feat(vault): clipboard hardening — clear-on-lock, backend trait, OSC52, configurable interval #18
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: GPL-3.0-or-later | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: "-D warnings" | |
| jobs: | |
| fmt: | |
| name: rustfmt | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt | |
| - run: cargo fmt --all -- --check | |
| clippy: | |
| name: clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo clippy --workspace --all-targets --all-features -- -D warnings | |
| test: | |
| name: test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo build --workspace --all-targets | |
| - run: cargo test --workspace --all-targets | |
| headless: | |
| name: headless build (no TUI / clipboard deps) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| # PRD G6: the server install path must keep building — the CLI behind | |
| # its `cli` feature gate, and the agent without the clipboard's | |
| # X11/Wayland dependency tree. | |
| - run: cargo build -p vault-cli --no-default-features --features cli | |
| - run: cargo build -p vault-agent --no-default-features | |
| version-gate: | |
| name: vault --version emits §13.2 attribution | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo build --bin vault --release | |
| - name: Verify attribution block | |
| run: | | |
| out=$(./target/release/vault --version) | |
| echo "$out" | |
| echo "$out" | grep -q "Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org>" \ | |
| && echo "$out" | grep -q "GPL-3.0-or-later" \ | |
| && echo "$out" | grep -q "https://Vault.SpacecraftSoftware.org/" | |
| audit: | |
| name: cargo-audit | |
| runs-on: ubuntu-latest | |
| # audit-check posts findings as a check run — needs checks:write. Job-level | |
| # permissions replace the default set, so contents:read is restated for | |
| # checkout. | |
| permissions: | |
| contents: read | |
| checks: write | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: rustsec/audit-check@v2 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| # Build-time / transitive advisories from the ratatui TUI tree, kept in | |
| # lock-step with deny.toml's policy (see that file for the paste | |
| # rationale). Both are informational (no fix that doesn't mean dropping | |
| # ratatui); revisit when ratatui's tree updates. | |
| # RUSTSEC-2024-0436 — paste (unmaintained, build-time proc-macro) | |
| # RUSTSEC-2026-0002 — lru 0.12.5 (unsound IterMut; transitive via ratatui) | |
| ignore: RUSTSEC-2024-0436,RUSTSEC-2026-0002 | |
| deny: | |
| name: cargo-deny | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: EmbarkStudios/cargo-deny-action@v2 |