name: CI
on:
push:
branches: [main, master]
pull_request:
branches: [main, master]
permissions:
contents: read
env:
CARGO_TERM_COLOR: always
jobs:
test:
name: Build & Test
runs-on: ${{ matrix.os }}
timeout-minutes: 30
permissions:
contents: read
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest]
rust: [stable]
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
- name: Install Rust
uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
with:
toolchain: ${{ matrix.rust }}
components: clippy, rustfmt
- name: Cache cargo registry
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
with:
path: ~/.cargo/registry
key: ${{ runner.os }}-${{ matrix.rust }}-cargo-registry-${{ hashFiles('**/Cargo.lock', '**/Cargo.toml') }}
restore-keys: |
${{ runner.os }}-${{ matrix.rust }}-cargo-registry-
- name: Cache cargo build
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
with:
path: target
key: ${{ runner.os }}-${{ matrix.rust }}-cargo-build-${{ hashFiles('**/Cargo.lock', '**/Cargo.toml') }}
restore-keys: |
${{ runner.os }}-${{ matrix.rust }}-cargo-build-
- name: Check formatting
run: cargo fmt --all -- --check
- name: Build
run: cargo build --locked --verbose
- name: Test all targets and features
run: cargo test --locked --all-targets --all-features --verbose
- name: Clippy
run: cargo clippy --locked --all-targets --all-features -- -D warnings
- name: Generate per-language evidence report
if: runner.os == 'Linux'
run: cargo run --locked --example evidence_report --all-features -- target/ripex-evidence.md
- name: Build (no-default-features, library only)
run: cargo build --locked --no-default-features --features "lang-all"
- name: Documentation
if: runner.os == 'Linux'
env:
RUSTDOCFLAGS: -D warnings
run: cargo doc --locked --no-deps --all-features
features:
name: Feature ${{ matrix.feature }}
runs-on: ubuntu-latest
timeout-minutes: 20
permissions:
contents: read
env:
RUSTFLAGS: -D warnings
strategy:
fail-fast: false
matrix:
feature:
- cli
- lang-all
- lang-c
- lang-cpp
- lang-csharp
- lang-go
- lang-js
- lang-python
- lang-rust
- serde
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
- name: Install Rust
uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
with:
toolchain: stable
- name: Cache feature build
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
with:
path: target
key: ${{ runner.os }}-${{ matrix.feature }}-cargo-build-${{ hashFiles('**/Cargo.lock', '**/Cargo.toml') }}
restore-keys: |
${{ runner.os }}-${{ matrix.feature }}-cargo-build-
- name: Check isolated feature
run: cargo check --locked --no-default-features --features "${{ matrix.feature }}"
- name: Run isolated integration tests
run: cargo test --locked --no-default-features --features "${{ matrix.feature }}" --tests
minimal:
name: Minimal library
runs-on: ubuntu-latest
timeout-minutes: 15
permissions:
contents: read
env:
RUSTFLAGS: -D warnings
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
- name: Install Rust
uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
with:
toolchain: stable
- run: cargo check --locked --no-default-features --lib
compiler-conformance:
name: Compiler conformance corpus
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
- name: Install Rust
uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
with:
toolchain: stable
- name: Install Go
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
with:
go-version: stable
- name: Install Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
with:
node-version: 22
- name: Install Python
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
with:
python-version: '3.12'
- name: Install latest .NET
uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9
with:
dotnet-version: '8.0.x'
- name: Install language analyzers
run: |
npm ci --prefix tests/lang-test/javascript
python -m pip install mypy
- name: Build ripex
run: cargo build --locked --all-features
- name: Check C17 corpus
run: target/debug/ripex check tests/lang-test/c --lang c --trusted-project
- name: Check C++20 corpus
run: target/debug/ripex check tests/lang-test/cpp --lang cpp --trusted-project
- name: Check C# project
run: target/debug/ripex check tests/lang-test/csharp --trusted-project
- name: Check Go project
run: target/debug/ripex check tests/lang-test/go --trusted-project
- name: Check JavaScript project
run: target/debug/ripex check tests/lang-test/javascript/src --lang javascript --trusted-project
- name: Check TypeScript project
run: target/debug/ripex check tests/lang-test/javascript/tsconfig.json --trusted-project
- name: Check strict Python project
run: target/debug/ripex check tests/lang-test/python/src --lang python --trusted-project
- name: Check Rust project
run: target/debug/ripex check tests/lang-test/rust --trusted-project
fuzz-replay:
name: Fuzz corpus replay (deterministic)
runs-on: ubuntu-latest
timeout-minutes: 15
permissions:
contents: read
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
- name: Install nightly Rust
uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
with:
toolchain: nightly
- name: Install latest cargo-fuzz
run: cargo +nightly install cargo-fuzz --version 0.13.2 --locked
- name: Replay committed fuzz seeds
working-directory: tests/fuzz
shell: bash
run: |
set -euo pipefail
if [[ ! -d corpus ]] || ! find corpus -type f -print -quit | grep -q .; then
echo "::notice::No committed fuzz seeds found; deterministic replay skipped."
exit 0
fi
for target in fuzz_all fuzz_js fuzz_python fuzz_go; do
corpus_dir="corpus/$target"
if [[ ! -d "$corpus_dir" ]]; then
echo "::error::Missing committed corpus directory: $corpus_dir"
exit 1
fi
echo "Replaying $target committed fuzz seeds"
CARGOFLAGS=--locked cargo +nightly fuzz run --fuzz-dir . "$target" -- -runs=1 -timeout=5 -rss_limit_mb=512 -max_len=4096
done
fuzz:
name: Fuzz (advisory crash / hang hunting)
needs: fuzz-replay
runs-on: ubuntu-latest
timeout-minutes: 15
continue-on-error: true
permissions:
contents: read
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
- name: Install nightly Rust
uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
with:
toolchain: nightly
- name: Install latest cargo-fuzz
run: cargo +nightly install cargo-fuzz --version 0.13.2 --locked
- name: Fuzz all parsers briefly
working-directory: tests/fuzz
shell: bash
run: |
# cargo-fuzz has no --locked flag; CARGOFLAGS locks its inner Cargo invocation.
CARGOFLAGS=--locked cargo +nightly fuzz run --fuzz-dir . fuzz_all -- -max_total_time=60 -timeout=5 -rss_limit_mb=512 -max_len=4096
node-bindings:
name: Node bindings (${{ matrix.target }})
runs-on: ${{ matrix.os }}
timeout-minutes: 45
permissions:
contents: read
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
target: x86_64-unknown-linux-gnu
binary: ripex.linux-x64-gnu.node
cross: "0"
runtime: true
- os: ubuntu-latest
target: aarch64-unknown-linux-gnu
binary: ripex.linux-arm64-gnu.node
cross: "1"
runtime: false
- os: macos-14
target: x86_64-apple-darwin
binary: ripex.darwin-x64.node
cross: "0"
runtime: false
- os: macos-14
target: aarch64-apple-darwin
binary: ripex.darwin-arm64.node
cross: "0"
runtime: true
- os: windows-latest
target: x86_64-pc-windows-msvc
binary: ripex.win32-x64-msvc.node
cross: "0"
runtime: true
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
- name: Install latest Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
with:
node-version: 22
- name: Install latest pnpm
run: npm install --global pnpm@10.28.2
- name: Install latest Bun
run: npm install --global bun@1.3.14
- name: Install Rust 1.85.0 and target
uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
with:
toolchain: 1.85.0
target: ${{ matrix.target }}
- name: Install Node binding dependencies
working-directory: bindings/node
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Install aarch64 cross-compiler
if: matrix.target == 'aarch64-unknown-linux-gnu'
run: |
sudo apt-get update
sudo apt-get install -y gcc-aarch64-linux-gnu
- name: Build Node binding
working-directory: bindings/node
env:
NAPI_TARGET: ${{ matrix.target }}
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
run: npm run build:release
- name: Verify target binary and package metadata
working-directory: bindings/node
env:
EXPECTED_BINARY: ${{ matrix.binary }}
EXPECTED_TARGET: ${{ matrix.target }}
shell: bash
run: |
set -euo pipefail
node - "$EXPECTED_BINARY" "$EXPECTED_TARGET" <<'NODE'
const fs = require('node:fs');
const binary = process.argv[2];
const target = process.argv[3];
const binaries = fs.readdirSync('.')
.filter((entry) => entry.endsWith('.node'))
.filter((entry) => fs.statSync(entry).isFile())
.sort();
if (binaries.length !== 1 || binaries[0] !== binary) {
throw new Error(`expected exactly ${binary}, found ${binaries.join(', ')}`);
}
const metadata = JSON.parse(fs.readFileSync('package.json', 'utf8'));
const targets = metadata.napi?.targets;
if (!Array.isArray(targets) || targets.length !== 5 || !targets.includes(target)) {
throw new Error(`package.json does not declare target ${target}`);
}
if (metadata.scripts?.postinstall) {
throw new Error('postinstall network/download hooks are forbidden');
}
NODE
- name: Run native Node binding tests
if: matrix.runtime == true
working-directory: bindings/node
run: npm test
- name: Run Bun native smoke test
if: matrix.runtime == true
working-directory: bindings/node
run: bun test test/index.bun.test.mjs
- name: Check public TypeScript declarations
if: matrix.runtime == true
working-directory: bindings/node
run: npm run test:types
- name: Check package contents
if: matrix.runtime == true
working-directory: bindings/node
run: npm run pack:dry
- name: Upload Node binding artifact
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
with:
name: node-bindings-${{ matrix.target }}
path: |
bindings/node/${{ matrix.binary }}
bindings/node/index.cjs
bindings/node/index.js
bindings/node/index.d.ts
if-no-files-found: error
retention-days: 7
python-bindings:
name: Python bindings (${{ matrix.os }})
runs-on: ${{ matrix.os }}
timeout-minutes: 30
permissions:
contents: read
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-14, windows-latest]
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
- name: Install Rust 1.85.0
uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
with:
toolchain: 1.85.0
components: clippy, rustfmt
- name: Install Python 3.12
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
with:
python-version: '3.12'
- name: Install Python build and test dependencies
run: |
python -m pip install --upgrade pip
python -m pip install "maturin>=1.5,<2.0" pytest pytest-asyncio mypy
- name: Build and install Python bindings
run: python -m pip install -e bindings/python
- name: Run pytest test suite
run: pytest -v bindings/python/tests
- name: Check typing with mypy
run: mypy --strict bindings/python/python/ripex bindings/python/tests