1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
name: CI
on:
push:
pull_request:
permissions:
contents: read
concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true
jobs:
lint-and-test:
name: lint-and-test
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
persist-credentials: false
- name: resolve toolchain
id: rust
run: echo "channel=$(sed -n 's/^channel = \"\(.*\)\"/\1/p' rust-toolchain.toml)" >> "$GITHUB_OUTPUT"
- uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master @ 2026-06-30
with:
toolchain: ${{ steps.rust.outputs.channel }}
components: rustfmt, clippy
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
- name: fmt check
run: cargo fmt --all -- --check
- name: clippy
run: cargo clippy --all-targets --all-features -- -D warnings
- name: test
run: cargo test --locked --all-features
docker-build-and-smoke:
name: docker-build-and-smoke
runs-on: ubuntu-latest
timeout-minutes: 25
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
persist-credentials: false
- name: resolve toolchain
id: rust
run: echo "channel=$(sed -n 's/^channel = \"\(.*\)\"/\1/p' rust-toolchain.toml)" >> "$GITHUB_OUTPUT"
- uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master @ 2026-06-30
with:
toolchain: ${{ steps.rust.outputs.channel }}
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
- name: build the cli binary
run: cargo build --release --features cli
- name: stage the binary for Dockerfile.dist
run: |
mkdir -p dist/linux/amd64
cp target/release/baseplate dist/linux/amd64/baseplate
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
- name: build the release image (single-arch) and smoke it network-free
run: |
docker buildx build --platform linux/amd64 -f Dockerfile.dist --load -t baseplate:ci .
# a real invocable op returns an ok envelope with the expected classification
out="$(echo '{"paths":["src/test/java/x/FooTest.java"]}' | docker run --rm -i --network none baseplate:ci java-test analyze)"
echo "$out"
echo "$out" | grep -q '"is_java_test":true'
# bad input must surface the error sentinel (ADR-0052), not a false clean pass
err="$(echo 'nope' | docker run --rm -i --network none baseplate:ci patterns match || true)"
echo "$err" | grep -q '"status":"error"'