runtime: fix clippy lints for Rust 1.97 #286
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # Least privilege: this workflow only checks out and builds/tests the code. | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Free disk space | |
| run: | | |
| sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL | |
| sudo docker image prune --all --force | |
| df -h / | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| submodules: recursive | |
| - name: Install protoc | |
| run: sudo apt-get install -y protobuf-compiler | |
| - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable (pinned) | |
| with: | |
| toolchain: stable | |
| - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| - run: cargo fmt --check | |
| - run: cargo clippy --workspace -- -D warnings | |
| - run: cargo test --workspace | |
| - name: Lint Cedar policies | |
| run: | | |
| files=$(git ls-files '*.cedar' 2>/dev/null || true) | |
| if [ -n "$files" ]; then | |
| python3 .github/scripts/lint-cedar-policies.py $files | |
| else | |
| echo "No .cedar files tracked — skipping lint." | |
| fi | |
| # Feature combination tests — verify minimal and no-default builds compile | |
| - name: Test minimal build (no default features) | |
| run: cargo check -p symbi-runtime --no-default-features | |
| - name: Test without vector backends | |
| run: cargo test -p symbi-runtime --no-default-features --features keychain | |
| # Lint ALL feature-gated code with -D warnings (compile-only; mirrors the | |
| # `just clippy` all-features gate so feature code can't merge with warnings | |
| # the default-features clippy above never sees). | |
| - name: Clippy with all features | |
| run: cargo clippy -p symbi-runtime --all-features -- -D warnings | |
| # Test the commonly-enabled features adopters actually build with. Excludes | |
| # embedding-models / vector backends, whose tests pull large model/data | |
| # downloads unsuitable for CI — those stay covered by the clippy step above. | |
| - name: Test major features | |
| run: cargo test -p symbi-runtime --features http-api,cloud-llm,cedar,metrics,cron | |
| # Experimental session feature (off by default) — verify the opt-in build. | |
| - name: Check session feature (runtime) | |
| run: cargo check -p symbi-runtime --no-default-features --features keychain,session | |
| - name: Test session feature (repl-core) | |
| run: cargo test -p repl-core --features session | |
| msrv: | |
| # Verify the declared MSRV (workspace.package.rust-version) actually builds. | |
| # CI's main job uses `stable`, which silently tolerates newer-than-MSRV APIs; | |
| # this job pins the floor so an accidental bump can't merge green. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Free disk space | |
| run: | | |
| sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL | |
| sudo docker image prune --all --force | |
| df -h / | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| submodules: recursive | |
| - name: Install protoc | |
| run: sudo apt-get install -y protobuf-compiler | |
| - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # pinned action, explicit MSRV toolchain | |
| with: | |
| toolchain: "1.89" | |
| - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| - run: cargo check --workspace | |
| fuzz: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Free disk space | |
| run: | | |
| sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL | |
| sudo docker image prune --all --force | |
| df -h / | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| submodules: recursive | |
| - name: Install protoc | |
| run: sudo apt-get install -y protobuf-compiler | |
| # Pin nightly to avoid str::as_str() breakage in shellexpand 3.1.1 | |
| # (rust-lang/rust#152961). Unpin once revert #152963 lands in nightly. | |
| - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable (pinned, used here with explicit toolchain override) | |
| with: | |
| toolchain: nightly-2026-02-21 | |
| - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| with: | |
| workspaces: tools/fuzz | |
| - name: Install cargo-fuzz | |
| run: cargo install cargo-fuzz --version 0.13.1 --locked | |
| - name: Fuzz (short CI run) | |
| run: | | |
| cd tools/fuzz | |
| for target in \ | |
| policy_parser \ | |
| fail_closed_tool_invocation \ | |
| tofu_key_substitution \ | |
| slack_signature_verification \ | |
| enforcement_policy_matrix \ | |
| dsl_lexer_parser \ | |
| schema_verification_garbage \ | |
| sensitive_arg_masking \ | |
| tool_substitution_detection \ | |
| dsl_structure_aware \ | |
| schemapin_keystore_roundtrip \ | |
| dsl_evaluator \ | |
| mattermost_signature_verification \ | |
| crypto_roundtrip \ | |
| webhook_verify_generic \ | |
| api_key_store \ | |
| policy_evaluation \ | |
| comm_policy_evaluate \ | |
| messaging_request_json \ | |
| remote_envelope \ | |
| secure_message_pipeline; do | |
| echo "--- Fuzzing $target (15s) ---" | |
| cargo fuzz run --fuzz-dir . "$target" -- -max_total_time=15 || exit 1 | |
| done |