-
Notifications
You must be signed in to change notification settings - Fork 0
197 lines (154 loc) · 5.84 KB
/
Copy pathcode-checks.yml
File metadata and controls
197 lines (154 loc) · 5.84 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
# SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
#
# SPDX-License-Identifier: Apache-2.0
name: Code Checks
on:
workflow_dispatch:
pull_request:
paths-ignore:
- "**/*.md"
- "docs/**"
- "LICENSE"
- "NOTICE"
- ".github/renovate.json"
push:
branches:
- main
paths-ignore:
- "**/*.md"
- "docs/**"
- "LICENSE"
- "NOTICE"
- ".github/renovate.json"
permissions:
contents: read
jobs:
rust:
name: fmt, lint, test, wasm, package
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
with:
toolchain: 1.96.0
components: rustfmt, clippy
targets: wasm32-unknown-unknown
- name: Cache Cargo
uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- name: Install nextest
uses: taiki-e/install-action@c61310c7f42caf5b425e349b6742d93ca197327c # nextest
- name: Install cargo-deny
uses: taiki-e/install-action@c61310c7f42caf5b425e349b6742d93ca197327c # cargo-deny
with:
tool: cargo-deny@0.19.6
- name: Install wasm-pack
uses: taiki-e/install-action@c61310c7f42caf5b425e349b6742d93ca197327c # wasm-pack
with:
tool: wasm-pack@0.15.0
- name: Install wasm-bindgen-cli
uses: taiki-e/install-action@c61310c7f42caf5b425e349b6742d93ca197327c # wasm-bindgen-cli
with:
tool: wasm-bindgen-cli@0.2.126
- name: Install Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
with:
node-version: '24'
cache: npm
cache-dependency-path: packages/ts/package-lock.json
- name: Format
run: cargo fmt --check
- name: Check all features
run: cargo check --workspace --all-features
- name: Check warnings as errors
run: RUSTFLAGS=-Dwarnings cargo check --workspace --all-features
- name: Clippy
run: cargo clippy --workspace --all-targets --all-features -- -D warnings
- name: Test
run: cargo nextest run --workspace --all-features
- name: Doc build
run: cargo doc --workspace --no-deps --all-features
env:
RUSTDOCFLAGS: -D warnings
- name: Doctests
run: cargo test --workspace --all-features --doc
- name: Check codec WASM crate
run: cargo check -p reallyme-codec-wasm --target wasm32-unknown-unknown
- name: Install TypeScript codec package dependencies
run: npm ci --prefix packages/ts
- name: Test TypeScript codec package
run: npm --prefix packages/ts test
- name: Test TypeScript codec package in browser
run: npm --prefix packages/ts run test:browser
- name: Test release-readiness CLI
run: node --test scripts/release-readiness/cli.test.mjs
- name: Test architecture source policy
run: node --test scripts/release-readiness/source-policy.test.mjs
- name: Test native manifest integrity metadata
run: node --test scripts/write_native_manifest.test.mjs
- name: Test release attestation policy
run: node --test scripts/verify_release_attestation.test.mjs
- name: Test Swift release artifact verification
run: node --test scripts/verify_swift_release_artifact.test.mjs
- name: Release readiness
run: node scripts/run_pinned_release_readiness.mjs
- name: Dependency policy
run: cargo deny check
native-sanitizers:
name: native sanitizer lanes
runs-on: macos-15
steps:
- name: Checkout
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
- name: Install Rust sanitizer toolchain
uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
with:
toolchain: nightly-2026-07-01
- name: Test native sanitizer lanes
run: scripts/test_native_sanitizers.sh
swift:
name: swift codec package
runs-on: macos-26
steps:
- name: Checkout
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
with:
toolchain: 1.96.0
- name: Select Xcode 26.4
run: |
sudo xcode-select -s /Applications/Xcode_26.4.app
swift --version
- name: Build codec FFI dylib
run: cargo build --locked -p reallyme-codec-ffi
- name: Test Swift package
run: swift test
env:
REALLYME_CODEC_FFI_LIBRARY_PATH: ${{ github.workspace }}/target/debug/libreallyme_codec_ffi.dylib
REALLYME_CODEC_SWIFTPM_RUNTIME_FFI: "1"
kotlin:
name: kotlin codec package
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
- name: Validate Gradle wrapper
uses: gradle/actions/wrapper-validation@0723195856401067f7a2779048b490ace7a47d7c # v5
- name: Install Java
uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
with:
distribution: temurin
java-version: '21'
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
with:
toolchain: 1.96.0
- name: Build codec FFI dylib
run: cargo build --locked -p reallyme-codec-ffi
- name: Test Kotlin codec package
working-directory: packages/kotlin
run: ./gradlew test
env:
REALLYME_CODEC_FFI_LIBRARY_PATH: ${{ github.workspace }}/target/debug/libreallyme_codec_ffi.so