Skip to content

Commit 634d7af

Browse files
frawarefraware
committed
Modernize CI, tooling, and documentation
Made-with: Cursor
1 parent 90d1b3a commit 634d7af

54 files changed

Lines changed: 5946 additions & 2451 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.cargo/config.toml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Workspace-local Cargo config. Keep builds reproducible: avoid global target-cpu=native here.
2+
3+
[target.wasm32-wasi]
4+
# Add linker flags here if your platform needs them for WASM builds.
5+
6+
[target.wasm32-unknown-unknown]

‎.github/dependabot.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "cargo"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
- package-ecosystem: "github-actions"
8+
directory: "/"
9+
schedule:
10+
interval: "weekly"
11+
- package-ecosystem: "pip"
12+
directory: "/"
13+
schedule:
14+
interval: "weekly"
15+
16+
- package-ecosystem: "npm"
17+
directory: "/bindings/node"
18+
schedule:
19+
interval: "weekly"

‎.github/pull_request_template.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
## Summary
2+
3+
<!-- What does this PR change and why? -->
4+
5+
## How tested
6+
7+
- [ ] `cargo fmt`, `cargo clippy -D warnings`, `cargo test` (if Rust changed)
8+
- [ ] `cargo deny check` / `cargo audit` (if dependencies or lockfiles changed)
9+
- [ ] `lake build` and `lake exe test_rbac`, `test_tenant`, `test_attest` (if Lean changed)
10+
- [ ] `ruff check`, `pytest tests/` (if Python changed)
11+
12+
## Checklist
13+
14+
- [ ] No secrets or credentials committed
15+
- [ ] [TRACEABILITY.md](../TRACEABILITY.md) updated if formal spec ↔ code mapping changed
16+
- [ ] [docs/README.md](../docs/README.md) or [README.md](../README.md) updated if user-facing workflows or layout changed materially

‎.github/workflows/ci-bindings-go.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Go bindings
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
pull_request:
7+
branches: [main]
8+
9+
jobs:
10+
go:
11+
runs-on: ubuntu-latest
12+
defaults:
13+
run:
14+
working-directory: bindings/go
15+
steps:
16+
- uses: actions/checkout@v4
17+
18+
- uses: actions/setup-go@v5
19+
with:
20+
go-version: "1.22"
21+
22+
- name: Vet
23+
run: go vet ./...
24+
25+
- name: Test (no CGO)
26+
env:
27+
CGO_ENABLED: "0"
28+
run: go test ./... -short

‎.github/workflows/ci-bindings-node.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Node bindings (Rust crate)
2+
3+
# Neon npm CLI is version-sensitive; CI validates the native crate until the JS toolchain is fully wired.
4+
5+
on:
6+
push:
7+
branches: [main, develop]
8+
paths:
9+
- "bindings/node/**"
10+
- "engine/**"
11+
- "Cargo.toml"
12+
- "Cargo.lock"
13+
pull_request:
14+
branches: [main]
15+
paths:
16+
- "bindings/node/**"
17+
- "engine/**"
18+
19+
env:
20+
CARGO_TERM_COLOR: always
21+
22+
jobs:
23+
check:
24+
runs-on: ubuntu-latest
25+
steps:
26+
- uses: actions/checkout@v4
27+
28+
- uses: dtolnay/rust-toolchain@stable
29+
with:
30+
toolchain: 1.88.0
31+
32+
- uses: Swatinem/rust-cache@v2
33+
with:
34+
workspaces: ". -> target"
35+
36+
- name: cargo check (policyengine-node)
37+
run: cargo check --manifest-path bindings/node/Cargo.toml

‎.github/workflows/ci-bindings-python.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Python bindings (PyO3)
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
paths:
7+
- "bindings/python/**"
8+
- "engine/**"
9+
- "Cargo.toml"
10+
- "Cargo.lock"
11+
pull_request:
12+
branches: [main]
13+
paths:
14+
- "bindings/python/**"
15+
- "engine/**"
16+
17+
env:
18+
CARGO_TERM_COLOR: always
19+
20+
jobs:
21+
check:
22+
runs-on: ubuntu-latest
23+
steps:
24+
- uses: actions/checkout@v4
25+
26+
- uses: dtolnay/rust-toolchain@stable
27+
with:
28+
toolchain: 1.88.0
29+
30+
- uses: Swatinem/rust-cache@v2
31+
with:
32+
workspaces: ". -> target"
33+
34+
- name: cargo check (policyengine-python)
35+
run: cargo check --manifest-path bindings/python/Cargo.toml

‎.github/workflows/ci-lean.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Lean CI
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
pull_request:
7+
branches: [main]
8+
9+
concurrency:
10+
group: lean-ci-${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: true
12+
13+
jobs:
14+
lean:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: actions/checkout@v4
18+
19+
- name: Install Elan
20+
run: |
21+
curl https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh -sSf | sh -s -- -y
22+
echo "$HOME/.elan/bin" >> $GITHUB_PATH
23+
24+
- name: Lake build
25+
run: lake build
26+
27+
- name: Executable smoke tests
28+
run: |
29+
lake exe test_rbac
30+
lake exe test_tenant
31+
lake exe test_attest

‎.github/workflows/ci-python.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Python CI
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
pull_request:
7+
branches: [main]
8+
9+
concurrency:
10+
group: python-ci-${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: true
12+
13+
jobs:
14+
python:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: actions/checkout@v4
18+
19+
- uses: actions/setup-python@v5
20+
with:
21+
python-version: "3.12"
22+
23+
- name: Install project (dev)
24+
run: pip install -e ".[dev]"
25+
26+
- name: Ruff check
27+
run: ruff check bundle scripts tests
28+
29+
- name: Mypy (strict modules)
30+
run: mypy bundle/validate_manifest.py tests
31+
32+
- name: Pytest
33+
run: pytest tests -v

‎.github/workflows/ci-rust.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: Rust CI
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
pull_request:
7+
branches: [main]
8+
9+
concurrency:
10+
group: rust-ci-${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: true
12+
13+
env:
14+
CARGO_TERM_COLOR: always
15+
16+
jobs:
17+
rust:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- uses: actions/checkout@v4
21+
22+
- uses: dtolnay/rust-toolchain@stable
23+
with:
24+
toolchain: 1.88.0
25+
components: rustfmt, clippy
26+
27+
- uses: Swatinem/rust-cache@v2
28+
with:
29+
workspaces: ". -> target"
30+
31+
- name: Format
32+
run: cargo fmt --all -- --check
33+
34+
- name: Clippy
35+
run: cargo clippy --workspace --all-targets -- -D warnings
36+
37+
- name: Install cargo-audit and cargo-deny
38+
run: cargo install cargo-audit cargo-deny --locked
39+
40+
- name: cargo deny (licenses / bans)
41+
run: cargo deny check
42+
43+
- name: cargo audit (RustSec)
44+
run: cargo audit
45+
46+
- name: Test
47+
run: cargo test --workspace --verbose
48+
49+
- name: Build release binaries
50+
run: cargo build --workspace --bins --release
51+
52+
wasm-smoke:
53+
runs-on: ubuntu-latest
54+
steps:
55+
- uses: actions/checkout@v4
56+
57+
- uses: dtolnay/rust-toolchain@stable
58+
with:
59+
toolchain: 1.88.0
60+
targets: wasm32-wasi
61+
62+
- uses: Swatinem/rust-cache@v2
63+
64+
- name: Build WASM (smoke)
65+
run: cargo build -p policyengine --target wasm32-wasi --release

‎.github/workflows/ci-sbom.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: SBOM
2+
3+
on:
4+
push:
5+
branches: [main]
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
syft:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@v4
16+
17+
- uses: anchore/sbom-action@v0
18+
with:
19+
path: .
20+
format: cyclonedx-json
21+
artifact-name: sbom-cyclonedx-json

0 commit comments

Comments
 (0)