release: v0.8.1 #120
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| # Reused by release.yml so a release re-runs the exact same gates. | |
| workflow_call: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| jobs: | |
| fmt: | |
| name: fmt | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 | |
| with: | |
| toolchain: stable | |
| components: rustfmt | |
| - run: cargo fmt --all --check | |
| clippy: | |
| name: clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 | |
| with: | |
| toolchain: stable | |
| components: clippy | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 | |
| - run: cargo clippy --all-targets --all-features -- -D warnings | |
| # The end-to-end suite spawns the real binary inside a PTY it creates itself, | |
| # so it needs no TTY of its own and none of the tests touch the network: the | |
| # ones that call the GitHub API are #[ignore]d. | |
| test: | |
| name: test (${{ matrix.os }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 | |
| with: | |
| toolchain: stable | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 | |
| - run: cargo test --all-features | |
| env: | |
| # Every screen a failing wait embeds is also written here, so the | |
| # `report` step below can put it in the summary instead of leaving | |
| # it in a log someone has to scroll (termlens 0.10). | |
| TERMLENS_ARTIFACT_DIR: ${{ runner.temp }}/termlens | |
| # Again from a timezone that is already tomorrow. Reports are pinned to | |
| # `--today` precisely so they do not depend on when they run, and the way | |
| # that rule gets broken is a new assertion about whatever day CI happened | |
| # to see — which passes on the day it is written and fails the morning | |
| # after. The binaries are built by the step above, so this costs seconds. | |
| - run: cargo test --all-features --test art_cli | |
| env: | |
| TZ: Pacific/Kiritimati | |
| TERMLENS_ARTIFACT_DIR: ${{ runner.temp }}/termlens | |
| # The termlens-cli suite is `#[ignore]`d so a plain `cargo test` never | |
| # installs anything behind a contributor's back (the same arrangement | |
| # smoke.rs uses for the tests needing `gh`). CI is where it should run, | |
| # so CI asks for it by name. The install is the version the lockfile | |
| # names, so the tool and the library are one release. | |
| - run: cargo test --all-features --test cli -- --ignored | |
| env: | |
| TERMLENS_ARTIFACT_DIR: ${{ runner.temp }}/termlens | |
| # A PTY failure is a picture, and a log is the worst place to read one. | |
| # This renders every screen the suite left behind — and every insta | |
| # `.snap.new` — into the job summary, with SVG and HTML uploaded. It | |
| # installs termlens-cli itself, so nothing else here has to. | |
| - uses: vyncint/termlens/.github/actions/report@e1b96c8203fd727fa3458af395719c429966ee82 # v0.10.1 | |
| if: failure() | |
| with: | |
| name: termlens-report-${{ matrix.os }} | |
| # The `cfg(not(unix))` path — a probe that asks nothing, since reading | |
| # `/dev/tty` with O_NONBLOCK is a unix arrangement — is code the matrix above | |
| # never compiles. It went out of date exactly as you would expect: an | |
| # undocumented public function and a constant used only by the other branch, | |
| # both of them warnings that `-D warnings` turns into failures. | |
| windows: | |
| name: check (windows) | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 | |
| with: | |
| toolchain: stable | |
| components: clippy | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 | |
| - run: cargo clippy --all-targets --all-features -- -D warnings | |
| - run: cargo doc --no-deps --all-features | |
| env: | |
| RUSTDOCFLAGS: -D warnings | |
| # Not the end-to-end suite: `tests/smoke.rs` drives a real PTY through | |
| # termlens, which is its own question. The in-process tests are pure | |
| # arithmetic and colour, and they run anywhere. | |
| - run: cargo test --all-features --lib | |
| msrv: | |
| name: msrv | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Read MSRV from Cargo.toml | |
| id: msrv | |
| run: | | |
| msrv="$(sed -n 's/^rust-version *= *"\(.*\)"/\1/p' Cargo.toml)" | |
| echo "MSRV: ${msrv}" | |
| echo "msrv=${msrv}" >> "$GITHUB_OUTPUT" | |
| - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 | |
| with: | |
| toolchain: ${{ steps.msrv.outputs.msrv }} | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 | |
| - run: cargo check --locked --all-targets | |
| docs: | |
| name: docs | |
| runs-on: ubuntu-latest | |
| env: | |
| RUSTDOCFLAGS: -D warnings | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 | |
| with: | |
| toolchain: stable | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 | |
| - run: cargo doc --no-deps --all-features | |
| deny: | |
| name: deny | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2 | |
| # Workflow security audit (template injection, credential persistence, | |
| # unpinned actions, …). Accepted findings live in .github/zizmor.yml. | |
| # The release path's one untested script. Three behaviours sat in it | |
| # unnoticed — an empty section reported as absent, the oldest section | |
| # absorbing the link block — and the empty case would have published the | |
| # crate and *then* failed the release, leaving a version permanently on | |
| # crates.io with no GitHub release and no platform archives. | |
| release-scripts: | |
| name: release scripts | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - run: ./.github/scripts/test-extract-changelog.sh | |
| # The vendored termlens skill is refreshed by hand, and a stale copy is | |
| # silent: agents working here get guidance for a version that is no longer | |
| # the dependency. Nothing can diff it against upstream — the published crate | |
| # does not ship the skill — but the two versions agreeing is checkable, and | |
| # that is the drift that happens. | |
| skill-version: | |
| name: skill version | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - run: ./.github/scripts/check-skill-version.sh | |
| zizmor: | |
| name: zizmor | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Audit workflows at pedantic level | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| # Version pinned; bump deliberately alongside a fresh local audit. | |
| # The composite action is audited too: it pulls actions of its own, | |
| # and it is the piece other people run in their repositories. | |
| # `track.example.yml` is audited too, and is the file that most needs | |
| # it: its first line tells you to copy it into a public repository of | |
| # your own. It is not under `.github/workflows/`, so neither the glob | |
| # nor GitHub itself ever parsed it — CI was green and the one file | |
| # the gate existed for was the one it was not pointed at. | |
| run: >- | |
| pipx run zizmor==1.29.0 --persona=pedantic | |
| .github/workflows/ action/action.yml action/track.example.yml | |
| # Single stable job name for branch protection: require this one check and | |
| # matrix/job changes never break the required-checks configuration. | |
| required-green: | |
| name: required-green | |
| if: always() | |
| needs: [fmt, clippy, test, windows, msrv, docs, deny, zizmor, release-scripts, skill-version] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Verify every needed job succeeded | |
| env: | |
| NEEDS: ${{ toJSON(needs) }} | |
| run: | | |
| echo "$NEEDS" | jq . | |
| echo "$NEEDS" | jq -e 'to_entries | all(.value.result == "success")' > /dev/null |