evalbox/.github/workflows/ci.yml at main · fullzer4/evalbox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  nix-checks:
    name: Nix Checks
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: DeterminateSystems/determinate-nix-action@bafaa638b9d5ec0e7e3ac1a7fc80453ef1fd265f # v3
      - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # main
      - name: Run checks (clippy, fmt, test, doc)
        run: nix flake check -L

  # E2E security tests require kernel 6.12+ (Landlock ABI v5).
  # GHA ubuntu-latest currently ships 6.11; image 20260209 has 6.14 but hasn't propagated yet.
  # Uncomment when runners get kernel 6.12+.
  #
  # e2e:
  #   name: E2E (${{ matrix.distro }})
  #   runs-on: ubuntu-latest
  #   needs: nix-checks
  #   permissions:
  #     id-token: write
  #     contents: read
  #   strategy:
  #     fail-fast: false
  #     matrix:
  #       distro: [ubuntu:24.04, fedora:41, alpine:3.21]
  #   steps:
  #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
  #     - uses: DeterminateSystems/determinate-nix-action@bafaa638b9d5ec0e7e3ac1a7fc80453ef1fd265f # v3
  #     - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # main
  #     - name: Build security test binary
  #       run: nix build -L .#security-test-bin
  #     - name: Run security tests in ${{ matrix.distro }}
  #       run: |
  #         TEST_BIN=$(realpath result/bin/security_tests-*)
  #         docker run --rm --privileged \
  #           -v /nix/store:/nix/store:ro \
  #           ${{ matrix.distro }} \
  #           "$TEST_BIN" --ignored --test-threads=1

  cargo-deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: EmbarkStudios/cargo-deny-action@6c8f9facfa5047ec02d8485b6bf52b587b7777d1 # v2

  semver-check:
    name: SemVer Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2
        with:
          package: evalbox