From 698461308a096238c923e7196a1e6b9dae238f57 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Thu, 6 Aug 2026 14:10:16 -0700 Subject: [PATCH 1/2] ci: adopt the fleet reusable workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the hand-maintained per-repo workflow with the shared one. No inputs: this repo already enforced a 100% per-line coverage gate at `--workspace --all-features`, which is the shared workflow's default, and MSRV is read from rust-version. Configuring anything here would be a behaviour change smuggled in by an adoption PR. Every job the old workflow ran is covered — fmt, clippy, test, MSRV, cargo-deny, cargo-vet and the secret scan. Adoption also ADDS checks this repo did not have: a path-dependency gate, a fuzz build-check, and rustdoc with warnings denied. Two fleet-wide defects are retired as a side effect, neither of them fixed here by hand: `cargo fetch` before `--locked` The shared workflow runs `cargo fetch --locked`. A bare `cargo fetch` RE-RESOLVES and rewrites Cargo.lock, so the `--locked` check that follows validates a lockfile the runner just generated — a gate structurally unable to fail. Measured in 62 fleet repos and demonstrated directly: with the committed lock `--locked` fails, and after `cargo fetch` it passes. gitleaks from `releases/latest` Resolved at job time from an unauthenticated GitHub API call, which is rate-limited on shared runners: the version comes back empty and the download 404s. ~1 run in 40 across 25 repos. The shared workflow pins the version. The workflow reference is pinned to a full commit SHA, per the fleet supply-chain rule that CI dependencies are never floating tags. --- .github/workflows/ci.yml | 148 +++------------------------------------ 1 file changed, 11 insertions(+), 137 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 591a263..7645891 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,142 +6,16 @@ on: pull_request: branches: [main] -env: - CARGO_TERM_COLOR: always - RUSTFLAGS: -D warnings +permissions: + contents: read jobs: - fmt: - name: Format - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - with: - components: rustfmt - - run: cargo fmt --check - - clippy: - name: Clippy - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - with: - components: clippy - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo clippy --workspace --all-targets --all-features -- -D warnings - - test: - name: Test (${{ matrix.os }}) - runs-on: ${{ matrix.os }} - strategy: - matrix: - os: [ubuntu-latest, macos-latest, windows-latest] - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo test --workspace --all-features - - msrv: - name: MSRV (1.81) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@1.81 - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo build --workspace - - coverage: - name: Coverage (100% lines) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - with: - components: llvm-tools-preview - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6 - with: - tool: cargo-llvm-cov - # Each executable source line must be hit at least once. - # - # Exception — panic-free defence in depth: a line carrying a - # `// cov:unreachable` marker is unreachable under a dominating invariant, - # kept deliberately to stay panic-free if that invariant is ever broken by - # a future change. Such lines cannot be exercised by any test and are - # exempt. The gate fails on any OTHER zero-hit line. - - name: Generate lcov - run: cargo llvm-cov --workspace --lcov --output-path lcov.info - - name: Enforce line coverage (unreachable defensive arms must carry // cov:unreachable) - shell: bash - run: | - fail=0 - while IFS= read -r line; do - if [[ "$line" == SF:* ]]; then - f="${line#SF:}" - elif [[ "$line" =~ ^DA:([0-9]+),0$ ]]; then - n="${BASH_REMATCH[1]}" - src="$(sed -n "${n}p" "$f")" - if [[ "$src" == *cov:unreachable* ]]; then - echo "exempt (// cov:unreachable): $f:$n" - else - echo "::error::Uncovered line $f:$n:$src" - fail=1 - fi - fi - done < lcov.info - if [[ "$fail" -ne 0 ]]; then exit 1; fi - echo "All executable lines covered, or annotated // cov:unreachable." - - deny: - name: cargo-deny - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2.0.20 - with: - command: check - - docs: - name: Docs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --workspace - - gitleaks: - name: gitleaks - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - fetch-depth: 0 - - name: gitleaks (license-free binary) - run: | - VER=8.21.2 - curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${VER}/gitleaks_${VER}_linux_x64.tar.gz" | tar -xz gitleaks - CFG=""; [ -f .gitleaks.toml ] && CFG="--config .gitleaks.toml" - ./gitleaks detect --source . --redact --no-banner $CFG - - vet: - name: Cargo Vet (supply-chain) - runs-on: ubuntu-latest - # Complements `deny` (known-bad advisories/licenses) with the supply-chain- - # injection layer: every dependency version must be human-source-reviewed or - # covered by an imported aggregate audit set (Google/Mozilla/Bytecode-Alliance/ - # Embark). Config in supply-chain/{config,audits,imports}.toml. - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - - name: Install cargo-vet - uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6 - with: - tool: cargo-vet - - name: Fetch dependencies - run: cargo fetch - - name: Check supply chain - run: cargo vet --locked + # fmt · clippy · test (3 OS) · MSRV · cargo-deny · cargo-vet · secret scan · + # fuzz build-check · rustdoc · 100% per-line coverage · path-dep gate. + # + # No inputs: this repo already enforced a 100% per-line gate at + # `--workspace --all-features`, which is exactly the shared workflow's default, + # and MSRV is read from rust-version. Anything that needed configuring would be + # a behaviour change smuggled in by an adoption PR, so there is nothing here. + ci: + uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@a62ab10603151071744cec0b4e3638aa6406d4e4 From 79d35658dccbc691db63fc1cafe8964ac859eb5d Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Thu, 6 Aug 2026 17:31:37 -0700 Subject: [PATCH 2/2] ci: keep the coverage scope this repo actually gated, not the wider default MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Correcting the adoption commit in this PR. The replaced workflow ran cargo llvm-cov --workspace --lcov --output-path lcov.info and enforced 100% per-line over that scope. It did NOT pass --all-features. The shared workflow defaults that input to true, which compiles feature-gated code this repo has never measured — line coverage falls from 100% to 89.70% on identical source, and the strict gate fails. Two ways to make CI green, and only one of them is an adoption: - widen the scope and lower the gate to a ~89 floor. That changes what CI accepts, in two directions at once, inside a PR whose stated job is to change nothing. - keep the scope as it was and keep the gate strict. What CI accepts is identical before and after. This takes the second. The blind spot is real and worth naming rather than leaving implied: feature-gated code remains unmeasured here, exactly as it was before this PR. Closing it means testing that code and then setting `all-features: true` — a separate change, with its own argument and its own review. --- .github/workflows/ci.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7645891..0c377e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,3 +19,17 @@ jobs: # a behaviour change smuggled in by an adoption PR, so there is nothing here. ci: uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@a62ab10603151071744cec0b4e3638aa6406d4e4 + with: + # CARRIED ACROSS. The replaced gate ran `cargo llvm-cov --workspace --lcov` + # with NO --all-features. The shared default turns it on, compiling + # feature-gated code this repo has never measured: line coverage falls + # 100% -> 89.70% on identical source, and the strict gate then fails. + # + # Keeping the scope as it was preserves exactly what CI accepts. Widening + # the scope AND lowering to a ~89 floor would change both halves at once + # inside a PR whose job is to change nothing. + # + # The blind spot is real and stated rather than implied: feature-gated code + # stays unmeasured here, as before. Closing it means testing that code and + # then setting this true — a separate change with its own argument. + all-features: false