1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
# CI — lint, build, and test Lattice on every push.
#
# Runs on GitHub-hosted `ubuntu-latest` inside the ghcr.io/twowells/rust-ci
# image, which bakes in rustup + the pinned toolchain + cc/make/git/pkg-config,
# so the job needs nothing provisioned on the runner itself.
#
# There is intentionally NO `pull_request` trigger. Fork PRs fire only
# pull_request events (their push happened in the fork), so push/
# workflow_dispatch-only triggers mean a fork PR never schedules a job here.
# If you later want CI for outside contributors' PRs, add a SEPARATE workflow
# with `on: pull_request` (also `ubuntu-latest`, free on public repos).
name: CI
on:
push:
workflow_dispatch:
# A new push to the same ref cancels the in-flight run.
concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true
jobs:
check:
runs-on: ubuntu-latest
# The hosted runner has no pinned Rust. This image bakes in rustup + the
# pinned toolchain + cc/make/git, so the job doesn't reprovision every run.
container: ghcr.io/twowells/rust-ci:latest
# Inside a container job GitHub's default shell is sh (dash); force bash so
# run steps don't silently break on a bashism.
defaults:
run:
shell: bash
steps:
- uses: actions/checkout@v6
# rustup reads rust-toolchain.toml (channel 1.95 + rustfmt/clippy) and
# installs the pinned toolchain if the runner doesn't have it yet.
- name: Materialize pinned Rust toolchain
run: |
rustup show
rustc --version && cargo --version
# Caches the registry, git deps, and target dir keyed on Cargo.lock so the
# ephemeral pods don't rebuild the world every push (cache lives GitHub-side).
- uses: Swatinem/rust-cache@v2
# Prebuilt binaries — far faster than `cargo install` from source on an
# ephemeral runner with no warm cache.
- name: Install cargo tools
uses: taiki-e/install-action@v2
with:
tool: cargo-nextest,cargo-deny,cargo-machete
# The project's single source of truth for "passing": fmt, clippy
# (-D warnings), deny, machete, and the nextest suite. See the Makefile.
- name: make check
run: make check