compose-lens 0.1.17

Loss-aware parsing, processing, validation, and rendering of Compose projects
Documentation
name: CI

on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  rust:
    name: Rust quality
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - &checkout
        name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install configured Rust toolchain
        run: rustup show active-toolchain
      - name: Check formatting
        run: cargo fmt --all -- --check
      - name: Check all targets
        run: cargo ci-check
      - name: Check repository policies
        run: cargo ci-policy
      - name: Run Clippy
        run: cargo ci-clippy
      - name: Run tests
        run: cargo ci-test
      - name: Run documentation tests
        run: cargo ci-doctest
      - name: Build documentation
        env:
          RUSTDOCFLAGS: -D warnings
        run: cargo ci-doc
      - name: Verify release package
        run: cargo ci-package

  coverage:
    name: Coverage ratchet
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - *checkout
      - name: Install LLVM coverage tools
        run: rustup component add llvm-tools-preview
      - name: Install pinned cargo-llvm-cov
        run: cargo install --locked --version 0.8.7 cargo-llvm-cov
      - name: Measure and enforce coarse coverage ratchet
        run: >-
          cargo llvm-cov --locked --workspace --all-features --all-targets --summary-only
          --fail-under-regions 88 --fail-under-functions 87 --fail-under-lines 89

  msrv:
    name: MSRV
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - *checkout
      - name: Read the workspace MSRV
        id: metadata
        shell: bash
        run: |
          msrv="$(
            cargo metadata --locked --no-deps --format-version 1 |
              jq -er '[.packages[].rust_version] | unique | if length == 1 and .[0] != null then .[0] else error("workspace packages must declare one common rust-version") end'
          )"
          printf 'msrv=%s\n' "$msrv" >> "$GITHUB_OUTPUT"
      - name: Install minimum supported Rust
        env:
          RUST_MSRV: ${{ steps.metadata.outputs.msrv }}
        run: rustup toolchain install "${RUST_MSRV}" --profile minimal
      - name: Check all targets with the MSRV
        env:
          RUST_MSRV: ${{ steps.metadata.outputs.msrv }}
        run: cargo "+${RUST_MSRV}" ci-check
      - name: Check repository policies with the MSRV
        env:
          RUST_MSRV: ${{ steps.metadata.outputs.msrv }}
        run: cargo "+${RUST_MSRV}" ci-policy

  dependencies:
    name: Dependency and license policy
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - *checkout
      - name: Audit dependencies, licenses, bans, and sources
        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
        with:
          command: check
          arguments: --all-features

  api:
    name: Public API compatibility
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - *checkout
      - name: Compare with the latest published release
        uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2.9
        with:
          package: compose-lens
          release-type: patch

  documentation:
    name: Repository files and documentation
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - *checkout
      - name: Install pinned Node.js toolchain
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.18.1
          cache: npm
          cache-dependency-path: package-lock.json
      - name: Install locked Node file-quality tools
        run: |
          npm ci --ignore-scripts
          printf '%s\n' "${GITHUB_WORKSPACE}/node_modules/.bin" >> "${GITHUB_PATH}"
      - name: Install checksum-pinned native file-quality tools
        run: sudo bash scripts/install-file-tools.sh /usr/local/bin
      - name: Check non-Rust file formatting and lint
        run: bash scripts/check-files.sh --check
      - name: Check local documentation links without network access
        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
        with:
          args: >-
            --config lychee.toml --root-dir '${{ github.workspace }}' --offline
            './**/*.md'
          fail: true
          token: ${{ secrets.GITHUB_TOKEN }}