1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
name: CI
on:
push:
pull_request:
permissions:
contents: read
env:
CARGO_TERM_COLOR: always
jobs:
quality:
runs-on: ubuntu-24.04
timeout-minutes: 30
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # 2026-07-29
with:
toolchain: 1.89.0
components: rustfmt, clippy
- run: cargo fmt --all -- --check
- run: cargo clippy --locked --all-targets --all-features -- -D warnings
- run: cargo clippy --locked --all-targets --no-default-features -- -D warnings
- name: Prove the engine excludes product transport
shell: bash
run: |
if cargo tree --locked --all-features | grep -Eq '^(mcport|notify) '; then
echo "product transport leaked into the evidence engine" >&2
exit 1
fi
- name: Enforce the repository architecture contract
run: cargo test --locked --all-features --test architecture_self
test:
strategy:
fail-fast: false
matrix:
os:
runs-on: ${{ matrix.os }}
timeout-minutes: 45
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # 2026-07-29
with:
toolchain: 1.89.0
- run: cargo test --locked --all-targets --all-features
- run: cargo test --locked --no-default-features
docs-and-package:
runs-on: ubuntu-24.04
timeout-minutes: 30
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # 2026-07-29
with:
toolchain: 1.89.0
- name: Build public documentation without warnings
env:
RUSTDOCFLAGS: -D warnings
run: cargo doc --locked --no-deps --all-features
- run: cargo publish --locked --dry-run
security:
runs-on: ubuntu-24.04
timeout-minutes: 15
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- uses: taiki-e/install-action@18b1216eba7f8039b0f8d131d5473787f0edce68 # v2
with:
tool: cargo-audit
- run: cargo audit --deny warnings
coverage:
runs-on: ubuntu-24.04
timeout-minutes: 45
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # 2026-07-29
with:
toolchain: 1.89.0
components: llvm-tools-preview
- uses: taiki-e/install-action@18b1216eba7f8039b0f8d131d5473787f0edce68 # v2
with:
tool: cargo-llvm-cov
- run: cargo llvm-cov --workspace --all-features --ignore-filename-regex '(main|error)\.rs$' --fail-under-lines 85