shepherd/.github/workflows/ci.yml at main · SecurityRonin/shepherd · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-Dwarnings"

jobs:
  fmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203 # stable
        with:
          toolchain: stable
          components: rustfmt
      - run: cargo fmt --all -- --check

  typos:
    name: Spell check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: crate-ci/typos@0d9ef485e3e6a76abe10723491e7b73a2c0c4002 # v1.29.5

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203 # stable
        with:
          toolchain: stable
          components: clippy
      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: clippy-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: clippy-${{ runner.os }}-
      - run: cargo clippy --workspace --all-targets -- -D warnings

  deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: EmbarkStudios/cargo-deny-action@34899fc7ba81ca6268d5947a7a16b4649013fea1 # v2.0.11
        with:
          command: check advisories licenses sources

  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203 # stable
        with:
          toolchain: stable
      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: test-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: test-${{ runner.os }}-
      - run: cargo test --workspace

  frontend:
    name: Frontend (lint + test + build)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - run: npx tsc --noEmit
      - run: npx vitest run
      - run: npx playwright install --with-deps chromium
      - run: npx playwright test

  # Ensure the Tauri app compiles (without bundling)
  tauri-build:
    name: Tauri build check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203 # stable
        with:
          toolchain: stable
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - name: Install system dependencies (Linux)
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
      - run: npm run build
      - run: cargo build --manifest-path src-tauri/Cargo.toml

  no-todo:
    name: No TODO/FIXME in source
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Check for TODO/FIXME comments
        run: |
          # Search source code (excluding tests and generated files)
          FOUND=$(grep -rn "TODO\|FIXME\|HACK\|XXX" \
            --include="*.rs" --include="*.ts" --include="*.tsx" \
            crates/*/src/ src/ src-tauri/src/ \
            | grep -v "_test\\.rs" \
            | grep -v "tests/" \
            | grep -v "__tests__" \
            | grep -v "test/" || true)
          if [ -n "$FOUND" ]; then
            echo "::error::Found TODO/FIXME/HACK comments in source code:"
            echo "$FOUND"
            exit 1
          fi
          echo "No TODO/FIXME/HACK found in source code."

  changelog:
    name: Changelog (git-cliff)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - uses: orhun/git-cliff-action@4a7e37c33500d51d40a25a067e6a66a2ad9e54e2 # v4.4.2
        with:
          args: --config cliff.toml --dry-run

  coverage:
    name: Code Coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203 # stable
        with:
          toolchain: stable
      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: coverage-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: coverage-${{ runner.os }}-
      - name: Install cargo-tarpaulin
        run: cargo install cargo-tarpaulin
      - name: Run coverage
        run: cargo tarpaulin --workspace --out xml --output-dir coverage/
      - uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
        with:
          files: coverage/cobertura.xml
          fail_ci_if_error: false