RUST-CI-004 document rustybuzz advisory exception #427
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| # Pin the vendored MiniUPnP C source the native miniupnpc-sys build links against. | |
| MINIUPNP_REF: bced81fb0b73ae78c9b911c89e881fbc6d4a5c7c | |
| jobs: | |
| build-test: | |
| name: build+test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| env: | |
| EMULEBB_WORKSPACE_ROOT: ${{ github.workspace }} | |
| EMULEBB_WORKSPACE_OUTPUT_ROOT: ${{ github.workspace }}/../emulebb-rust-out | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/../emulebb-rust-out/builds/rust/target | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| steps: | |
| - name: Checkout emulebb-rust | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| - name: Checkout emulebb-miniupnp (native C source) | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| repository: emulebb/emulebb-miniupnp | |
| ref: ${{ env.MINIUPNP_REF }} | |
| path: .ci/emulebb-miniupnp | |
| - name: Install pinned Rust | |
| uses: dtolnay/rust-toolchain@1a3a6d54512beeaffd394f8d516ca16f2c506a20 # 1.97.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "24" | |
| package-manager-cache: false | |
| - name: Install Linux UI build dependencies | |
| if: runner.os == 'Linux' | |
| run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libfontconfig1-dev | |
| - name: Cache cargo build | |
| uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| # The local Kad swarm harness refuses loopback by design (node.rs | |
| # lan_bind_ip): bind through the runner's real primary IPv4 so the | |
| # multi-node tests exercise a genuine interface, exactly like the | |
| # operator split-tunnel machines do via X_LOCAL_IP. | |
| - name: Resolve runner LAN IP (X_LOCAL_IP) | |
| shell: bash | |
| run: | | |
| ip=$(python -c "import socket; s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.connect(('203.0.113.1', 9)); print(s.getsockname()[0])") | |
| echo "resolved X_LOCAL_IP=$ip" | |
| echo "X_LOCAL_IP=$ip" >> "$GITHUB_ENV" | |
| - name: Rust build/test gate | |
| env: | |
| MINIUPNP_ROOT: ${{ github.workspace }}/.ci/emulebb-miniupnp | |
| run: python tools/rust_quality_gate.py ci-test | |
| quality: | |
| name: policy + format + clippy | |
| runs-on: ubuntu-latest | |
| env: | |
| EMULEBB_WORKSPACE_ROOT: ${{ github.workspace }} | |
| EMULEBB_WORKSPACE_OUTPUT_ROOT: ${{ github.workspace }}/../emulebb-rust-out | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/../emulebb-rust-out/builds/rust/target | |
| steps: | |
| - name: Checkout emulebb-rust | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| # clippy --workspace builds emulebb-miniupnpc-sys, whose build.rs compiles | |
| # the vendored MiniUPnP C source; provide it exactly as the build-test job | |
| # does so the clippy step is not blocked on a native build failure. | |
| - name: Checkout emulebb-miniupnp (native C source) | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| repository: emulebb/emulebb-miniupnp | |
| ref: ${{ env.MINIUPNP_REF }} | |
| path: .ci/emulebb-miniupnp | |
| - name: Install pinned Rust with rustfmt and Clippy | |
| uses: dtolnay/rust-toolchain@1a3a6d54512beeaffd394f8d516ca16f2c506a20 # 1.97.0 | |
| with: | |
| components: rustfmt, clippy | |
| - name: Set up Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "24" | |
| package-manager-cache: false | |
| - name: Install Linux UI build dependencies | |
| run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libfontconfig1-dev | |
| - name: Rust quality gate | |
| env: | |
| MINIUPNP_ROOT: ${{ github.workspace }}/.ci/emulebb-miniupnp | |
| run: python tools/rust_quality_gate.py quick | |
| supply-chain: | |
| name: cargo-deny (advisories, licenses, sources) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout emulebb-rust | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| - name: cargo-deny — advisories, licenses, and sources | |
| uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2 | |
| with: | |
| command: check advisories licenses sources |