1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
name: CI
on:
push:
branches:
pull_request:
branches:
workflow_dispatch:
env:
CARGO_TERM_COLOR: always
RUST_BACKTRACE: 1
jobs:
test:
name: Test (${{ matrix.os }}, ${{ matrix.rust }})
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
# Pinned macos-14 instead of macos-latest: the current
# macos-latest image (aliased to macos-15) has a broken
# `rustup` -- it's actually the `rustup-init` bootstrap
# stub, which intercepts `cargo clippy` invocations
# (rustup-init treats `clippy` as an unknown CLI arg and
# exits 1). macos-13 was the first attempt but had bad
# runner availability. macos-14 is the latest pin that
# both works and has decent capacity. Revisit when GitHub
# fixes the macos-latest image.
os:
rust:
exclude:
- os: macos-14
rust: beta
- os: windows-latest
rust: beta
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@master
with:
toolchain: ${{ matrix.rust }}
components: rustfmt, clippy
- uses: swatinem/rust-cache@v2
with:
shared-key: "${{ matrix.os }}-${{ matrix.rust }}"
- name: Check formatting
if: matrix.rust == 'stable' && matrix.os == 'ubuntu-latest'
run: cargo fmt --all -- --check
- name: Clippy
if: matrix.rust == 'stable'
run: cargo clippy --all-targets --all-features -- -D warnings
- name: Build
run: cargo build --all-features
- name: Build without default features
run: cargo build --no-default-features
- name: Unit tests
run: cargo test --lib --all-features
- name: Unit tests without default features
run: cargo test --lib --no-default-features
- name: Integration tests (fake-binary)
# tests/fake-claude.sh is a bash script and cannot run on
# Windows; gate this step to the Unix runners. integration.rs
# is entirely #[ignore] (real binary + auth), so `--test '*'`
# without `--ignored` runs only the fake-binary suites.
if: matrix.os != 'windows-latest'
run: cargo test --test '*' --all-features
- name: Doc tests
run: cargo test --doc --all-features
contract:
name: CLI contract (claude ${{ matrix.claude_version }})
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
# Both ends of the range declared in src/version.rs as
# TESTED_CLI_VERSION_MIN / MAX. A unit test cross-checks that these
# match, so bumping a constant without adding it here fails the build.
#
# The floor is measured, not assumed: this suite bisected it. 2.1.97
# lacks --exclude-dynamic-system-prompt-sections (part of the hermetic
# seal) and 2.1.98 has it, which was the last flag to land of the set
# the builders emit.
claude_version:
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- uses: swatinem/rust-cache@v2
with:
shared-key: "contract"
- uses: actions/setup-node@v7
with:
node-version: "22"
- name: Install claude CLI
# 2.1.999 is a placeholder upper bound, not a real release; resolve it
# to whatever is currently published so the ceiling is exercised
# against something that exists.
run: |
version="${{ matrix.claude_version }}"
if [ "$version" = "2.1.999" ]; then
npm install -g @anthropic-ai/claude-code@latest
else
npm install -g "@anthropic-ai/claude-code@$version"
fi
claude --version
- name: Contract suite
# No auth and no tokens: every check reads `--help` only.
run: cargo test --test contract --all-features -- --ignored
security:
name: Security audit
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: rustsec/audit-check@v2.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
msrv:
name: MSRV check
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@master
with:
toolchain: "1.90.0"
- uses: swatinem/rust-cache@v2
with:
shared-key: "msrv"
- name: Check MSRV
run: cargo check --all-features
docs:
name: Documentation
runs-on: ubuntu-latest
env:
RUSTDOCFLAGS: -D warnings
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- uses: swatinem/rust-cache@v2
with:
shared-key: "docs"
- name: Build docs
run: cargo doc --no-deps --all-features