vimanam 1.3.0

OpenAPI/Swagger to Markdown documentation generator with grouping, filtering, and detail levels for docs and LLM context
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

name: CI

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    # Run weekly on Sundays at 00:00 UTC to catch newly published advisories against pinned crates
    - cron: '0 0 * * 0'

permissions:
  contents: read

jobs:
  test:
    name: Format, lint, test (stable)
    if: github.event_name != 'schedule'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master 2026-06-20
        with:
          toolchain: stable
          components: rustfmt, clippy

      - run: cargo fmt --check
      - run: cargo clippy --all-targets -- -D warnings
      - run: cargo test

  msrv:
    name: Build (MSRV 1.96)
    if: github.event_name != 'schedule'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master 2026-06-20
        with:
          toolchain: "1.96"

      - run: cargo build

  audit:
    name: Dependency security audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Audit dependencies
        uses: actions-rust-lang/audit@72c09e02f132669d52284a3323acdb503cfc1a24 # v1.2.7

  pin-check:
    name: Actions pinned to SHA
    if: github.event_name != 'schedule'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Require all actions to be pinned to a full commit SHA
        run: |
          set -euo pipefail
          # Every `uses:` (except local ./ actions) must be pinned to a 40-char commit SHA.
          # dist's generated release.yml is hand-pinned post-generation; this guards against a
          # regeneration silently reverting it to mutable tags.
          unpinned="$(grep -rEn '^[[:space:]]*-?[[:space:]]*uses:[[:space:]]' .github/workflows \
            | grep -vE 'uses:[[:space:]]*\./' \
            | grep -vE 'uses:[[:space:]]*[^@]+@[0-9a-f]{40}([[:space:]]|"|$)' || true)"
          if [ -n "$unpinned" ]; then
            echo "::error::These actions are not pinned to a full commit SHA:"
            echo "$unpinned"
            echo "Pin like: uses: owner/repo@<40-char-sha> # vX"
            exit 1
          fi
          echo "All workflow actions are SHA-pinned."