name: CI
on:
push:
branches: [main]
pull_request:
env:
CARGO_TERM_COLOR: always
jobs:
msrv:
runs-on: macos-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - run: rustup toolchain install 1.88.0 --profile minimal
- run: cargo +1.88.0 check --locked
rust:
runs-on: macos-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - name: Verify private maintenance docs stay untracked
run: |
for path in AGENTS.md CLAUDE.md docs/AUDIT.md docs/ISSUES.md; do
if git ls-files --error-unmatch "$path" >/dev/null 2>&1; then
echo "$path is private maintenance material and must not be tracked" >&2
exit 1
fi
done
if [ -n "$(git ls-files docs/internal)" ]; then
echo "docs/internal is private maintenance material and must not be tracked" >&2
exit 1
fi
if git grep -nE '(issue +#[0-9]+|audit finding|finding +#[0-9]+)' -- '*.rs'; then
echo "tracked source must not expose private tracker references" >&2
exit 1
fi
if git log -1 --pretty=%s | grep -Eq '(#[0-9]+|audit finding)'; then
echo "commit subject exposes private tracker metadata" >&2
exit 1
fi
- run: rustup toolchain install stable --profile minimal --component rustfmt,clippy
- run: cargo fmt -- --check
- run: cargo clippy --locked --all-targets --all-features -- -D warnings
- run: cargo test --locked
- run: cargo package --locked
- name: Audit Rust dependencies
uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 with:
token: ${{ secrets.GITHUB_TOKEN }}