ci: rebuild delivery around bounded Cargo Rail work #487
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ci-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_INCREMENTAL: 0 | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| jobs: | |
| plan: | |
| name: Plan | |
| if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| outputs: | |
| artifact: ${{ steps.stage.outputs.artifact }} | |
| core: ${{ steps.select.outputs.core }} | |
| ct: ${{ steps.select.outputs.ct }} | |
| examples: ${{ steps.select.outputs.examples }} | |
| features: ${{ steps.select.outputs.features }} | |
| feature-matrix: ${{ steps.select.outputs.feature-matrix }} | |
| fuzz: ${{ steps.select.outputs.fuzz }} | |
| fuzz-rows: ${{ steps.select.outputs.fuzz-rows }} | |
| head-commit: ${{ steps.rail.outputs.head-commit }} | |
| identity: ${{ steps.rail.outputs.plan-identity }} | |
| miri: ${{ steps.select.outputs.miri }} | |
| miri-rows: ${{ steps.select.outputs.miri-rows }} | |
| msrv: ${{ steps.select.outputs.msrv }} | |
| platform-matrix: ${{ steps.select.outputs.platform-matrix }} | |
| platforms: ${{ steps.select.outputs.platforms }} | |
| rsa: ${{ steps.select.outputs.rsa }} | |
| supply-chain: ${{ steps.select.outputs.supply-chain }} | |
| tests: ${{ steps.select.outputs.tests }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - id: rail | |
| name: Select affected work | |
| uses: loadingalias/cargo-rail-action@78ad385a85627484a5b634cf1bc3caa1de872c6a # v8.2.0 | |
| with: | |
| version: "0.25.0" | |
| since: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'push' && github.event.before || '' }} | |
| all: ${{ github.event_name == 'workflow_dispatch' }} | |
| - id: select | |
| name: Export executor decisions | |
| shell: bash | |
| env: | |
| PLAN: ${{ steps.rail.outputs.plan-file }} | |
| READER: ${{ steps.rail.outputs.plan-reader }} | |
| run: | | |
| set -euo pipefail | |
| required_any() { | |
| local decision work | |
| for work in "$@"; do | |
| decision=$(python3 "$READER" is-required "$PLAN" "$work") | |
| case "$decision" in | |
| true) echo true; return ;; | |
| false) ;; | |
| *) echo "invalid decision for $work: $decision" >&2; exit 2 ;; | |
| esac | |
| done | |
| echo false | |
| } | |
| feature_matrix=$( | |
| RAIL_PLAN_FILE="$PLAN" RAIL_PLAN_READER="$READER" \ | |
| scripts/check/feature-contracts.sh matrix | |
| ) | |
| feature_count=$(jq -r '.include | length' <<<"$feature_matrix") | |
| platform_matrix=$(scripts/ci/target-contracts.sh matrix "$PLAN" "$READER") | |
| platform_count=$(jq -r '.include | length' <<<"$platform_matrix") | |
| miri_rows=$(scripts/test/miri-contracts.sh rows "$PLAN" "$READER") | |
| fuzz_rows=$(scripts/test/fuzz-contracts.sh rows "$PLAN" "$READER") | |
| { | |
| echo "actions=$(required_any policy.actions)" | |
| echo "core=$(required_any cargo.fmt cargo.build cargo.clippy cargo.doc cargo.doctest cargo.test contracts.auxiliary contracts.examples)" | |
| echo "ct=$(required_any assurance.ct)" | |
| echo "examples=$(required_any cargo.build contracts.examples)" | |
| [[ "$feature_count" -gt 0 ]] && echo "features=true" || echo "features=false" | |
| echo "feature-matrix=$feature_matrix" | |
| [[ -n "$fuzz_rows" ]] && echo "fuzz=true" || echo "fuzz=false" | |
| echo "fuzz-rows=$fuzz_rows" | |
| [[ -n "$miri_rows" ]] && echo "miri=true" || echo "miri=false" | |
| echo "miri-rows=$miri_rows" | |
| echo "msrv=$(required_any cargo.build)" | |
| echo "platform-matrix=$platform_matrix" | |
| [[ "$platform_count" -gt 0 ]] && echo "platforms=true" || echo "platforms=false" | |
| echo "rsa=$(required_any assurance.rsa)" | |
| echo "supply-chain=$(required_any dependency-policy dependencies.auxiliary)" | |
| echo "tests=$(required_any cargo.test)" | |
| } >>"$GITHUB_OUTPUT" | |
| - name: Install actionlint and ripgrep | |
| if: steps.select.outputs.actions == 'true' | |
| run: scripts/ci/install-actions-policy-tools.sh | |
| - name: Install Just and Zizmor | |
| if: steps.select.outputs.actions == 'true' | |
| uses: taiki-e/install-action@0758d235715de2f3551eacc980d9ae8fce9342c3 # v2.87.3 | |
| with: | |
| tool: just@1.58.0,zizmor@1.30.0 | |
| fallback: none | |
| - name: Run affected repository policy | |
| env: | |
| RAIL_PLAN_FILE: ${{ steps.rail.outputs.plan-file }} | |
| RAIL_PLAN_READER: ${{ steps.rail.outputs.plan-reader }} | |
| RAIL_PLAN_IDENTITY: ${{ steps.rail.outputs.plan-identity }} | |
| RAIL_PLAN_HEAD_COMMIT: ${{ steps.rail.outputs.head-commit }} | |
| run: scripts/check/policy.sh | |
| - name: Check release intent | |
| if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' && !(startsWith(github.head_ref, 'rail/release-') && github.event.pull_request.head.repo.full_name == github.repository) | |
| env: | |
| RAIL_BASE_REF: ${{ steps.rail.outputs.base }} | |
| run: cargo rail change check --since "$RAIL_BASE_REF" --required | |
| - id: stage | |
| name: Stage immutable plan | |
| shell: bash | |
| env: | |
| PLAN: ${{ steps.rail.outputs.plan-file }} | |
| READER: ${{ steps.rail.outputs.plan-reader }} | |
| run: | | |
| set -euo pipefail | |
| root="$RUNNER_TEMP/rscrypto-cargo-rail-plan" | |
| artifact="cargo-rail-plan-$GITHUB_RUN_ID" | |
| mkdir -p "$root" | |
| install -m 600 "$PLAN" "$root/plan.json" | |
| install -m 700 "$READER" "$root/read.py" | |
| install -m 700 "$(command -v cargo-rail)" "$root/cargo-rail" | |
| echo "artifact=$artifact" >>"$GITHUB_OUTPUT" | |
| - name: Upload immutable plan | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ${{ steps.stage.outputs.artifact }} | |
| path: ${{ runner.temp }}/rscrypto-cargo-rail-plan/ | |
| retention-days: 7 | |
| if-no-files-found: error | |
| core: | |
| name: Core | |
| needs: plan | |
| if: needs.plan.outputs.core == 'true' | |
| runs-on: runs-on=${{ github.run_id }}/runner=linux-x64-ci | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: $/.github/actions/plan | |
| with: | |
| artifact: ${{ needs.plan.outputs.artifact }} | |
| identity: ${{ needs.plan.outputs.identity }} | |
| head-commit: ${{ needs.plan.outputs.head-commit }} | |
| - id: rust | |
| uses: $/.github/actions/rust | |
| with: | |
| components: clippy,rustfmt | |
| cache-url: ${{ vars.CARGO_RAIL_CACHE_URL }} | |
| cache-mode: ${{ vars.CARGO_RAIL_CACHE_URL != '' && github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && 'read-write' || vars.CARGO_RAIL_CACHE_URL != '' && secrets.CARGO_RAIL_R2_READ_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_READ_SECRET_ACCESS_KEY != '' && 'read' || 'off' }} | |
| cache-access-key-id: ${{ github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID || secrets.CARGO_RAIL_R2_READ_ACCESS_KEY_ID }} | |
| cache-secret-access-key: ${{ github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY || secrets.CARGO_RAIL_R2_READ_SECRET_ACCESS_KEY }} | |
| - name: Install test runner | |
| if: needs.plan.outputs.tests == 'true' | |
| uses: taiki-e/install-action@0758d235715de2f3551eacc980d9ae8fce9342c3 # v2.87.3 | |
| with: | |
| tool: cargo-nextest@0.9.143 | |
| fallback: none | |
| - name: Check, lint, and document | |
| env: | |
| RSCRYPTO_SKIP_CHECK_SUPPLY_CHAIN: 1 | |
| run: scripts/check/check.sh | |
| - name: Test | |
| env: | |
| RSCRYPTO_TEST_MODE: commit | |
| run: scripts/test/test.sh | |
| - name: Run minimum-feature examples | |
| if: needs.plan.outputs.examples == 'true' | |
| run: scripts/test/test-examples.sh | |
| - name: Report compiler cache | |
| if: ${{ !cancelled() && steps.rust.outputs.cache-enabled == 'true' }} | |
| run: scripts/ci/report-cache.sh | |
| msrv: | |
| name: MSRV | |
| needs: plan | |
| if: needs.plan.outputs.msrv == 'true' | |
| runs-on: runs-on=${{ github.run_id }}/runner=linux-x64-ci | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: $/.github/actions/plan | |
| with: | |
| artifact: ${{ needs.plan.outputs.artifact }} | |
| identity: ${{ needs.plan.outputs.identity }} | |
| head-commit: ${{ needs.plan.outputs.head-commit }} | |
| - run: scripts/ci/require-work.sh cargo.build | |
| - id: rust | |
| uses: $/.github/actions/rust | |
| with: | |
| contract: msrv | |
| cache-url: ${{ vars.CARGO_RAIL_CACHE_URL }} | |
| cache-mode: ${{ vars.CARGO_RAIL_CACHE_URL != '' && github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && 'read-write' || vars.CARGO_RAIL_CACHE_URL != '' && secrets.CARGO_RAIL_R2_READ_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_READ_SECRET_ACCESS_KEY != '' && 'read' || 'off' }} | |
| cache-access-key-id: ${{ github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID || secrets.CARGO_RAIL_R2_READ_ACCESS_KEY_ID }} | |
| cache-secret-access-key: ${{ github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY || secrets.CARGO_RAIL_R2_READ_SECRET_ACCESS_KEY }} | |
| - run: scripts/check/msrv.sh | |
| - name: Report compiler cache | |
| if: ${{ !cancelled() && steps.rust.outputs.cache-enabled == 'true' }} | |
| run: scripts/ci/report-cache.sh | |
| features: | |
| name: Feature Contracts (${{ matrix.label }}) | |
| needs: plan | |
| if: needs.plan.outputs.features == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJSON(needs.plan.outputs.feature-matrix) }} | |
| runs-on: runs-on=${{ github.run_id }}/runner=linux-x64-ci | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: $/.github/actions/plan | |
| with: | |
| artifact: ${{ needs.plan.outputs.artifact }} | |
| identity: ${{ needs.plan.outputs.identity }} | |
| head-commit: ${{ needs.plan.outputs.head-commit }} | |
| - run: scripts/ci/require-work.sh contracts.features | |
| - id: rust | |
| uses: $/.github/actions/rust | |
| with: | |
| cache-url: ${{ vars.CARGO_RAIL_CACHE_URL }} | |
| cache-mode: ${{ vars.CARGO_RAIL_CACHE_URL != '' && github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && 'read-write' || vars.CARGO_RAIL_CACHE_URL != '' && secrets.CARGO_RAIL_R2_READ_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_READ_SECRET_ACCESS_KEY != '' && 'read' || 'off' }} | |
| cache-access-key-id: ${{ github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID || secrets.CARGO_RAIL_R2_READ_ACCESS_KEY_ID }} | |
| cache-secret-access-key: ${{ github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY || secrets.CARGO_RAIL_R2_READ_SECRET_ACCESS_KEY }} | |
| - name: Install test runner | |
| if: matrix.test_runner == 'nextest' | |
| uses: taiki-e/install-action@0758d235715de2f3551eacc980d9ae8fce9342c3 # v2.87.3 | |
| with: | |
| tool: cargo-nextest@0.9.143 | |
| fallback: none | |
| - env: | |
| FEATURE_DOMAIN: ${{ matrix.domain }} | |
| FEATURE_PROFILES: ${{ matrix.profiles }} | |
| FEATURE_SHARD: ${{ matrix.shard }} | |
| run: scripts/check/feature-contracts.sh selected "$FEATURE_DOMAIN" "$FEATURE_SHARD" "$FEATURE_PROFILES" | |
| - name: Report compiler cache | |
| if: ${{ !cancelled() && steps.rust.outputs.cache-enabled == 'true' }} | |
| run: scripts/ci/report-cache.sh | |
| platforms: | |
| name: ${{ matrix.name }} | |
| needs: plan | |
| if: needs.plan.outputs.platforms == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJSON(needs.plan.outputs.platform-matrix) }} | |
| runs-on: ${{ matrix.runner_type == 'runson' && format('runs-on={0}/runner={1}', github.run_id, matrix.runner) || matrix.runner }} | |
| timeout-minutes: ${{ matrix.timeout_minutes }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ needs.plan.outputs.head-commit }} | |
| persist-credentials: false | |
| - uses: $/.github/actions/plan | |
| if: matrix.verify_plan | |
| with: | |
| artifact: ${{ needs.plan.outputs.artifact }} | |
| identity: ${{ needs.plan.outputs.identity }} | |
| head-commit: ${{ needs.plan.outputs.head-commit }} | |
| - id: rust | |
| uses: $/.github/actions/rust | |
| with: | |
| contract: ${{ matrix.contract }} | |
| components: ${{ matrix.components }} | |
| cache-url: ${{ vars.CARGO_RAIL_CACHE_URL }} | |
| cache-mode: ${{ matrix.cache && vars.CARGO_RAIL_CACHE_URL != '' && github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && 'read-write' || matrix.cache && vars.CARGO_RAIL_CACHE_URL != '' && secrets.CARGO_RAIL_R2_READ_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_READ_SECRET_ACCESS_KEY != '' && 'read' || 'off' }} | |
| cache-access-key-id: ${{ github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID || secrets.CARGO_RAIL_R2_READ_ACCESS_KEY_ID }} | |
| cache-secret-access-key: ${{ github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY || secrets.CARGO_RAIL_R2_READ_SECRET_ACCESS_KEY }} | |
| - shell: bash | |
| env: | |
| TARGET_ROW: ${{ matrix.id }} | |
| run: scripts/ci/target-contracts.sh run "$TARGET_ROW" shallow | |
| - name: Report compiler cache | |
| if: ${{ !cancelled() && steps.rust.outputs.cache-enabled == 'true' }} | |
| run: scripts/ci/report-cache.sh | |
| miri: | |
| name: Miri | |
| needs: plan | |
| if: needs.plan.outputs.miri == 'true' | |
| runs-on: runs-on=${{ github.run_id }}/runner=linux-x64-ci | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: $/.github/actions/plan | |
| with: | |
| artifact: ${{ needs.plan.outputs.artifact }} | |
| identity: ${{ needs.plan.outputs.identity }} | |
| head-commit: ${{ needs.plan.outputs.head-commit }} | |
| - run: scripts/ci/require-work.sh assurance.miri | |
| - uses: $/.github/actions/rust | |
| with: | |
| contract: nightly | |
| components: miri,rust-src | |
| - env: | |
| MIRI_ROWS: ${{ needs.plan.outputs.miri-rows }} | |
| run: scripts/test/miri-contracts.sh selected "$MIRI_ROWS" | |
| fuzz: | |
| name: Fuzz | |
| needs: plan | |
| if: needs.plan.outputs.fuzz == 'true' | |
| runs-on: runs-on=${{ github.run_id }}/runner=linux-x64-ci | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: $/.github/actions/plan | |
| with: | |
| artifact: ${{ needs.plan.outputs.artifact }} | |
| identity: ${{ needs.plan.outputs.identity }} | |
| head-commit: ${{ needs.plan.outputs.head-commit }} | |
| - run: scripts/ci/require-work.sh assurance.fuzz | |
| - uses: $/.github/actions/rust | |
| with: | |
| contract: nightly | |
| components: rust-src | |
| - run: scripts/ci/install-tools.sh fuzz | |
| - env: | |
| FUZZ_ROWS: ${{ needs.plan.outputs.fuzz-rows }} | |
| RSCRYPTO_FUZZ_JOBS: 1 | |
| RSCRYPTO_FUZZ_TARGET_CONCURRENCY: 2 | |
| run: scripts/test/fuzz-contracts.sh selected "$FUZZ_ROWS" | |
| supply-chain: | |
| name: Supply Chain | |
| needs: plan | |
| if: needs.plan.outputs.supply-chain == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: $/.github/actions/plan | |
| with: | |
| artifact: ${{ needs.plan.outputs.artifact }} | |
| identity: ${{ needs.plan.outputs.identity }} | |
| head-commit: ${{ needs.plan.outputs.head-commit }} | |
| - run: scripts/ci/require-work.sh --any dependency-policy dependencies.auxiliary | |
| - uses: $/.github/actions/rust | |
| - run: scripts/ci/install-tools.sh supply-chain | |
| - run: cargo deny --locked check all | |
| - run: cargo audit --ignore RUSTSEC-2023-0071 | |
| ct: | |
| name: Constant-Time Gate | |
| needs: plan | |
| if: needs.plan.outputs.ct == 'true' | |
| runs-on: runs-on=${{ github.run_id }}/runner=linux-x64-ci | |
| timeout-minutes: 60 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: $/.github/actions/plan | |
| with: | |
| artifact: ${{ needs.plan.outputs.artifact }} | |
| identity: ${{ needs.plan.outputs.identity }} | |
| head-commit: ${{ needs.plan.outputs.head-commit }} | |
| - run: scripts/ci/require-work.sh assurance.ct | |
| - uses: $/.github/actions/rust | |
| with: | |
| components: llvm-tools-preview | |
| - run: scripts/ct/structural.sh | |
| rsa: | |
| name: RSA Gate | |
| needs: plan | |
| if: needs.plan.outputs.rsa == 'true' | |
| runs-on: runs-on=${{ github.run_id }}/runner=linux-x64-ci | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: $/.github/actions/plan | |
| with: | |
| artifact: ${{ needs.plan.outputs.artifact }} | |
| identity: ${{ needs.plan.outputs.identity }} | |
| head-commit: ${{ needs.plan.outputs.head-commit }} | |
| - run: scripts/ci/require-work.sh assurance.rsa | |
| - id: rust | |
| uses: $/.github/actions/rust | |
| with: | |
| cache-url: ${{ vars.CARGO_RAIL_CACHE_URL }} | |
| cache-mode: ${{ vars.CARGO_RAIL_CACHE_URL != '' && github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && 'read-write' || vars.CARGO_RAIL_CACHE_URL != '' && secrets.CARGO_RAIL_R2_READ_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_READ_SECRET_ACCESS_KEY != '' && 'read' || 'off' }} | |
| cache-access-key-id: ${{ github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID || secrets.CARGO_RAIL_R2_READ_ACCESS_KEY_ID }} | |
| cache-secret-access-key: ${{ github.event_name == 'push' && secrets.CARGO_RAIL_R2_WRITE_ACCESS_KEY_ID != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY != '' && secrets.CARGO_RAIL_R2_WRITE_SECRET_ACCESS_KEY || secrets.CARGO_RAIL_R2_READ_SECRET_ACCESS_KEY }} | |
| - run: scripts/test/test-rsa-linux-asm.sh | |
| - name: Report compiler cache | |
| if: ${{ !cancelled() && steps.rust.outputs.cache-enabled == 'true' }} | |
| run: scripts/ci/report-cache.sh | |
| complete: | |
| name: Complete | |
| needs: [plan, core, msrv, features, platforms, miri, fuzz, supply-chain, ct, rsa] | |
| if: ${{ !cancelled() && needs.plan.result != 'skipped' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Require selected jobs | |
| shell: bash | |
| env: | |
| CORE_REQUIRED: ${{ needs.plan.outputs.core }} | |
| CORE_RESULT: ${{ needs.core.result }} | |
| CT_REQUIRED: ${{ needs.plan.outputs.ct }} | |
| CT_RESULT: ${{ needs.ct.result }} | |
| FEATURES_REQUIRED: ${{ needs.plan.outputs.features }} | |
| FEATURES_RESULT: ${{ needs.features.result }} | |
| FUZZ_REQUIRED: ${{ needs.plan.outputs.fuzz }} | |
| FUZZ_RESULT: ${{ needs.fuzz.result }} | |
| MIRI_REQUIRED: ${{ needs.plan.outputs.miri }} | |
| MIRI_RESULT: ${{ needs.miri.result }} | |
| MSRV_REQUIRED: ${{ needs.plan.outputs.msrv }} | |
| MSRV_RESULT: ${{ needs.msrv.result }} | |
| PLATFORM_REQUIRED: ${{ needs.plan.outputs.platforms }} | |
| PLATFORM_RESULT: ${{ needs.platforms.result }} | |
| PLAN_RESULT: ${{ needs.plan.result }} | |
| RSA_REQUIRED: ${{ needs.plan.outputs.rsa }} | |
| RSA_RESULT: ${{ needs.rsa.result }} | |
| SUPPLY_REQUIRED: ${{ needs.plan.outputs.supply-chain }} | |
| SUPPLY_RESULT: ${{ needs.supply-chain.result }} | |
| run: | | |
| [[ "$PLAN_RESULT" == success ]] | |
| for pair in \ | |
| "$CORE_REQUIRED:$CORE_RESULT:core" \ | |
| "$CT_REQUIRED:$CT_RESULT:ct" \ | |
| "$FEATURES_REQUIRED:$FEATURES_RESULT:features" \ | |
| "$FUZZ_REQUIRED:$FUZZ_RESULT:fuzz" \ | |
| "$MIRI_REQUIRED:$MIRI_RESULT:miri" \ | |
| "$MSRV_REQUIRED:$MSRV_RESULT:msrv" \ | |
| "$PLATFORM_REQUIRED:$PLATFORM_RESULT:platforms" \ | |
| "$RSA_REQUIRED:$RSA_RESULT:rsa" \ | |
| "$SUPPLY_REQUIRED:$SUPPLY_RESULT:supply-chain" | |
| do | |
| IFS=: read -r required result name <<<"$pair" | |
| if [[ "$required" == true ]]; then | |
| [[ "$result" == success ]] || { echo "$name: $result" >&2; exit 1; } | |
| else | |
| [[ "$result" == skipped ]] || { echo "$name ran unexpectedly: $result" >&2; exit 1; } | |
| fi | |
| done |