Skip to content

perf(delivery): Cow<str> values in query HashMap, drop into_owned() #48

perf(delivery): Cow<str> values in query HashMap, drop into_owned()

perf(delivery): Cow<str> values in query HashMap, drop into_owned() #48

name: PR Quality Gate
on:
pull_request:
push:
branches: [main]
concurrency:
group: quality-gate-${{ github.ref }}
cancel-in-progress: true
# Deny-all by default; this workflow only ever reads the checked-out code. No
# job here writes packages, contents, or any other scope, so a malicious PR or a
# compromised build dependency has no privileged token to exfiltrate.
permissions: {}
env:
CARGO_TERM_COLOR: always
jobs:
backend:
name: Backend (fmt, clippy, tests)
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Install Rust toolchain
run: rustup show
# Compiler cache with a sharp trust boundary: only builds on the default
# branch may *write* the cache (`save-if`), while pull requests restore it
# read-only. A PR therefore reuses main's warm cache for speed but can
# never persist a poisoned artifact that a later trusted build would read.
- name: Cache Rust build
uses: Swatinem/rust-cache@v2
with:
key: quality-gate
save-if: ${{ github.ref == 'refs/heads/main' }}
- name: Format
run: cargo fmt --all -- --check
- name: Clippy
run: cargo clippy --all-features -- -D warnings -A clippy::too_many_arguments
env:
SERVAL_SKIP_FRONTEND_BUILD: "1"
- name: Unit tests
run: cargo test
env:
SERVAL_SKIP_FRONTEND_BUILD: "1"
frontend:
name: Frontend (build, lint)
runs-on: ubuntu-latest
permissions:
contents: read
defaults:
run:
working-directory: frontend
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- uses: actions/setup-node@v4
with:
node-version: 24
cache: npm
cache-dependency-path: frontend/package-lock.json
- name: Install dependencies
run: npm ci
- name: Build
run: npm run build
- name: Lint
run: npm run lint