1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
on:
push:
branches:
- main
pull_request:
types:
- opened
- reopened
- synchronize
schedule:
- cron: '0 0 * * *'
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
name: Static checks
permissions:
contents: read
jobs:
# Detect if only docs changed - skip CI if so
changes:
name: Detect changes
runs-on: ubuntu-latest
outputs:
code: ${{ steps.filter.outputs.code }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
filters: |
code:
- '**/*.rs'
- '**/*.toml'
- '**/*.lock'
- 'Cargo.lock'
- '.cargo/**'
# Run unit and integration tests
test:
name: cargo test
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false
- name: Install pinned Rust toolchain
uses: ./.github/actions/rust-toolchain
- run: cargo test --locked --all-features
# Check code formatting against Rust style guidelines
formatting:
name: cargo fmt
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false
- name: Install pinned Rust toolchain
uses: ./.github/actions/rust-toolchain
with:
components: rustfmt
- run: cargo fmt --all -- --check
# Lint for common mistakes and style issues
linting:
name: cargo clippy
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false
- name: Install pinned Rust toolchain
uses: ./.github/actions/rust-toolchain
with:
components: clippy
- run: cargo clippy --locked --all-targets --all-features -- -D warnings
# Check dependencies for known security vulnerabilities
security:
name: cargo audit
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false
- name: Install pinned Rust toolchain
uses: ./.github/actions/rust-toolchain
- run: cargo install cargo-audit --locked
- run: cargo audit
# Verify licenses, check for banned dependencies, and audit sources
deny:
name: cargo deny
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false
- name: Install pinned Rust toolchain
uses: ./.github/actions/rust-toolchain
- run: cargo install cargo-deny --locked
- run: cargo deny check
# Detect unused dependencies in Cargo.toml
unused-deps:
name: cargo udeps
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false
- name: Install Rust nightly
# WHY toolchain input: a SHA-pinned ref no longer selects the channel
uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master (2026-06-30)
with:
toolchain: nightly
# +nightly: a bare cargo would resolve to the rust-toolchain.toml pin
- run: cargo +nightly install cargo-udeps --locked
# udeps needs nightly-only -Z flags
- run: cargo +nightly udeps --locked --all-features
# Analyze binary size and identify largest functions
bloat:
name: cargo bloat
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false
- name: Install pinned Rust toolchain
uses: ./.github/actions/rust-toolchain
- run: cargo install cargo-bloat --locked
- run: cargo bloat --release --all-features -n 20
# Detect undefined behavior in unsafe code using Miri interpreter
miri:
name: cargo miri
timeout-minutes: 30
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false
- name: Install Rust nightly
# WHY toolchain input: a SHA-pinned ref no longer selects the channel
uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master (2026-06-30)
with:
toolchain: nightly
components: miri
# +nightly outranks rust-toolchain.toml; miri only exists on nightly.
# -Zmiri-disable-isolation: tests touch the real filesystem. Blocking:
# the suite passes under miri (root-only FFI tests self-skip).
- run: cargo +nightly miri test --locked
env:
MIRIFLAGS: -Zmiri-disable-isolation