forge/.github/workflows/ci.yml at main · ferrosadb/forge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # Required so the four checks run on the merge-queue's merge_group ref;
  # without this the queue waits forever for checks that never report.
  merge_group:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  fmt-lint:
    name: Format & Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @ 2026-04-25
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Check formatting
        run: cargo fmt --all -- --check
      - name: Clippy (warnings as errors)
        run: cargo clippy --workspace --all-targets -- -D warnings

  build-test:
    name: Build & Test
    runs-on: ubuntu-latest
    needs: fmt-lint
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @ 2026-04-25
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Build workspace
        run: cargo build --workspace --all-targets
      - name: Anti-loop contract tests
        run: |
          cargo test -p forge-checklist-state
          cargo test -p forge --test checklist
          cargo test -p forge-mcp-server
      - name: MCP draft conformance tests
        run: |
          cargo test -p forge-mcp-server --lib stdio_server_discover
          cargo test -p forge-mcp-server --lib http_
          cargo test -p forge-fmem-client --lib protocol::tests::encode_mcp_header_value
          cargo test -p forge-fmem-client --lib transport::http::tests::http_call_sends_modern_accept_and_encoded_name_headers
          cargo test -p forge-fmem-client --lib tools::handshake
      - name: Test workspace
        run: cargo test --workspace
      - name: Build release CLI smoke
        run: |
          cargo build --release --bin frg
          ./target/release/frg --version
          ./target/release/frg --help >/dev/null

  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    needs: fmt-lint
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @ 2026-04-25
        with:
          components: llvm-tools-preview
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Install cargo-llvm-cov
        run: cargo install --locked cargo-llvm-cov --version 0.8.4
      - name: Measure workspace coverage
        run: |
          mkdir -p coverage
          cargo llvm-cov --workspace --all-features --lcov --output-path coverage/lcov.info
          cargo llvm-cov report --json --output-path coverage/coverage.json
          cargo llvm-cov report --html --output-dir coverage/html
          cargo llvm-cov report --summary-only | tee coverage/summary.txt
      - name: Enforce coverage floor
        run: >-
          cargo llvm-cov report
          --fail-under-lines 70
          --fail-under-functions 66
          --fail-under-regions 68
      - name: Publish coverage summary
        if: ${{ always() && hashFiles('coverage/summary.txt') != '' }}
        run: |
          echo '### Workspace coverage' >> "$GITHUB_STEP_SUMMARY"
          echo '```text' >> "$GITHUB_STEP_SUMMARY"
          tail -n 2 coverage/summary.txt >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
      - name: Upload coverage reports
        if: ${{ always() && hashFiles('coverage/summary.txt') != '' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-reports
          path: |
            coverage/lcov.info
            coverage/coverage.json
            coverage/summary.txt
            coverage/html/
          if-no-files-found: error
          retention-days: 14

  docs:
    name: Docs
    runs-on: ubuntu-latest
    needs: fmt-lint
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @ 2026-04-25
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Build docs with warnings denied
        run: cargo doc --workspace --no-deps
        env:
          RUSTDOCFLAGS: -D warnings

  advisories:
    name: Dependency Advisories
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @ 2026-04-25
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Install cargo-deny
        run: cargo install --locked cargo-deny
      - name: Check advisories + licenses + bans + sources
        run: cargo deny check