Skip to content

Commit bee45b1

Browse files
epageepage
committed
chore(ci): Improve coverage
1 parent 9d79c97 commit bee45b1

4 files changed

Lines changed: 168 additions & 29 deletions

File tree

‎.github/workflows/audit.yml‎

Lines changed: 79 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,87 @@
1-
name: Security audit
1+
name: Audit
2+
3+
permissions:
4+
contents: read
5+
26
on:
37
pull_request:
4-
paths:
5-
- '**/Cargo.toml'
6-
- '**/Cargo.lock'
78
push:
8-
paths:
9-
- '**/Cargo.toml'
10-
- '**/Cargo.lock'
11-
schedule:
12-
- cron: '12 12 12 * *'
9+
branches:
10+
- main
11+
12+
env:
13+
RUST_BACKTRACE: 1
14+
CARGO_TERM_COLOR: always
15+
CLICOLOR: 1
16+
17+
concurrency:
18+
group: "${{ github.workflow }}-${{ github.ref }}"
19+
cancel-in-progress: true
20+
1321
jobs:
14-
security_audit:
22+
audit:
23+
permissions:
24+
contents: none
25+
name: Audit
26+
needs: [advisories, cargo_deny, actions]
1527
runs-on: ubuntu-latest
28+
if: "always()"
29+
steps:
30+
- name: Failed
31+
run: exit 1
32+
if: "contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')"
33+
advisories:
34+
permissions:
35+
issues: write # to create issues (actions-rs/audit-check)
36+
checks: write # to create check (actions-rs/audit-check)
37+
runs-on: ubuntu-latest
38+
# Prevent sudden announcement of a new advisory from failing ci:
39+
continue-on-error: true
40+
strategy:
41+
matrix:
42+
checks:
43+
- advisories
44+
steps:
45+
- name: Checkout repository
46+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
47+
with:
48+
persist-credentials: false
49+
- name: Lint advisories
50+
uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
51+
with:
52+
command: check ${{ matrix.checks }}
53+
rust-version: stable
54+
55+
cargo_deny:
56+
permissions:
57+
issues: write # to create issues (actions-rs/audit-check)
58+
checks: write # to create check (actions-rs/audit-check)
59+
runs-on: ubuntu-latest
60+
strategy:
61+
matrix:
62+
checks:
63+
- bans licenses sources
64+
steps:
65+
- name: Checkout repository
66+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
67+
with:
68+
persist-credentials: false
69+
- name: Lint bans
70+
uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
71+
with:
72+
command: check ${{ matrix.checks }}
73+
rust-version: stable
74+
75+
actions:
76+
runs-on: ubuntu-latest
77+
permissions:
78+
security-events: write
79+
contents: read # only needed for private or internal repos
80+
actions: read # only needed for private or internal repos
1681
steps:
1782
- name: Checkout repository
18-
uses: actions/checkout@v6
19-
- uses: actions-rs/audit-check@v1
83+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2084
with:
21-
token: ${{ secrets.GITHUB_TOKEN }}
85+
persist-credentials: false
86+
- name: Run zizmor
87+
uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2

‎.github/workflows/ci.yml‎

Lines changed: 68 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,88 @@
1-
name: ci
1+
name: CI
2+
3+
permissions:
4+
contents: read
5+
26
on:
37
pull_request:
4-
paths:
5-
- '**'
6-
- '!*.md'
7-
- "!/LICENSE"
88
push:
99
branches:
1010
- master
11-
paths:
12-
- '**'
13-
- '!*.md'
14-
- "!/LICENSE"
11+
12+
env:
13+
RUST_BACKTRACE: 1
14+
CARGO_TERM_COLOR: always
15+
CLICOLOR: 1
16+
17+
concurrency:
18+
group: "${{ github.workflow }}-${{ github.ref }}"
19+
cancel-in-progress: true
20+
1521
jobs:
22+
ci:
23+
permissions:
24+
contents: none
25+
name: CI
26+
needs: [test, lockfile, rustfmt]
27+
runs-on: ubuntu-latest
28+
if: "always()"
29+
steps:
30+
- name: Failed
31+
run: exit 1
32+
if: "contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')"
1633
test:
1734
name: Test
1835
strategy:
1936
matrix:
2037
os: ["ubuntu-latest"]
2138
rust: ["stable"]
39+
continue-on-error: ${{ matrix.rust != 'stable' }}
2240
runs-on: ${{ matrix.os }}
41+
env:
42+
# Reduce amount of data cached
43+
CARGO_PROFILE_DEV_DEBUG: line-tables-only
2344
steps:
2445
- name: Checkout repository
25-
uses: actions/checkout@v6
46+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
47+
with:
48+
persist-credentials: false
2649
- name: Install Rust
27-
uses: actions-rs/toolchain@v1
50+
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
2851
with:
2952
toolchain: ${{ matrix.rust }}
30-
profile: minimal
31-
override: true
32-
- uses: Swatinem/rust-cache@v2
53+
- name: Initialize cache
54+
uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
3355
- name: Default features
3456
run: cargo test --workspace
57+
lockfile:
58+
runs-on: ubuntu-latest
59+
steps:
60+
- name: Checkout repository
61+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
62+
with:
63+
persist-credentials: false
64+
- name: Install Rust
65+
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
66+
with:
67+
toolchain: stable
68+
- name: Initialize cache
69+
uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
70+
- name: "Is lockfile updated?"
71+
run: cargo update --workspace --locked
72+
rustfmt:
73+
name: rustfmt
74+
runs-on: ubuntu-latest
75+
steps:
76+
- name: Checkout repository
77+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
78+
with:
79+
persist-credentials: false
80+
- name: Install Rust
81+
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
82+
with:
83+
toolchain: "1.95" # STABLE
84+
components: rustfmt
85+
- name: Initialize cache
86+
uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
87+
- name: Check formatting
88+
run: cargo fmt --check

‎.github/workflows/spelling.yml‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,27 @@
11
name: Spelling
2+
3+
permissions:
4+
contents: read
5+
26
on: [pull_request]
37

8+
env:
9+
RUST_BACKTRACE: 1
10+
CARGO_TERM_COLOR: always
11+
CLICOLOR: 1
12+
13+
concurrency:
14+
group: "${{ github.workflow }}-${{ github.ref }}"
15+
cancel-in-progress: true
16+
417
jobs:
518
spelling:
619
name: Spell Check with Typos
720
runs-on: ubuntu-latest
821
steps:
922
- name: Checkout Actions Repository
10-
uses: actions/checkout@v6
23+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
24+
with:
25+
persist-credentials: false
1126
- name: Spell Check Repo
12-
uses: crate-ci/typos@master
27+
uses: crate-ci/typos@8f11c0dc0f31c780c45b3dd5b72ff4b48a350b75 # master

‎.github/zizmor.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
rules:
2+
superfluous-actions:
3+
# https://github.com/zizmorcore/zizmor/issues/1817
4+
disable: true

0 commit comments

Comments
 (0)