1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
name: CI
# This crate is published and three services depend on it, yet it was the only
# repo here with no gate — both bots already block their deploy on
# fmt + clippy + test. Runs on PRs so a review has mechanical signal, and on main
# so a direct push can't skip it.
on:
push:
branches:
paths-ignore:
pull_request:
workflow_dispatch:
concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true
env:
CARGO_TERM_COLOR: always
jobs:
check:
name: fmt + clippy + test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
components: rustfmt, clippy
- uses: Swatinem/rust-cache@v2
- run: cargo fmt --check
- run: cargo clippy --all-features --all-targets -- -D warnings
# --all-features so the agentic path compiles too, and doc-tests run: the
# rustdoc examples are part of the public API contract.
- run: cargo test --all-features
package:
name: cargo package
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
# Catches a publish that would fail on metadata or a missing include long
# before `cargo publish` is typed — the flow here is tag-then-publish, where
# a broken package means a burnt version number.
- run: cargo package
downstream:
# Named for what it ACTUALLY covers. This job can only build the public
# consumers; the private ones (pr-review-bot, and a client-org bot that is
# deliberately not named in a public workflow) are not checked here. A job
# called "downstream compiles" that silently skips the consumers most likely to
# break buys false confidence — the green tick was reporting success for builds
# it never ran.
#
# The full check is a RELEASE step instead: compile EVERY consumer against the
# release candidate before cutting a version. See "Releasing" in README.md.
name: downstream compiles (public consumers)
runs-on: ubuntu-latest
# Why this job exists at all: 0.11.0 added a field to the public `PrMeta`
# struct. Every test in this repo passed, and pr-review-bot then failed to
# compile against it. A breaking change to a published crate is invisible to
# its own test suite — only a consumer build sees it.
#
# Each consumer's dependency is REPOINTED at this checkout rather than patched
# via [patch.crates-io], because a patch must satisfy the consumer's version
# requirement — so every version-bump PR would fail for the wrong reason.
steps:
- uses: actions/checkout@v4
with:
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- name: kaniscope-action
run: |
set -euo pipefail
git clone --depth 1 https://github.com/nhatvu148/kaniscope-action.git consumer
cd consumer
sed -i 's|^pr-review-core = .*|pr-review-core = { path = "../core" }|' Cargo.toml
grep -n '^pr-review-core' Cargo.toml
cargo check --all-targets
- name: pr-review-bot
env:
TOKEN: ${{ secrets.DOWNSTREAM_TOKEN }}
run: |
set -euo pipefail
# pr-review-bot is private, so this needs a read-scoped PAT in the
# DOWNSTREAM_TOKEN secret. OPTIONAL by design: the release checklist
# compiles every consumer by hand, which covers more than this job can
# (it also reaches the client-org bot, which is not named here). Setting
# the secret just moves that check earlier, to every PR.
if [ -z "${TOKEN:-}" ]; then
echo "::warning::DOWNSTREAM_TOKEN unset — pr-review-bot not built here."
echo "::warning::The release checklist in README.md covers it; this job does not."
exit 0
fi
git clone --depth 1 "https://x-access-token:${TOKEN}@github.com/nhatvu148/pr-review-bot.git" bot
cd bot
sed -i 's|^pr-review-core = .*|pr-review-core = { path = "../core" }|' Cargo.toml
grep -n '^pr-review-core' Cargo.toml
cargo check --all-targets --features claude-code