feat(cli): guide 'no store selected' in dir command #16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Secure CI suite: format, lint (deny warnings), build, test on Linux + Windows, | |
| # plus supply-chain checks (cargo-deny advisories/licenses/sources/bans and | |
| # cargo-audit RUSTSEC). Runs on every PR and on pushes to main. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| # Least privilege: CI only needs to read the repo. No token can write. | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_INCREMENTAL: "0" # reproducible, smaller caches in CI | |
| RUST_BACKTRACE: "1" | |
| jobs: | |
| test: | |
| name: build & test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install pinned Rust toolchain | |
| shell: bash | |
| run: | | |
| rustup show # installs the toolchain pinned in rust-toolchain.toml (channel + components + targets) | |
| rustc --version && cargo --version | |
| - name: Cache cargo + target | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| target | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-cargo- | |
| # The CLI's build.rs embeds the real guest wasm (BINDING contract D6), so | |
| # the wasm32 guest must be built before anything that compiles digstore-cli. | |
| - name: Build guest wasm (required by digstore-cli build.rs) | |
| run: cargo build -p digstore-guest --target wasm32-unknown-unknown --release --locked | |
| - name: Format check | |
| if: matrix.os == 'ubuntu-latest' | |
| run: cargo fmt --all --check | |
| # Deny warnings (correctness, suspicious, security-relevant lints fail CI). | |
| # Two purely cosmetic style lints are allowed so the gate stays focused on | |
| # substance rather than churn over test-code idioms. | |
| - name: Clippy (deny warnings) | |
| run: > | |
| cargo clippy --workspace --all-targets --locked -- | |
| -D warnings | |
| -A clippy::default_constructed_unit_structs | |
| -A clippy::field_reassign_with_default | |
| - name: Build | |
| run: cargo build --workspace --locked | |
| - name: Test | |
| run: cargo test --workspace --locked | |
| supply-chain: | |
| name: supply-chain audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install pinned Rust toolchain | |
| run: rustup show | |
| - name: Cache cargo tools | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/bin | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| key: ${{ runner.os }}-cargo-tools-deny | |
| - name: Install cargo-deny | |
| run: cargo install cargo-deny --locked || true | |
| # Security-relevant supply-chain checks: RUSTSEC advisories (known/accepted | |
| # ones ignored in deny.toml), yanked crates, dependency bans, and the source | |
| # registry allow-list. cargo-deny is a superset of cargo-audit, so a separate | |
| # audit step would be redundant. License compliance is deferred (see deny.toml). | |
| - name: cargo deny check | |
| run: cargo deny check advisories bans sources |