styrolite 0.2.2

Lightweight, programmatic sandboxing tool
Documentation

#
# Cargo Make Configuration
#
[config]
reduce_output = false
skip_core_tasks = true

#
# Environment and Profile Setup
#
# default profile
[env]
STYROLITE_BUILD_FLAGS = ""
# TODO(found-it): support more than just linux when it makes sense
TARGET_ARCH = { condition.env_not_set = ["TARGET_ARCH"], value = "x86_64" }
TARGET_LIBC = { condition.env_not_set = ["TARGET_LIBC"], value = "musl" }
TARGET_VENDOR = { condition.env_not_set = ["TARGET_VENDOR"], value = "unknown" }
CARGO_BUILD_TARGET = { condition.env_not_set = [
  "CARGO_BUILD_TARGET",
], value = "${TARGET_ARCH}-${TARGET_VENDOR}-linux-${TARGET_LIBC}" }
RUSTFLAG_STATIC = { condition.env_true = [
  "STATIC_BINARY",
], value = "-Ctarget-feature=+crt-static" }
RUSTFLAGS = { script = ["echo ${RUSTFLAG_STATIC}"] }

# release profile
# Use with: cargo make --profile release <task>
[env.release]
STYROLITE_BUILD_FLAGS = "--release"

#
# Tasks
#
[tasks.clippy]
install_crate = "clippy"
command = "cargo"
args = ["clippy"]
dependencies = ["rustup-target-add"]

[tasks.format]
install_crate = "rustfmt"
command = "cargo"
args = ["fmt", "--", "--emit=files"]

[tasks.format-check]
install_crate = "rustfmt"
command = "cargo"
args = ["fmt", "--all", "--", "--check"]

[tasks.clean]
command = "cargo"
args = ["clean"]

[tasks.rustup-target-add]
command = "rustup"
args = ["target", "add", "${CARGO_BUILD_TARGET}"]

[tasks.examples]
command = "cargo"
args = ["build", "@@split(STYROLITE_BUILD_FLAGS, )", "--examples"]
dependencies = ["rustup-target-add"]

[tasks.build]
command = "cargo"
args = ["build", "@@split(STYROLITE_BUILD_FLAGS, )"]
dependencies = ["rustup-target-add", "examples"]

[tasks.test]
command = "cargo"
args = ["test"]
dependencies = ["rustup-target-add"]

[tasks.ci]
dependencies = [
  "format-check",
  "clippy",
  "build",
  "test",
  "shellcheck",
  "shfmt",
]

[tasks.example-attach]
env = { ATTACH_PID = { condition.env_not_set = [
  "ATTACH_PID",
], script = [
  '''
    echo "Please set ATTACH_PID to the pid you'd like to attach with this example"
    exit 1
''',
] } }
script = '''
echo "Using $ATTACH_PID"
sudo ./target/x86_64-unknown-linux-musl/debug/examples/styrolite-attach \
  $PWD/target/x86_64-unknown-linux-musl/debug/styrolite \
  $ATTACH_PID
'''
dependencies = ["build"]

[tasks.example-rundir-alpine]
env = { ALPINE_ROOTFS = { condition.env_not_set = [
  "ALPINE_ROOTFS",
], script = [
  '''
    alpine_rootfs=$PWD/local/alpine
    if [ -d "${alpine_rootfs}" ]; then
      echo "${alpine_rootfs}"
      return
    fi

    mkdir -p "${alpine_rootfs}"
    curl --retry 4 --fail -o "${alpine_rootfs}/alpine-minirootfs.tar.gz" https://dl-cdn.alpinelinux.org/alpine/v3.22/releases/x86_64/alpine-minirootfs-3.22.2-x86_64.tar.gz
    cd "${alpine_rootfs}" && tar xzvf alpine-minirootfs.tar.gz && cd -
    echo $PWD/local/alpine
''',
] } }
script = '''
echo "Using $ALPINE_ROOTFS"
sudo ./target/x86_64-unknown-linux-musl/debug/examples/styrolite-rundir \
  $PWD/target/x86_64-unknown-linux-musl/debug/styrolite \
  $ALPINE_ROOTFS
'''
dependencies = ["build"]

[tasks.shellcheck-exists]
script = '''
if ! command -v shellcheck; then
  echo "please install shellcheck"
  exit 1
fi
'''

[tasks.shellcheck]
command = "./hack/code/shellcheck.sh"
dependencies = ["shellcheck-exists"]

[tasks.shfmt-exists]
script = '''
if ! command -v shfmt; then
  echo "please install shfmt"
  exit 1
fi
'''

[tasks.shfmt]
command = "./hack/code/shfmt.sh"
dependencies = ["shfmt-exists"]

[tasks.shfmt-write]
env = { STYROLITE_SHFMT_WRITE = "true" }
command = "./hack/code/shfmt.sh"
dependencies = ["shfmt-exists"]

[tasks.zizmor-exists]
script = '''
if ! command -v zizmor; then
  echo "please install zizmor"
  exit 1
fi
'''

[tasks.zizmor]
script = '''
GH_TOKEN=$(gh auth token) zizmor --pedantic .
'''
dependencies = ["check-gh-installed", "zizmor-exists"]

#
# Release Tasks
#
[tasks.assets-exist]
script = '''
if [ ! -d ./target/assets ]; then
  echo "./target/assets does not exist"
  exit 1
fi
'''

[tasks.release-exists]
script = '''
if [ ! -d ./target/release ]; then
  echo "./target/release does not exist"
  exit 1
fi
'''

[tasks.assemble-release-assets]
command = "./hack/ci/assemble-release-assets.sh"
dependencies = ["release-exists"]

[tasks.check-gh-installed]
command = "which"
args = ["gh"]

[tasks.upload-release-assets]
command = "./hack/ci/upload-release-assets.sh"
dependencies = ["check-gh-installed", "assets-exist"]