1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
name: CI
# Thin caller over jhheider/rust-ci. lean-embed is a PRIVATE repo, so CI routes
# to the self-hosted arm64 runner (studio-lean-embed). If this repo ever goes
# public, revert to the default hosted 3-OS matrix (drop os/runs-on, add
# `coverage: true`) and remove the gha-runner service.
on:
push:
branches:
paths-ignore:
pull_request:
paths-ignore:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
ci:
uses: jhheider/rust-ci/.github/workflows/ci.yml@v1
with:
os: '["self-hosted"]'
runs-on: self-hosted
secrets: inherit
# The crate's whole reason to exist: enforce the lean-deps commitment so a
# routine `cargo update` can't quietly pull in aws-lc-sys / openssl-sys
# (reqwest's default rustls provider is aws-lc-rs - we keep it out).
lean:
name: Lean deps (no aws-lc / openssl)
runs-on: self-hosted
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- name: Assert no aws-lc-sys / openssl-sys in the dependency tree
run: |
set -euo pipefail
for crate in aws-lc-sys openssl-sys; do
if cargo tree -i "$crate" >/dev/null 2>&1; then
echo "::error::$crate is in the dependency tree - the lean commitment is broken"
cargo tree -i "$crate" || true
exit 1
fi
done
echo "lean: no aws-lc-sys / openssl-sys"