From e326451459911c0f8c79dc9adb8ecd034af50dbb Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Fri, 7 Aug 2026 06:51:51 -0700 Subject: [PATCH] ci: adopt the fleet reusable workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the hand-maintained ci.yml with a call to SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@619094ad54edc586f5c2733358e00326b30790bd What the old file enforced (read from origin/main, not the TSV): fmt; clippy --all-targets twice (default features and --no-default-features); `cargo test` twice, same two feature sets, ubuntu only; cargo-deny; MSRV 1.85 running `cargo test`; a 100%-line coverage gate; a second, independent 100%-e2e gate over the integration suite; a fuzz build check; gitleaks; a soft cargo-geiger; cargo-vet. Inputs, each carrying an existing decision across: os-matrix: false the old test job ran on ubuntu-latest only msrv-check: test the old MSRV job ran the suite at 1.85, not just a build deny-config-repo: "" keep the repo's own deny.toml; the shared fleet config is LOOSER (multiple-versions "warn" vs "deny", and 21 RUSTSEC ignores vs none) deny-args: --all-features cargo-deny-action defaults its `arguments` input to --all-features, so the old job checked the full-feature graph `all-features` and `coverage-scope` stay at their defaults. This is a one-package workspace whose only feature is `alloc`, and `alloc` is in `default`, so `--workspace --all-features` compiles and measures exactly the lines the old bare `cargo llvm-cov` did. Carried across as jobs, because no input can express them: - no-default-features: the lean `no_std` leg of the old clippy and test jobs. The shared workflow builds one feature set, so that leg lives here. - coverage-e2e: the old coverage job's second gate — the integration suite (--test roundtrip --test errors) must ALONE reach 100%. Copied verbatim; only the job scaffolding is new, and it is the same scaffolding the old coverage job used. - geiger: soft, unchanged. Relaxation, stated rather than hidden: the fleet `strict` gate additionally exempts delimiter-only lines and annotated `// cov:unreachable` lines, which the old hand-rolled gate did not — it failed on any zero-hit record at all. The repo is at 100% today with no markers at all, so both gates are green; the new one is marginally more permissive at the margin. Added by adoption, with no old equivalent (verified green on this branch): - path-deps: no path dependency may escape the repository - docs: `cargo doc --no-deps --workspace --all-features` with RUSTDOCFLAGS=-D warnings (ran it on this branch: exit 0) - fmt is now `cargo fmt --all --check`, clippy now `--workspace` - gitleaks runs both `git` and `dir` mode with the repo's .gitleaks.toml - cargo-vet now runs `cargo fetch --locked`; the old bare `cargo fetch` re-resolved Cargo.lock in the runner, so `vet --locked` validated a lock CI had just generated for itself main has no branch protection, so no required-check name changes with this. --- .github/workflows/ci.yml | 153 ++++++++++++--------------------------- 1 file changed, 45 insertions(+), 108 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b5bedc2..7f1bad2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,24 +6,51 @@ on: pull_request: branches: [main] +permissions: + contents: read + +# Only the repo-specific jobs at the bottom of this file read these. A called +# workflow does not inherit caller-level `env:`; the reusable workflow declares +# its own copy of exactly the same three. env: CARGO_TERM_COLOR: always CARGO_INCREMENTAL: "0" RUSTFLAGS: -Dwarnings jobs: - fmt: - name: Format - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - with: - components: rustfmt - - run: cargo fmt --check + ci: + uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@619094ad54edc586f5c2733358e00326b30790bd + with: + # The old `test` job ran on ubuntu-latest only. `true` would newly gate on + # macOS and Windows, which nothing here has ever been shown to pass. + os-matrix: false + # The old MSRV job ran `cargo test` on 1.85, not a bare build. The floor + # needs no input: the single member declares rust-version "1.85", so the + # workflow derives the same 1.85 the job was pinned to. + msrv-check: test + # `all-features` and `coverage-scope` stay at their defaults. This is a + # one-package workspace whose only feature is `alloc`, and `alloc` is in + # `default`, so `--workspace --all-features` compiles and measures exactly + # the same lines the old bare `cargo llvm-cov` did. + # + # The repo's own deny.toml, not the shared fleet config. Local is strictly + # STRICTER: `[bans] multiple-versions = "deny"` (shared: "warn") and + # `[advisories] ignore = []` (shared: 21 RUSTSEC ignores). Adopting the + # shared file would loosen this gate, which an adoption PR must not do. + deny-config-repo: "" + # cargo-deny-action defaults its `arguments` input to `--all-features`, so + # the old job checked the full-feature dependency graph. Carry that across. + deny-args: --all-features - clippy: - name: Clippy + # --------------------------------------------------------------------------- + # Repo-specific jobs, carried across from the pre-adoption ci.yml. + # --------------------------------------------------------------------------- + + # The old clippy and test jobs each ran a second, `--no-default-features` leg: + # the lean `no_std` build without the allocating convenience. The shared + # workflow builds one feature set, so that leg lives here or nowhere. + no-default-features: + name: Clippy + Test (--no-default-features, no_std) runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 @@ -31,79 +58,17 @@ jobs: with: components: clippy - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 - - run: cargo clippy --all-targets -- -D warnings # The lean `no_std` build (no `alloc` convenience) must stay warning-clean. - run: cargo clippy --all-targets --no-default-features -- -D warnings - - test: - name: Test - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 - - run: cargo test - run: cargo test --no-default-features - deny: - name: Cargo Deny - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 - - msrv: - name: MSRV (1.85) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@c56a35af9328d0bc581dc86c05e58f97f7c38a0e # 1.85 - - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 - - run: cargo test - - run: cargo build --no-default-features - - fuzz-check: - name: Fuzz (build check) - runs-on: ubuntu-latest - # The workflow-wide RUSTFLAGS=-Dwarnings must NOT leak into the nightly fuzz - # build (nightly warns more freely) or cargo-fuzz's own build. - env: - RUSTFLAGS: "" - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - # cargo-fuzz needs nightly (-Z sanitizer=address). The action installs - # nightly and `rustup default`s it, but the checked-in rust-toolchain.toml - # (pinned to stable 1.96.0) OVERRIDES a channel default — so cargo fuzz - # would build on stable and reject -Zsanitizer. Force nightly with a - # command-line `+nightly` (a +toolchain beats the toml; precedence: - # `cargo +X` > RUSTUP_TOOLCHAIN > rust-toolchain.toml > rustup default). - - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - with: - toolchain: nightly - components: rust-src - # Install without --locked: cargo-fuzz's pinned Cargo.lock holds an old - # rustix whose attributes current nightly rejects. - - run: cargo +nightly install cargo-fuzz - - run: cargo +nightly fuzz build - - secrets: - name: Secret Scan (gitleaks) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - fetch-depth: 0 - - name: Install gitleaks - # renovate: datasource=github-releases depName=gitleaks/gitleaks - run: | - VERSION=8.30.1 - curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \ - | tar xz -C /tmp gitleaks - - name: Run gitleaks - run: /tmp/gitleaks detect --source . - - coverage: - name: Coverage (100% lines) + # The e2e half of the old `coverage` job. The shared workflow's coverage gate + # measures the whole suite; this second, independent gate asserts the + # integration suite ALONE reaches 100%. No input can express it, so it is + # copied verbatim — only the surrounding job scaffolding is new, and that is + # the same scaffolding the old coverage job used. + coverage-e2e: + name: Coverage (100% e2e, public API only) runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 @@ -112,15 +77,6 @@ jobs: components: llvm-tools-preview - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 - run: cargo install cargo-llvm-cov --locked - # 100% line coverage: any `DA:,0` record fails the gate. - - name: Enforce 100% line coverage - run: | - cargo llvm-cov --lcov --output-path lcov.info - if grep -qE '^DA:[0-9]+,0$' lcov.info; then - echo "::error::uncovered lines:"; grep -nE '^(SF:|DA:[0-9]+,0$)' lcov.info - exit 1 - fi - echo "100% line coverage ✓" # The whole public API is exercised through the integration tests (tests/), # so the e2e suite alone must also reach 100% — no line is reachable only # via white-box unit tests. @@ -143,22 +99,3 @@ jobs: - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 - run: cargo install cargo-geiger --locked - run: cargo geiger 2>&1 || true - - vet: - name: Cargo Vet (supply-chain) - runs-on: ubuntu-latest - # Complements `deny` (known-bad advisories/licenses) with the supply-chain- - # injection layer: every dependency version must be human-source-reviewed or - # covered by an imported aggregate audit set (Google/Mozilla/Bytecode-Alliance/ - # Embark). Config in supply-chain/{config,audits,imports}.toml. - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - - name: Install cargo-vet - uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6 - with: - tool: cargo-vet - - name: Fetch dependencies - run: cargo fetch - - name: Check supply chain - run: cargo vet --locked