Skip to content

Commit 949fefa

Browse files
AbeeujahAbeeujah
committed
Configure GitHub Actions CI
- Add GitHub Actions workflows for audit, code coverage, and continuous integration - Add dependabot for automated dependency updates - Add zizmor security configuration - Add CI helper scripts for MSRV pinning and core node startup - Add justfile for task automation - Add pull request template
1 parent d384cf2 commit 949fefa

File tree

10 files changed

+380
-0
lines changed

10 files changed

+380
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Set update schedule for GitHub Actions
2+
version: 2
3+
updates:
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"

‎.github/pull_request_template.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<!-- You can erase any parts of this template not applicable to your Pull Request. -->
2+
3+
### Description
4+
5+
<!-- Describe the purpose of this PR, what's being adding and/or fixed -->
6+
7+
### Notes to the reviewers
8+
9+
<!-- In this section you can include notes directed to the reviewers, like explaining why some parts
10+
of the PR were done in a specific way -->
11+
12+
### Changelog notice
13+
14+
<!-- Notice the release manager should include in the release tag message changelog -->
15+
<!-- See https://keepachangelog.com/en/1.0.0/ for examples -->
16+
17+
### Checklists
18+
19+
#### All Submissions:
20+
21+
* [ ] I've signed all my commits
22+
* [ ] I followed the [contribution guidelines](https://github.com/bitcoindevkit/bdk/blob/master/CONTRIBUTING.md)
23+
* [ ] I ran `just p` before pushing
24+
25+
#### New Features:
26+
27+
* [ ] I've added tests for the new feature
28+
* [ ] I've added docs for the new feature
29+
30+
#### Bugfixes:
31+
32+
* [ ] This pull request breaks the existing API
33+
* [ ] I've added tests to reproduce the issue which are now passing
34+
* [ ] I'm linking the issue being fixed by this PR

‎.github/workflows/audit.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Audit
2+
3+
# Performs a security audit of Rust dependencies using cargo-audit through the actions-rust-lang/audit action.
4+
# Runs nightly on schedule and when Cargo.toml, Cargo.lock, or audit.toml files are modified.
5+
# Helps identify known security vulnerabilities in the dependency tree.
6+
7+
on:
8+
push:
9+
paths:
10+
# Run if workflow changes
11+
- ".github/workflows/audit.yml"
12+
# Run on changed dependencies
13+
- "**/Cargo.toml"
14+
- "**/Cargo.lock"
15+
# Run if the configuration file changes
16+
- "**/audit.toml"
17+
# Rerun periodically
18+
schedule:
19+
- cron: "0 0 * * *" # Nightly
20+
# Run manually
21+
workflow_dispatch:
22+
23+
jobs:
24+
audit:
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: read
28+
issues: write
29+
steps:
30+
- name: Checkout
31+
uses: actions/checkout@v6
32+
with:
33+
persist-credentials: false
34+
- uses: actions-rust-lang/audit@v1
35+
name: Audit Rust Dependencies

‎.github/workflows/code_coverage.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: Code Coverage
2+
3+
# Generates code coverage reports using cargo-llvm-cov and uploads results to Codecov.
4+
# Runs on every push and pull request to track test coverage metrics.
5+
# Uploads coverage reports to Codecov for visualization and analysis.
6+
7+
on: [push, pull_request]
8+
9+
permissions:
10+
contents: read
11+
pull-requests: write
12+
13+
jobs:
14+
coverage:
15+
name: Code Coverage
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v6
21+
with:
22+
persist-credentials: false
23+
- name: Install Rust toolchain
24+
uses: actions-rust-lang/setup-rust-toolchain@v1
25+
with:
26+
toolchain: nightly
27+
components: llvm-tools-preview
28+
cache: true
29+
- name: Install cargo-llvm-cov
30+
run: cargo install cargo-llvm-cov
31+
- name: Generate coverage data
32+
run: cargo llvm-cov --all-features --branch --quiet --ignore-filename-regex "test_utils" --lcov --output-path lcov.info
33+
env:
34+
RUSTFLAGS: "--cfg coverage_nightly"
35+
- name: Generate HTML coverage report
36+
run: cargo llvm-cov --all-features --branch --quiet --ignore-filename-regex "test_utils" --html
37+
env:
38+
RUSTFLAGS: "--cfg coverage_nightly"
39+
- name: Codecov upload
40+
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de
41+
with:
42+
files: ./lcov.info
43+
flags: rust
44+
name: codecov-bdk-electrum-streaming-client
45+
token: ${{ secrets.CODECOV_TOKEN }}
46+
fail_ci_if_error: false
47+
- name: Upload artifact
48+
uses: actions/upload-artifact@v4
49+
with:
50+
name: coverage-report
51+
path: target/llvm-cov/html

‎.github/workflows/cont_integration.yml‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
on: [push, pull_request]
2+
3+
# Main continuous integration workflow that runs build, test, and code quality checks.
4+
# Runs on every push and pull request, testing against both MSRV (1.85) and stable Rust.
5+
# # Includes no_std and WASM compatibility checks, formatting validation, and clippy linting.
6+
7+
name: CI
8+
9+
permissions: {}
10+
11+
env:
12+
CARGO_TERM_COLOR: always
13+
14+
jobs:
15+
build-test-msrv:
16+
name: Build & Test MSRV
17+
runs-on: ${{ matrix.os }}
18+
strategy:
19+
matrix:
20+
os:
21+
- ubuntu-latest
22+
- ubuntu-24.04-arm
23+
features:
24+
- --no-default-features --features tokio
25+
- --all-features
26+
exclude:
27+
# electrsd does not provide ARM binaries, so integration tests fail on ARM
28+
- os: ubuntu-24.04-arm
29+
features: --all-features
30+
steps:
31+
- name: Checkout
32+
uses: actions/checkout@v6
33+
with:
34+
persist-credentials: false
35+
# The 'toolchain' argument on this action overrides the Rust compiler version set in rust-toolchain.toml
36+
# in order to test our MSRV.
37+
- name: Install Rust toolchain
38+
uses: actions-rust-lang/setup-rust-toolchain@v1
39+
with:
40+
toolchain: 1.85 # MSRV
41+
cache: true
42+
- name: Pin dependencies for MSRV
43+
run: ./ci/pin-msrv.sh
44+
- name: Build + Test
45+
run: |
46+
cargo build --workspace --all-targets ${{ matrix.features }}
47+
cargo test --workspace ${{ matrix.features }}
48+
49+
build-test-stable:
50+
name: Build & Test Rust Stable
51+
runs-on: ${{ matrix.os }}
52+
strategy:
53+
matrix:
54+
os:
55+
- ubuntu-latest
56+
- ubuntu-24.04-arm
57+
features:
58+
- --no-default-features --features tokio
59+
- --all-features
60+
exclude:
61+
# electrsd does not provide ARM binaries, so integration tests fail on ARM
62+
- os: ubuntu-24.04-arm
63+
features: --all-features
64+
steps:
65+
- name: Checkout
66+
uses: actions/checkout@v6
67+
with:
68+
persist-credentials: false
69+
- name: Install Rust toolchain
70+
uses: actions-rust-lang/setup-rust-toolchain@v1
71+
with:
72+
cache: true
73+
- name: Build + Test
74+
run: |
75+
cargo build --workspace --all-targets ${{ matrix.features }}
76+
cargo test --workspace ${{ matrix.features }}
77+
78+
check-no-std:
79+
name: Check no_std
80+
runs-on: ubuntu-latest
81+
steps:
82+
- name: Checkout
83+
uses: actions/checkout@v6
84+
with:
85+
persist-credentials: false
86+
- name: Install Rust toolchain
87+
uses: actions-rust-lang/setup-rust-toolchain@v1
88+
with:
89+
cache: true
90+
- name: Check no-std
91+
run: cargo check --workspace --all-targets --no-default-features --features tokio
92+
93+
check-wasm:
94+
name: Check WASM
95+
runs-on: ubuntu-latest
96+
env:
97+
CC: clang-14
98+
CFLAGS: -I/usr/include
99+
steps:
100+
- name: Checkout
101+
uses: actions/checkout@v6
102+
with:
103+
persist-credentials: false
104+
- run: wget -qO - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add - || exit 1
105+
- run: sudo apt-get update || true
106+
- run: sudo apt-get install -y libclang-common-14-dev clang-14 libc6-dev-i386 || exit 1
107+
- name: Install Rust toolchain
108+
uses: actions-rust-lang/setup-rust-toolchain@v1
109+
with:
110+
cache: true
111+
target: wasm32-unknown-unknown
112+
- name: Check-WASM
113+
run: |
114+
rustup target add wasm32-unknown-unknown
115+
cargo check --workspace --no-default-features --target wasm32-unknown-unknown
116+
117+
fmt:
118+
name: Rust fmt
119+
runs-on: ubuntu-latest
120+
steps:
121+
- name: Checkout
122+
uses: actions/checkout@v6
123+
with:
124+
persist-credentials: false
125+
- name: Install Rust toolchain
126+
uses: actions-rust-lang/setup-rust-toolchain@v1
127+
with:
128+
cache: true
129+
- name: Check fmt
130+
run: cargo fmt --all -- --check
131+
132+
clippy_check:
133+
name: Rust Clippy
134+
runs-on: ubuntu-latest
135+
permissions:
136+
checks: write
137+
steps:
138+
- name: Checkout
139+
uses: actions/checkout@v6
140+
with:
141+
persist-credentials: false
142+
- name: Install Rust toolchain
143+
uses: actions-rust-lang/setup-rust-toolchain@v1
144+
with:
145+
cache: true
146+
- name: Check Clippy
147+
run: cargo clippy --workspace --all-targets -- -D warnings

‎.github/workflows/zizmor.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Zizmor Actions Analysis
2+
3+
# Analyzes Github Actions workflows for security vulnerabilities using zizmor.
4+
# Runs on pushes to master and all pull requests to detect potential security issues
5+
# in workflow configurations. Results are uploaded as a GitHub's security dashboard.
6+
# The .github/zizmor.yml configures the rules this action will check against.
7+
8+
on:
9+
push:
10+
branches: ["master"]
11+
pull_request:
12+
branches: ["master"]
13+
14+
jobs:
15+
zizmor:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
security-events: write
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@v6
22+
with:
23+
persist-credentials: false
24+
25+
- name: Rust Cache
26+
uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5
27+
28+
- name: Install zizmor
29+
run: cargo install zizmor --locked --version 1.6.0
30+
31+
- name: Run zizmor 🌈
32+
run: zizmor --format sarif . > results.sarif
33+
env:
34+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
35+
36+
- name: Upload SARIF file
37+
uses: github/codeql-action/upload-sarif@v4
38+
with:
39+
sarif_file: results.sarif
40+
category: zizmor

‎.github/zizmor.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
rules:
2+
unpinned-uses:
3+
config:
4+
policies:
5+
actions-rust-lang/setup-rust-toolchain: ref-pin
6+
github/codeql-action/*: ref-pin
7+
actions/*: ref-pin

‎ci/pin-msrv.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
3+
set -x
4+
set -euo pipefail
5+
6+
# Pin dependencies for MSRV
7+
8+
# To pin deps, switch toolchain to MSRV and execute the below updates
9+
10+
# cargo clean
11+
# rustup override set 1.85.0
12+
13+
# e.g cargo update -p home --precise "0.5.11"

‎ci/start-core.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/usr/bin/env sh
2+
3+
echo "Starting bitcoin node."
4+
mkdir $GITHUB_WORKSPACE/.bitcoin
5+
/root/bitcoind -regtest -server -daemon -datadir=$GITHUB_WORKSPACE/.bitcoin -fallbackfee=0.0002 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0 -blockfilterindex=1 -peerblockfilters=1
6+
7+
echo "Waiting for bitcoin node."
8+
until /root/bitcoin-cli -regtest -datadir=$GITHUB_WORKSPACE/.bitcoin getblockchaininfo; do
9+
sleep 1
10+
done
11+
/root/bitcoin-cli -regtest -datadir=$GITHUB_WORKSPACE/.bitcoin createwallet $BDK_RPC_WALLET
12+
echo "Generating 150 bitcoin blocks."
13+
ADDR=$(/root/bitcoin-cli -regtest -datadir=$GITHUB_WORKSPACE/.bitcoin -rpcwallet=$BDK_RPC_WALLET getnewaddress)
14+
/root/bitcoin-cli -regtest -datadir=$GITHUB_WORKSPACE/.bitcoin generatetoaddress 150 $ADDR

‎justfile‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
alias b := build
2+
alias c := check
3+
alias f := fmt
4+
alias t := test
5+
alias p := pre-push
6+
7+
_default:
8+
@just --list
9+
10+
# Build the project
11+
build:
12+
cargo build
13+
14+
# Check code: formatting, compilation, linting, and commit signature
15+
check:
16+
cargo +nightly fmt --all -- --check
17+
cargo check --all-features --all-targets
18+
cargo clippy --all-features --all-targets -- -D warnings
19+
@[ "$(git log --pretty='format:%G?' -1 HEAD)" = "N" ] && \
20+
echo "\n⚠️ Unsigned commit: BDK requires that commits be signed." || \
21+
true
22+
23+
# Format all code
24+
fmt:
25+
cargo +nightly fmt
26+
27+
# Run all tests on the workspace with all features
28+
test:
29+
cargo test --all-features
30+
31+
# Run pre-push suite: format, check, and test
32+
pre-push: fmt check test

0 commit comments

Comments
 (0)