name: CI
on:
push:
pull_request:
workflow_dispatch:
permissions:
contents: read
concurrency:
group: ci-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
CARGO_TERM_COLOR: always
jobs:
rust:
name: Rust quality
runs-on: ubuntu-24.04
timeout-minutes: 30
steps:
- &checkout
name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with:
persist-credentials: false
- name: Install configured Rust toolchain
run: rustup show active-toolchain
- name: Check formatting
run: cargo fmt --all -- --check
- name: Check all targets
run: cargo ci-check
- name: Check repository policies
run: cargo ci-policy
- name: Run Clippy
run: cargo ci-clippy
- name: Run tests
run: cargo ci-test
- name: Run documentation tests
run: cargo ci-doctest
- name: Build documentation
env:
RUSTDOCFLAGS: -D warnings
run: cargo ci-doc
- name: Verify release package
run: cargo ci-package
coverage:
name: Coverage ratchet
runs-on: ubuntu-24.04
timeout-minutes: 30
steps:
- *checkout
- name: Install LLVM coverage tools
run: rustup component add llvm-tools-preview
- name: Install pinned cargo-llvm-cov
run: cargo install --locked --version 0.8.7 cargo-llvm-cov
- name: Measure and enforce coarse coverage ratchet
run: >-
cargo llvm-cov --locked --workspace --all-features --all-targets --summary-only
--fail-under-regions 88 --fail-under-functions 87 --fail-under-lines 89
msrv:
name: MSRV
runs-on: ubuntu-24.04
timeout-minutes: 20
steps:
- *checkout
- name: Read the workspace MSRV
id: metadata
shell: bash
run: |
msrv="$(
cargo metadata --locked --no-deps --format-version 1 |
jq -er '[.packages[].rust_version] | unique | if length == 1 and .[0] != null then .[0] else error("workspace packages must declare one common rust-version") end'
)"
printf 'msrv=%s\n' "$msrv" >> "$GITHUB_OUTPUT"
- name: Install minimum supported Rust
env:
RUST_MSRV: ${{ steps.metadata.outputs.msrv }}
run: rustup toolchain install "${RUST_MSRV}" --profile minimal
- name: Check all targets with the MSRV
env:
RUST_MSRV: ${{ steps.metadata.outputs.msrv }}
run: cargo "+${RUST_MSRV}" ci-check
- name: Check repository policies with the MSRV
env:
RUST_MSRV: ${{ steps.metadata.outputs.msrv }}
run: cargo "+${RUST_MSRV}" ci-policy
dependencies:
name: Dependency and license policy
runs-on: ubuntu-24.04
timeout-minutes: 15
steps:
- *checkout
- name: Audit dependencies, licenses, bans, and sources
uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 with:
command: check
arguments: --all-features
api:
name: Public API compatibility
runs-on: ubuntu-24.04
timeout-minutes: 20
steps:
- *checkout
- name: Compare with the latest published release
uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 with:
package: compose-lens
release-type: patch
documentation:
name: Repository files and documentation
runs-on: ubuntu-24.04
timeout-minutes: 15
steps:
- *checkout
- name: Install pinned Node.js toolchain
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 with:
node-version: 24.18.1
cache: npm
cache-dependency-path: package-lock.json
- name: Install locked Node file-quality tools
run: |
npm ci --ignore-scripts
printf '%s\n' "${GITHUB_WORKSPACE}/node_modules/.bin" >> "${GITHUB_PATH}"
- name: Install checksum-pinned native file-quality tools
run: sudo bash scripts/install-file-tools.sh /usr/local/bin
- name: Check non-Rust file formatting and lint
run: bash scripts/check-files.sh --check
- name: Check local documentation links without network access
uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 with:
args: >-
--config lychee.toml --root-dir '${{ github.workspace }}' --offline
'./**/*.md'
fail: true
token: ${{ secrets.GITHUB_TOKEN }}