1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
name: Rust
# No pull request trigger: the gate is the one an author runs locally before
# asking for review, and a tick that arrives unasked is a tick people stop
# reading. Master is different. The publish job below is gated on
# `github.event_name == 'push'` and reads `github.event.before` to diff
# Cargo.toml, so a push to master is the release mechanism and removing it
# silently stops releases rather than making anything manual.
on:
push:
branches:
workflow_dispatch:
env:
CARGO_TERM_COLOR: always
jobs:
test:
runs-on: ubicloud-standard-8
permissions:
contents: read
steps:
- name: Checkout code
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
with:
cache-on-failure: "true"
- name: Install Rust
uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
with:
toolchain: stable
- name: Test supported feature boundaries
run: |
cargo test --no-default-features
cargo test
cargo test --no-default-features --features agent-control
cargo test --no-default-features --features ws-client
cargo test --no-default-features --features ws
cargo test --no-default-features --features full
cargo test --all-features
# The list above is hand-written, so it only covers the sets somebody
# thought to add. `signal` and `log_reader` were absent from it and did not
# compile on their own for the whole life of the feature table. This step
# reads the features out of Cargo.toml instead, so a feature added tomorrow
# is covered tomorrow. It runs inside `test`, which `publish` already needs,
# so a feature that does not build standalone blocks the release.
- name: Every feature compiles standalone
run: ./scripts/check-features.sh
clippy_check:
runs-on: ubicloud-standard-8
permissions:
contents: read
steps:
- name: Checkout code
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
with:
cache-on-failure: "true"
- name: Install Rust
uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
with:
toolchain: stable
components: clippy
- name: Lint supported feature boundaries
run: |
cargo clippy --all-targets --no-default-features -- -D warnings
cargo clippy --all-targets -- -D warnings
cargo clippy --all-targets --no-default-features --features agent-control -- -D warnings
cargo clippy --all-targets --no-default-features --features ws-client -- -D warnings
cargo clippy --all-targets --no-default-features --features ws -- -D warnings
cargo clippy --all-targets --no-default-features --features full -- -D warnings
cargo clippy --all-targets --all-features -- -D warnings
format_check:
runs-on: ubicloud-standard-8
permissions:
contents: read
steps:
- name: Checkout code
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
with:
cache-on-failure: "true"
- name: Install Rust
uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
with:
toolchain: stable
components: rustfmt
- name: Check formatting
run: cargo fmt --all -- --check
security_audit:
runs-on: ubicloud-standard-2
permissions:
contents: read
# audit-check reports its findings as a check run; without this the
# report API call fails with "Resource not accessible by integration"
# and the job errors even when no vulnerabilities are found.
checks: write
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- name: Resolve current compatible dependencies for audit
run: cargo generate-lockfile
- uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}