From bb8ca4b5e0d65de05ae1fd4ae75caa3d5da19cf8 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 26 May 2026 10:30:52 +0100 Subject: [PATCH 1/2] ci(rust): convert rust-ci.yml to thin wrapper (standards#174) Replaces the per-repo `rust-ci.yml` copy with a 5-line wrapper invoking the shared reusable workflow in `hyperpolymath/standards` (PR #174). Pinned to PR #174's HEAD SHA `4fdf4314b4ab54269adbaff10e30e483b5e86845`; will resolve to standards/main once #174 merges. Estate audit found ~87 rust-ci.yml copies across the estate; this is one of them. The reusable provides identical cargo check/clippy/fmt/test behaviour with opt-in `enable_audit` + `enable_coverage` inputs. Pattern precedent: standards#168 (governance-reusable) + downstream wrappers absolute-zero#41 + tma-mark2#41. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/rust-ci.yml | 105 +++++----------------------------- 1 file changed, 14 insertions(+), 91 deletions(-) diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 7c765f5..7f0b7f8 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,97 +1,20 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 +# Rust CI — thin wrapper calling the shared estate reusable in +# hyperpolymath/standards. Configure once, propagate everywhere. +# See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards. name: Rust CI -on: [push, pull_request] + +on: + push: + branches: [main, master] + pull_request: permissions: contents: read -env: - CARGO_TERM_COLOR: always - # IMPORTANT: do NOT set RUSTFLAGS=-Dwarnings at workflow-env level. That - # promotes warnings in *dependency* code to errors, which breaks the build - # non-deterministically as upstream crates emit deprecations. Use - # `cargo clippy -- -D warnings` below, which is scoped to this workspace. - jobs: - test: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Install Rust toolchain - # Install via official rustup script directly. This avoids any - # dependency on third-party setup actions whose SHA pins may - # drift; rustup.rs is the canonical install path. - run: | - set -eux - curl --proto '=https' --tlsv1.2 -sSfL https://sh.rustup.rs \ - | sh -s -- -y --default-toolchain stable --profile minimal \ - --component rustfmt,clippy - echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" - - - name: Print toolchain - run: | - rustc --version - cargo --version - rustfmt --version - cargo clippy --version - - - name: Check formatting - run: cargo fmt --all -- --check - - - name: Clippy lints (workspace, errors only on our code) - run: cargo clippy --workspace --all-targets --all-features -- -D warnings - - - name: Run tests - run: cargo test --workspace --all-features --no-fail-fast - - - name: Build release - run: cargo build --workspace --release - - security: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Install Rust toolchain - run: | - set -eux - curl --proto '=https' --tlsv1.2 -sSfL https://sh.rustup.rs \ - | sh -s -- -y --default-toolchain stable --profile minimal - echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" - - - name: Install cargo-audit (locked) - run: cargo install --locked cargo-audit - - - name: Security audit (advisories) - # cargo audit fails on any RUSTSEC advisory. Yanked-crate notes are - # informational warnings and do not fail without `--deny warnings`. - run: cargo audit - - coverage: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Install Rust toolchain (with llvm-tools-preview) - run: | - set -eux - curl --proto '=https' --tlsv1.2 -sSfL https://sh.rustup.rs \ - | sh -s -- -y --default-toolchain stable --profile minimal \ - --component llvm-tools-preview - echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" - - - name: Install cargo-llvm-cov (locked) - # cargo-llvm-cov uses Rust's native coverage instrumentation — - # faster and more reliable than tarpaulin (which depends on a - # kernel module that breaks under Ubuntu kernel updates). - run: cargo install --locked cargo-llvm-cov - - - name: Generate coverage (lcov) - run: cargo llvm-cov --workspace --all-features --lcov --output-path lcov.info - - - name: Upload to codecov (best-effort) - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1 - with: - files: lcov.info - continue-on-error: true + rust-ci: + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@4fdf4314b4ab54269adbaff10e30e483b5e86845 + with: + enable_audit: true + enable_coverage: true From 1a57544f9f58dfac24ada8d8fe32fcc29801b0f4 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 26 May 2026 13:39:17 +0100 Subject: [PATCH 2/2] ci(sweep): codeql actions matrix - Replace codeql.yml `javascript-typescript` matrix entry with `actions` (repo has no JS/TS source). Matches the canonical fix in rsr-template-repo#71 / mtpc#8 / thunderbird#75. --- .github/workflows/codeql.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index abaa6bd..ab01691 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,7 +30,10 @@ jobs: fail-fast: false matrix: include: - - language: javascript-typescript + # Repo source is not JS/TS; scan workflow files via the + # actions extractor (every repo has those). See hypatia rule + # codeql_language_matrix_mismatch. + - language: actions build-mode: none steps: