feat(upgrade): block Windows update of system-path install without ad… #298
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # Cancel in-progress runs for the same ref when a new commit is pushed, | |
| # so we don't waste CI minutes on superseded PR commits. | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: "-D warnings" | |
| jobs: | |
| # Lint runs once on Linux: fmt + clippy are platform-independent and | |
| # running them 3x would just burn CI minutes. | |
| lint: | |
| name: fmt + clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust (stable, with rustfmt + clippy) | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt, clippy | |
| - name: Cache cargo registry + build artifacts | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Check formatting | |
| run: cargo fmt --all -- --check | |
| - name: Clippy (warnings as errors) | |
| run: cargo clippy --all-targets -- -D warnings | |
| - name: Security audit (RustSec advisories) | |
| uses: rustsec/audit-check@v2.0.0 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| # Tests run on all three OSes so Windows-specific code paths | |
| # (extract.rs 7z handling, #[cfg(unix)] symlinks, where.exe lookup) | |
| # and macOS get real regression coverage instead of only building. | |
| test: | |
| name: test (${{ matrix.os }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust (stable) | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo registry + build artifacts | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Tests | |
| run: cargo test --all | |
| # commit-lint: enforce commit message + identity rules on every PR commit. | |
| # Delegates to the code-hooks repo's reusable workflow so rule fixes | |
| # (e.g. the new-branch scan fix in pre-push) propagate to every consumer | |
| # without each repo touching its CI. Rules are read at runtime from the | |
| # code-hooks checkout, making that repo the single source of truth. | |
| # | |
| # code-hooks is public, so the called workflow clones it over | |
| # unauthenticated HTTPS -- no secrets, no deploy key needed here. | |
| # Branch protection on `main` requires this job's status check; that's | |
| # the layer that actually enforces, since `git commit --no-verify` | |
| # bypasses local hooks. | |
| commit-lint: | |
| name: commit-lint | |
| uses: mose-x/code-hooks/.github/workflows/commit-lint.yml@main |