Sync Cargo.lock with Zenoh feb4ebe from 2026-08-13
#3258
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| # `release/*` because that is where a release is actually built from: the | |
| # release workflow creates the branch through the shared | |
| # eclipse-zenoh/ci/create-release-branch action, and without this CI never runs | |
| # on it. The dry-run branches that same action produces are excluded - they are | |
| # throwaway. | |
| push: | |
| branches: ["main", "release/*", "!release/dry-run/*"] | |
| # Every branch, not just main: a backport pull request targets a release | |
| # branch, and it needs CI as much as any other. Not `push` on every branch as | |
| # well - with this on, that runs the whole matrix twice per branch. | |
| pull_request: | |
| branches: ["**"] | |
| # No schedule. The obvious argument for a nightly is that it would catch | |
| # zenoh-flat-jni moving under us, and it would not: Cargo.lock pins that | |
| # dependency to a commit, and Cargo re-resolves a git dependency only on | |
| # `cargo update`, so a timed build rebuilds exactly what the last merge built. | |
| # Upstream drift arrives here as a lockfile-sync pull request, which runs CI | |
| # like anything else. What is left is an expired Central token or GPG key, | |
| # caught only in a week with no merges at all - a thin canary against a daily | |
| # publication. workflow_dispatch runs the path on demand. | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| # A run on main publishes two coordinates from two separate uploads — our copy | |
| # of zenoh-flat-jni, then this SDK naming it. Nothing makes that pair atomic, so | |
| # runs are serialized rather than cancelled: cancelling a run mid-publication is | |
| # exactly what leaves the two naming different commits. Per ref, so branches do | |
| # not queue behind each other. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| # Third-party actions are pinned to a commit, with the version in a trailing | |
| # comment: a tag is mutable, and a moved tag runs code nobody reviewed. Actions | |
| # under eclipse-zenoh/ are ours and stay on a branch. | |
| jobs: | |
| build: | |
| name: Build on ${{ matrix.os }} | |
| runs-on: ["${{ matrix.os }}"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - name: Check out zenoh-java | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| path: zenoh-java | |
| - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 | |
| with: | |
| distribution: temurin | |
| java-version: 11 | |
| # rust-toolchain.toml here tracks zenoh-flat-jni's own, because that is | |
| # what has to compile. Installing it up front keeps a missing toolchain | |
| # from surfacing in the middle of the Gradle build. | |
| # | |
| # Nothing else Rust runs here. Formatting, clippy, the feature-leak test | |
| # and the native build are zenoh-flat-jni's own CI, on three platforms, | |
| # for the very commit pinned here; re-running them from this repository | |
| # only adds ways for the two toolchains to disagree. | |
| - name: Install Rust toolchain | |
| working-directory: zenoh-java | |
| run: rustup show | |
| # v5, not v6: v6 moved caching into a proprietary component under Gradle's | |
| # own terms of use, which is not ours to accept for an Eclipse project. | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 | |
| - name: Gradle Test | |
| working-directory: zenoh-java | |
| # CI tests against zenoh-flat-jni's source, so it opts into the composite | |
| # build; settings.gradle.kts then fetches the commit Cargo.lock pins. A | |
| # release does not opt in: it resolves zenoh-flat-jni from Maven Central | |
| # like any other consumer. | |
| # | |
| # No checkout or cargo step precedes this. The build fetches its own | |
| # pinned bindings, and their test task depends on their native build, so | |
| # Gradle drives both git and cargo - which is why `./gradlew jvmTest | |
| # -PuseLocalJni=true` reproduces this run anywhere. | |
| run: ./gradlew jvmTest --info -PuseLocalJni=true | |
| markdown_lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # Pinned where it stands. v18 runs on node20, which is not retired, and a | |
| # newer major changes markdownlint's rules - an upgrade to make on its own, | |
| # not inside a pinning change. | |
| - uses: DavidAnson/markdownlint-cli2-action@eb5ca3ab411449c66620fe7f1b3c9e10547144b0 # v18 | |
| with: | |
| config: '.markdownlint.yaml' | |
| globs: '**/README.md' | |
| # NOTE: In GitHub repository settings, the "Require status checks to pass | |
| # before merging" branch protection rule ensures that commits are only merged | |
| # from branches where specific status checks have passed. These checks are | |
| # specified manually as a list of workflow job names. Thus we use this extra | |
| # job to signal whether all CI checks have passed. | |
| ci: | |
| name: CI status checks | |
| runs-on: ubuntu-latest | |
| needs: [build, markdown_lint] | |
| if: always() | |
| steps: | |
| - name: Check whether all jobs pass | |
| run: echo '${{ toJson(needs) }}' | jq -e 'all(.result == "success")' | |
| # Everything below publishes, and only from main, on every merge there. | |
| # Branches and pull requests publish nothing. | |
| # | |
| # The snapshot must be usable by someone who is not us, which means its | |
| # zenoh-flat-jni dependency has to exist — and be the commit this SDK compiled | |
| # against. It must also not wait on zenoh-flat-jni's CI. Both follow from one | |
| # rule: this job publishes what it depends on. See CI.md. | |
| # Which commit that is, and whether the copy already published is it. | |
| flat_jni_pin: | |
| name: Resolve the zenoh-flat-jni pin | |
| if: contains(fromJSON('["refs/heads/main"]'), github.ref) | |
| needs: ci | |
| runs-on: ubuntu-latest | |
| outputs: | |
| commit: ${{ steps.pin.outputs.commit }} | |
| base: ${{ steps.pin.outputs.base }} | |
| qualifier: ${{ steps.pin.outputs.qualifier }} | |
| rebuild: ${{ steps.pin.outputs.rebuild }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - id: pin | |
| run: bash ci/scripts/flat-jni-copy.bash | |
| # Our own copy, built from that commit by zenoh-flat-jni's own publication | |
| # workflow — its cross-compilation matrix is six desktop targets and four | |
| # Android ABIs, and duplicating it here is how the two would drift. | |
| # | |
| # The workflow file is taken from its main, reviewed like any dependency; | |
| # `uses:` cannot hold an expression, so the pin cannot go there. What is built | |
| # is `branch:`, and that is the whole of the coupling: this needs a *file* in | |
| # that repository, never a run of its CI. | |
| # | |
| # Half an hour when it runs, so it runs only when the pin has moved. | |
| publish_flat_jni_copy: | |
| name: Publish our zenoh-flat-jni copy | |
| needs: flat_jni_pin | |
| if: needs.flat_jni_pin.outputs.rebuild == 'true' | |
| uses: eclipse-zenoh/zenoh-flat-jni/.github/workflows/publish.yml@main | |
| permissions: | |
| contents: read | |
| packages: write | |
| with: | |
| snapshot: true | |
| # A called workflow runs with the caller's context, so it has to be told | |
| # whose sources to check out. | |
| source-repository: eclipse-zenoh/zenoh-flat-jni | |
| branch: ${{ needs.flat_jni_pin.outputs.commit }} | |
| version-qualifier: ${{ needs.flat_jni_pin.outputs.qualifier }} | |
| # It derives the coordinate from its own version.txt; this is what we | |
| # expect that to be, so a pin that moved past a version bump there fails | |
| # before publishing something we cannot resolve. | |
| expected-base-version: ${{ needs.flat_jni_pin.outputs.base }} | |
| secrets: inherit | |
| # Then the SDK snapshot, naming the copy above. Reached both ways: the copy | |
| # was rebuilt, or it was already current and skipped. | |
| publish_snapshot_package: | |
| name: Publish snapshot package | |
| needs: [flat_jni_pin, publish_flat_jni_copy] | |
| if: >- | |
| ${{ !cancelled() | |
| && needs.flat_jni_pin.result == 'success' | |
| && needs.publish_flat_jni_copy.result != 'failure' }} | |
| uses: ./.github/workflows/publish.yml | |
| permissions: | |
| contents: read | |
| packages: write | |
| with: | |
| snapshot: true | |
| # The commit that triggered this run, not `main`. Concurrency queues a | |
| # newer run; it does not hold the branch still. Passing the branch name, | |
| # this job would check out whatever `main` had become while the JNI copy | |
| # was being built for half an hour — publishing SDK source B against the | |
| # copy built from A's pin, which is the mismatch the whole job exists to | |
| # prevent. | |
| branch: ${{ github.sha }} | |
| secrets: inherit |