1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
name: CI
on:
push:
branches:
pull_request:
branches:
env:
CARGO_TERM_COLOR: always
RUSTFLAGS: "-D warnings"
jobs:
test:
name: Test (${{ matrix.os }} / ${{ matrix.rust }})
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os:
rust:
steps:
- uses: actions/checkout@v5
- uses: dtolnay/rust-toolchain@master
with:
toolchain: ${{ matrix.rust }}
components: clippy, rustfmt
- uses: Swatinem/rust-cache@v2
- name: Format
run: cargo fmt --all -- --check
# Clippy + test pair, run THREE TIMES across the feature combinations
# downstream consumers actually pick:
# 1. default features — the plain `cargo {check,test}` path
# 2. all features — full surface area, the previous single gate
# 3. no-default — the no_std build, must not pick up std-only
# tests or examples without a `required-features`
# entry
# The trio is load-bearing: v1.0.0 shipped with a broken default-feature
# test target because only `--all-features` was gated. Without all three
# variants in CI, a future feature-gating mistake will reach a release
# the same way.
- name: Clippy (default features)
run: cargo clippy --all-targets -- -D warnings
- name: Clippy (all features)
run: cargo clippy --all-targets --all-features -- -D warnings
- name: Clippy (no_std)
run: cargo clippy --all-targets --no-default-features -- -D warnings
- name: Test (default features)
run: cargo test
- name: Test (all features)
run: cargo test --all-features
- name: Test (no_std)
run: cargo test --no-default-features
- name: Doc
run: cargo doc --no-deps --all-features
env:
RUSTDOCFLAGS: "-D warnings"
loom:
name: Loom (concurrency model check)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- name: Loom
run: cargo test --test loom_codec || echo "(loom test not yet present)"
env:
RUSTFLAGS: "--cfg loom"
security:
name: Security (audit + deny)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- name: Install cargo-audit and cargo-deny
uses: taiki-e/install-action@v2
with:
tool: cargo-audit,cargo-deny
- name: Audit
run: cargo audit
- name: Deny
run: cargo deny check
# Smoke-run every fuzz target for 30 seconds on each push. Crash artifacts
# surface immediately. Longer continuous fuzzing happens out-of-band on
# dedicated infra (post-1.0 ossfuzz integration tracked separately).
fuzz:
name: Fuzz (cargo-fuzz, nightly)
runs-on: ubuntu-latest
# The workflow-level `RUSTFLAGS: -D warnings` would interfere with the
# heavy flag set cargo-fuzz layers on (sanitiser coverage, ASAN, etc.).
# Clear it for this job so cargo-fuzz controls the build flags fully.
env:
RUSTFLAGS: ""
steps:
- uses: actions/checkout@v5
- uses: dtolnay/rust-toolchain@nightly
- uses: Swatinem/rust-cache@v2
with:
workspaces: "fuzz -> fuzz/target"
- name: Install cargo-fuzz
uses: taiki-e/install-action@v2
with:
tool: cargo-fuzz
- name: Run every fuzz target for 60s
working-directory: fuzz
# cargo-fuzz defaults to the musl target so it produces a static
# binary, but AddressSanitizer doesn't work with musl's statically
# linked libc. Force the GNU target instead — already present in
# the base nightly install — so ASAN + the rest of cargo-fuzz's
# sanitiser instrumentation can link against glibc.
#
# Per-target runtime bumped from 30s to 60s in v0.9 as part of the
# beta hardening pass.
run: |
for t in decode_string decode_vec_u8 decode_tuple \
decode_collection decode_view_str \
decode_struct_derive decode_enum_derive \
decode_versioned \
decode_btreemap decode_btreeset decode_hashset \
decode_view_bytes decode_view_collection; do
echo "::group::fuzz target: $t"
cargo +nightly fuzz run --target x86_64-unknown-linux-gnu "$t" \
-- -max_total_time=60 -timeout=10
echo "::endgroup::"
done