swaits
54d73d9cb1
RUSTSEC-2026-0119 (hickory-proto O(n²) name-compression DoS) and RUSTSEC-2026-0120 (hickory-net NSEC3 unbounded loop / OOM) both fire against hickory 0.26.0-beta.4. Fixed upstream in hickory 0.26.1, but iroh 0.98.2 hard-pins hickory-resolver = "=0.26.0-beta.4" so we can't bump transitively. Unblock once iroh releases a version that relaxes the pin.
126 lines
4.1 KiB
YAML
126 lines
4.1 KiB
YAML
name: CI
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
pull_request:
|
||
branches: [main]
|
||
|
||
concurrency:
|
||
group: ${{ github.workflow }}-${{ github.ref }}
|
||
cancel-in-progress: true
|
||
|
||
env:
|
||
CARGO_TERM_COLOR: always
|
||
RUSTFLAGS: -D warnings
|
||
|
||
jobs:
|
||
# ── Fast lane: OS × toolchain matrix ──────────────────────────────
|
||
check:
|
||
name: check (${{ matrix.os }}, ${{ matrix.toolchain }})
|
||
strategy:
|
||
fail-fast: false
|
||
matrix:
|
||
os: [ubuntu-latest, macos-latest, windows-latest]
|
||
toolchain: [stable, "1.93.0"] # MSRV
|
||
runs-on: ${{ matrix.os }}
|
||
steps:
|
||
- uses: actions/checkout@v6
|
||
- uses: dtolnay/rust-toolchain@master
|
||
with:
|
||
toolchain: ${{ matrix.toolchain }}
|
||
components: rustfmt, clippy
|
||
- uses: Swatinem/rust-cache@v2
|
||
- uses: taiki-e/install-action@v2
|
||
with:
|
||
tool: cargo-nextest
|
||
- name: fmt
|
||
run: cargo fmt --check
|
||
- name: clippy
|
||
run: cargo clippy --all-targets --all-features -- -D warnings
|
||
- name: nextest
|
||
run: cargo nextest run --all-features --profile ci
|
||
- name: doctests
|
||
run: cargo test --doc --all-features
|
||
|
||
# ── Supply-chain hygiene ──────────────────────────────────────────
|
||
deny:
|
||
name: cargo deny
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v6
|
||
- uses: taiki-e/install-action@v2
|
||
with:
|
||
tool: cargo-deny
|
||
- run: cargo deny check
|
||
|
||
audit:
|
||
name: cargo audit
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v6
|
||
- uses: taiki-e/install-action@v2
|
||
with:
|
||
tool: cargo-audit
|
||
# cargo-audit doesn't read deny.toml, so mirror its ignore list here.
|
||
# See deny.toml [advisories] for rationale on each ID.
|
||
- run: cargo audit --ignore RUSTSEC-2026-0119 --ignore RUSTSEC-2026-0120
|
||
|
||
# ── Public-API semver compliance (PR only) ────────────────────────
|
||
semver:
|
||
name: cargo semver-checks
|
||
if: github.event_name == 'pull_request'
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v6
|
||
- uses: dtolnay/rust-toolchain@stable
|
||
- uses: Swatinem/rust-cache@v2
|
||
- uses: taiki-e/install-action@v2
|
||
with:
|
||
tool: cargo-semver-checks
|
||
- name: semver-checks (non-blocking until 0.1 on crates.io)
|
||
run: cargo semver-checks check-release || echo "pre-publish; ignoring"
|
||
|
||
# ── Line + branch coverage (Linux stable only) ────────────────────
|
||
coverage:
|
||
name: coverage
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v6
|
||
- uses: dtolnay/rust-toolchain@stable
|
||
with:
|
||
components: llvm-tools-preview
|
||
- uses: Swatinem/rust-cache@v2
|
||
- uses: taiki-e/install-action@v2
|
||
with:
|
||
tool: cargo-llvm-cov,cargo-nextest
|
||
- name: lcov
|
||
run: cargo llvm-cov nextest --all-features --lcov --output-path lcov.info
|
||
- uses: codecov/codecov-action@v6
|
||
with:
|
||
files: lcov.info
|
||
fail_ci_if_error: false
|
||
env:
|
||
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
|
||
|
||
# ── Build examples (smoke) ────────────────────────────────────────
|
||
examples:
|
||
name: examples build
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v6
|
||
- uses: dtolnay/rust-toolchain@stable
|
||
- uses: Swatinem/rust-cache@v2
|
||
- run: cargo build --example quickstart
|
||
- run: cargo build --example simulator --features sim
|
||
|
||
# ── Stateright BFS safety proof (fast) ────────────────────────────
|
||
stateright:
|
||
name: stateright BFS N=3 K=2
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v6
|
||
- uses: dtolnay/rust-toolchain@stable
|
||
- uses: Swatinem/rust-cache@v2
|
||
- run: cargo test --test stateright_model --release --all-features -- bfs_n3_k2 --ignored
|