1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
name: verify
on:
push:
branches:
pull_request:
permissions:
contents: read
# A force-push should not leave the previous run burning a runner.
concurrency:
group: verify-${{ github.ref }}
cancel-in-progress: true
env:
CARGO_TERM_COLOR: always
# Names lead with the verb for what the job does — run, check, build — with
# the varying part in parentheses, matching release. Read in a checks list,
# where anything longer than a glance is wasted.
#
# Unlike release, these are the required status checks on main: renaming one
# means updating branch protection in the same breath, or the rule waits on a
# name nothing produces and every pull request blocks without saying why.
jobs:
# One test in tests/cli.rs runs `omh init`, which builds the base image
# through Docker. It is `#[ignore]`d, so this is the job that opts back in.
test-linux:
name: run tests (linux, with docker)
runs-on: ubuntu-latest
steps:
- name: check out the repo
uses: actions/checkout@v7
- name: restore the cargo cache
uses: Swatinem/rust-cache@v2
- name: run every test
run: cargo test --locked -- --include-ignored
# GitHub's macOS runners have no Docker daemon. This runs the same command a
# contributor runs, and the one Docker test reports itself as ignored rather
# than being excluded by target — so a new integration test is covered here
# by default instead of silently dropping off macOS, and nothing has to
# remember to update a skip list.
test-macos:
name: run tests (macos)
runs-on: macos-latest
steps:
- name: check out the repo
uses: actions/checkout@v7
- name: restore the cargo cache
uses: Swatinem/rust-cache@v2
- name: run every test that does not need a container runtime
run: cargo test --locked
lint:
name: check formatting and lints
runs-on: ubuntu-latest
steps:
- name: check out the repo
uses: actions/checkout@v7
- name: restore the cargo cache
uses: Swatinem/rust-cache@v2
- name: check formatting
run: cargo fmt --check
- name: lint, with warnings as errors
run: cargo clippy --locked --all-targets -- -D warnings
# install.sh runs before omh does, on a machine nobody has checked, and it is
# the only file here that no compiler reads.
installer:
name: check installer (shellcheck and tests)
runs-on: ubuntu-latest
steps:
- name: check out the repo
uses: actions/checkout@v7
- name: restore the cargo cache
uses: Swatinem/rust-cache@v2
- name: shellcheck it
run: shellcheck install.sh scripts/test-install.sh
- name: build the binary the tests package
run: cargo build --locked
- name: exercise every path it can take
run: ./scripts/test-install.sh
# The MSRV in Cargo.toml is a claim about who can build this, and an unchecked
# claim is the thing this repo distrusts most. `build` rather than `check`,
# because the job says "builds" and `cargo check` stops before codegen.
msrv:
name: build (msrv 1.85)
runs-on: ubuntu-latest
env:
# Overrides rust-toolchain.toml, which otherwise pins this job to stable.
RUSTUP_TOOLCHAIN: "1.85"
steps:
- name: check out the repo
uses: actions/checkout@v7
- name: install rust 1.85
uses: dtolnay/rust-toolchain@master
with:
toolchain: "1.85"
- name: restore the cargo cache
uses: Swatinem/rust-cache@v2
- name: build on the floor omh declares
run: cargo build --locked --all-targets