crypto: enforce lint-clean safety boundaries #432
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| RUST_BACKTRACE: 1 | |
| CARGO_TERM_COLOR: always | |
| CARGO_INCREMENTAL: 0 | |
| permissions: | |
| contents: read | |
| jobs: | |
| rail-plan: | |
| name: Build Plan | |
| if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.actor != 'dependabot[bot]') }} | |
| runs-on: ubuntu-latest | |
| outputs: | |
| build: ${{ steps.rail.outputs.build }} | |
| test: ${{ steps.rail.outputs.test }} | |
| infra: ${{ steps.rail.outputs.infra }} | |
| surfaces_json: ${{ steps.rail.outputs.surfaces-json }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Build Plan (PR) | |
| if: github.event_name == 'pull_request' | |
| id: rail | |
| uses: loadingalias/cargo-rail-action@ebc8ef2740efefe2cd5c42826344a8f1213113ae # v6.1.2 | |
| with: | |
| version: "0.21.0" | |
| checksum: required | |
| since: ${{ github.event.pull_request.base.sha }} | |
| - name: Check Release Intent Coverage | |
| if: github.event_name == 'pull_request' && !(startsWith(github.head_ref, 'rail/release-') && github.event.pull_request.head.repo.full_name == github.repository) | |
| env: | |
| RAIL_BASE_REF: ${{ steps.rail.outputs.base-ref }} | |
| run: cargo rail change check --since "$RAIL_BASE_REF" --required | |
| dependency-smoke: | |
| name: Dependency Smoke | |
| if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.draft && github.actor == 'dependabot[bot]' }} | |
| uses: ./.github/workflows/_rust-job.yaml | |
| with: | |
| runner: ubuntu-latest | |
| timeout_minutes: 45 | |
| cache_key: dependabot-smoke | |
| tools_mode: supply-chain | |
| toolchain_components: "clippy, rustfmt" | |
| enable_magic_cache: false | |
| enable_rust_cache: true | |
| operation: dependabot-smoke | |
| base_sha: ${{ github.event.pull_request.base.sha }} | |
| suite: | |
| name: CI Suite | |
| needs: rail-plan | |
| if: ${{ !cancelled() && (github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.actor != 'dependabot[bot]' && (needs.rail-plan.result != 'success' || needs.rail-plan.outputs.build == 'true' || needs.rail-plan.outputs.test == 'true' || needs.rail-plan.outputs.infra == 'true'))) }} | |
| uses: ./.github/workflows/_ci-suite.yaml | |
| with: | |
| cache_key_prefix: commit | |
| supply_chain_mode: light | |
| test_mode: commit | |
| include_cargo_graph: ${{ contains(needs.rail-plan.outputs.surfaces_json, '"custom:cargo_graph":true') }} | |
| complete: | |
| name: Complete | |
| needs: [rail-plan, suite, dependency-smoke] | |
| if: ${{ !cancelled() && (github.event_name != 'pull_request' || !github.event.pull_request.draft) }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Assert suite passed | |
| env: | |
| ACTOR: ${{ github.actor }} | |
| DEPENDENCY_SMOKE_RESULT: ${{ needs.dependency-smoke.result }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| PLAN_RESULT: ${{ needs.rail-plan.result }} | |
| SUITE_RESULT: ${{ needs.suite.result }} | |
| run: | | |
| if [[ "$EVENT_NAME" == "pull_request" && "$ACTOR" == "dependabot[bot]" ]]; then | |
| if [[ "$DEPENDENCY_SMOKE_RESULT" != "success" ]]; then | |
| echo "Dependency smoke result: $DEPENDENCY_SMOKE_RESULT" | |
| exit 1 | |
| fi | |
| echo "Dependency smoke: $DEPENDENCY_SMOKE_RESULT" | |
| exit 0 | |
| fi | |
| if [[ "$PLAN_RESULT" != "success" ]]; then | |
| echo "Build plan result: $PLAN_RESULT" | |
| exit 1 | |
| fi | |
| if [[ "$SUITE_RESULT" == "skipped" ]]; then | |
| echo "CI suite skipped because Cargo Rail selected no suite surfaces" | |
| elif [[ "$SUITE_RESULT" != "success" ]]; then | |
| echo "CI suite result: $SUITE_RESULT" | |
| exit 1 | |
| fi | |
| echo "CI suite: $SUITE_RESULT" |