release: v0.3.1 — the pixel path, tested (#40) #18

Workflow file for this run

	name: CI

	on:
	pull_request:
	push:
	branches: [main]
	# Reused by release.yml so a release re-runs the exact same gates.
	workflow_call:

	permissions:
	contents: read

	concurrency:
	group: ci-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

	jobs:
	fmt:
	name: fmt
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	persist-credentials: false
	- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
	with:
	toolchain: stable
	components: rustfmt
	- run: cargo fmt --all --check

	clippy:
	name: clippy
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	persist-credentials: false
	- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
	with:
	toolchain: stable
	components: clippy
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
	- run: cargo clippy --all-targets --all-features -- -D warnings

	# The end-to-end suite spawns the real binary inside a PTY it creates itself,
	# so it needs no TTY of its own and none of the tests touch the network: the
	# ones that call the GitHub API are #[ignore]d.
	test:
	name: test (${{ matrix.os }})
	strategy:
	fail-fast: false
	matrix:
	os: [ubuntu-latest, macos-latest]
	runs-on: ${{ matrix.os }}
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	persist-credentials: false
	- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
	with:
	toolchain: stable
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
	- run: cargo test --all-features
	# Again from a timezone that is already tomorrow. Reports are pinned to
	# `--today` precisely so they do not depend on when they run, and the way
	# that rule gets broken is a new assertion about whatever day CI happened
	# to see — which passes on the day it is written and fails the morning
	# after. The binaries are built by the step above, so this costs seconds.
	- run: cargo test --all-features --test art_cli
	env:
	TZ: Pacific/Kiritimati

	# The `cfg(not(unix))` path — a probe that asks nothing, since reading
	# `/dev/tty` with O_NONBLOCK is a unix arrangement — is code the matrix above
	# never compiles. It went out of date exactly as you would expect: an
	# undocumented public function and a constant used only by the other branch,
	# both of them warnings that `-D warnings` turns into failures.
	windows:
	name: check (windows)
	runs-on: windows-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	persist-credentials: false
	- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
	with:
	toolchain: stable
	components: clippy
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
	- run: cargo clippy --all-targets --all-features -- -D warnings
	- run: cargo doc --no-deps --all-features
	env:
	RUSTDOCFLAGS: -D warnings
	# Not the end-to-end suite: `tests/smoke.rs` drives a real PTY through
	# termlens, which is its own question. The in-process tests are pure
	# arithmetic and colour, and they run anywhere.
	- run: cargo test --all-features --lib

	msrv:
	name: msrv
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	persist-credentials: false
	- name: Read MSRV from Cargo.toml
	id: msrv
	run: \|
	msrv="$(sed -n 's/^rust-version = "$.*$"/\1/p' Cargo.toml)"
	echo "MSRV: ${msrv}"
	echo "msrv=${msrv}" >> "$GITHUB_OUTPUT"
	- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
	with:
	toolchain: ${{ steps.msrv.outputs.msrv }}
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
	- run: cargo check --locked --all-targets

	docs:
	name: docs
	runs-on: ubuntu-latest
	env:
	RUSTDOCFLAGS: -D warnings
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	persist-credentials: false
	- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
	with:
	toolchain: stable
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
	- run: cargo doc --no-deps --all-features

	deny:
	name: deny
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	persist-credentials: false
	- uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2

	# Workflow security audit (template injection, credential persistence,
	# unpinned actions, …). Accepted findings live in .github/zizmor.yml.
	zizmor:
	name: zizmor
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	persist-credentials: false
	- name: Audit workflows at pedantic level
	env:
	GH_TOKEN: ${{ github.token }}
	# Version pinned; bump deliberately alongside a fresh local audit.
	# The composite action is audited too: it pulls actions of its own,
	# and it is the piece other people run in their repositories.
	run: pipx run zizmor==1.29.0 --persona=pedantic .github/workflows/ action/action.yml

	# Single stable job name for branch protection: require this one check and
	# matrix/job changes never break the required-checks configuration.
	required-green:
	name: required-green
	if: always()
	needs: [fmt, clippy, test, windows, msrv, docs, deny, zizmor]
	runs-on: ubuntu-latest
	steps:
	- name: Verify every needed job succeeded
	env:
	NEEDS: ${{ toJSON(needs) }}
	run: \|
	echo "$NEEDS" \| jq .
	echo "$NEEDS" \| jq -e 'to_entries \| all(.value.result == "success")' > /dev/null

Navigation Menu

release: v0.3.1 — the pixel path, tested (#40) #18

Workflow file

release: v0.3.1 — the pixel path, tested (#40) #18

Uh oh!

Workflow file for this run