kept deliberately to stay panic-free if that invariant is ever broken by - # a future change. Such lines cannot be exercised by any test and are - # exempt. The gate fails on any OTHER zero-hit line. - - name: Generate lcov - run: cargo llvm-cov --workspace --lcov --output-path lcov.info - - name: Enforce line coverage (unreachable defensive arms must carry // cov:unreachable) - shell: bash - run: | - fail=0 - while IFS= read -r line; do - if [[ "$line" == SF:* ]]; then - f="${line#SF:}" - elif [[ "$line" =~ ^DA:([0-9]+),0$ ]]; then - n="${BASH_REMATCH[1]}" - src="$(sed -n "${n}p" "$f")" - if [[ "$src" == *cov:unreachable* ]]; then - echo "exempt (// cov:unreachable): $f:$n" - else - echo "::error::Uncovered line $f:$n:$src" - fail=1 - fi - fi - done < lcov.info - if [[ "$fail" -ne 0 ]]; then exit 1; fi - echo "All executable lines covered, or annotated // cov:unreachable." - - deny: - name: cargo-deny - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2.0.20 - with: - command: check - - docs: - name: Docs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --workspace - - gitleaks: - name: gitleaks - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - fetch-depth: 0 - - name: gitleaks (license-free binary) - run: | - VER=8.21.2 - curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${VER}/gitleaks_${VER}_linux_x64.tar.gz" | tar -xz gitleaks - CFG=""; [ -f .gitleaks.toml ] && CFG="--config .gitleaks.toml" - ./gitleaks detect --source . --redact --no-banner $CFG - - vet: - name: Cargo Vet (supply-chain) - runs-on: ubuntu-latest - # Complements `deny` (known-bad advisories/licenses) with the supply-chain- - # injection layer: every dependency version must be human-source-reviewed or - # covered by an imported aggregate audit set (Google/Mozilla/Bytecode-Alliance/ - # Embark). Config in supply-chain/{config,audits,imports}.toml. - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - - name: Install cargo-vet - uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6 - with: - tool: cargo-vet - - name: Fetch dependencies - run: cargo fetch - - name: Check supply chain - run: cargo vet --locked + # Keeping the scope as it was preserves exactly what CI accepts. Widening + # the scope AND lowering to a ~89 floor would change both halves at once + # inside a PR whose job is to change nothing. + # + # The blind spot is real and stated rather than implied: feature-gated code + # stays unmeasured here, as before. Closing it means testing that code and + # then setting this true — a separate change with its own argument. + all-features: false