CI hardening: de-flake embedded Postgres, gate releases on version bump, edition 2024, MSRV check #342

Workflow file for this run

	# `push` is restricted to `main` (as in the Python workflows): a PR from a
	# branch in this repository would otherwise fire two identical runs, which race
	# each other into the unauthenticated GitHub API rate limit while downloading
	# the embedded Postgres archives (see #76).
	on:
	push:
	branches:
	- main
	pull_request:

	name: Rust CI

	jobs:
	cargo_check:
	name: Cargo Check
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
	with:
	toolchain: stable
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
	- run: cargo check --locked

	# `rust-version` in [workspace.package] is a promise to downstream consumers;
	# without this job nothing ever tested it, and any accidental use of a newer
	# language or std feature would ship silently.
	#
	# Library targets only (no `--all-targets`): the dev-dependency floor is far
	# higher than the library's -- postgresql_embedded 0.21 / sqlx 0.9 need 1.94 --
	# so building the test targets here would prove nothing about what a consumer
	# of the published crate needs.
	msrv:
	name: MSRV (1.85)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
	with:
	# Keep in sync with `rust-version` in the root Cargo.toml.
	toolchain: "1.85"
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
	- run: cargo check --workspace --locked

	fmt:
	name: Fmt
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
	with:
	toolchain: stable
	components: rustfmt
	- run: cargo fmt --all -- --check

	clippy:
	name: Clippy
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
	with:
	toolchain: stable
	components: clippy
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
	# `--workspace --all-targets` rather than `--all`: `--all` only lints the
	# default targets (lib/bins), so benches and test-only code were never
	# checked.
	- run: cargo clippy --locked --workspace --all-targets -- -D warnings

	test:
	name: Test Suite
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
	with:
	toolchain: stable
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
	- uses: ./.github/actions/cache-embedded-postgres
	- name: Run tests
	# See the note on the Coverage job: the integration tests download an
	# embedded Postgres from GitHub releases and need an authenticated
	# client to stay inside the API rate limit (#76).
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: cargo test --locked

	coverage:
	name: Coverage
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
	with:
	toolchain: stable
	# Required by cargo-llvm-cov (it drives llvm-profdata/llvm-cov).
	components: llvm-tools-preview
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
	- uses: taiki-e/install-action@82cd3e7658a6f96c86c0234aeeda1748937cb0a1 # v2.85.13
	with:
	tool: cargo-llvm-cov
	- uses: ./.github/actions/cache-embedded-postgres
	- name: Collect coverage
	# The integration tests download an embedded Postgres from GitHub
	# releases via postgresql_embedded, which shares the unauthenticated
	# API rate limit with every other job on the runner (see #76).
	# `postgresql_archive` picks up GITHUB_TOKEN and authenticates, which
	# raises the limit enough to make this reliable.
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: cargo llvm-cov --workspace --locked --lcov --output-path lcov.info
	# A CODECOV_TOKEN repository secret is required for the report to land:
	# tokenless uploads are rejected here ("Token required because branch is
	# protected"). `fail_ci_if_error: false` keeps that -- and any Codecov
	# outage -- from failing the build; until the secret exists the upload is
	# simply a no-op.
	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
	with:
	files: lcov.info
	flags: rust
	token: ${{ secrets.CODECOV_TOKEN }}
	fail_ci_if_error: false

	# https://github.com/marketplace/actions/alls-green
	check: # This job does nothing and is only used for the branch protection
	name: pgpq Rust Check
	if: always()

	outputs:
	result: ${{ steps.all-green.outputs.result }}

	# `coverage` is deliberately not listed here: it is informational, and a
	# failure there (or at Codecov) should show up in the checks list without
	# blocking the branch-protection gate or the release job.
	needs:
	- cargo_check
	- msrv
	- fmt
	- clippy
	- test
	runs-on: ubuntu-latest

	steps:
	- name: Decide whether the needed jobs succeeded or failed
	uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
	id: all-green
	with:
	jobs: ${{ toJSON(needs) }}

	# Publishing an already-published version is a no-op that costs a job (see
	# #56). Ask crates.io whether the version in core/Cargo.toml is new rather
	# than letting `cargo publish` discover it. Deliberately not wired into the
	# `check` gate above: this job only decides whether to release.
	detect-release:
	name: Detect release
	runs-on: ubuntu-latest
	if: ${{ github.ref == 'refs/heads/main' }}
	permissions:
	contents: read
	outputs:
	should_release: ${{ steps.detect.outputs.should_release }}
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- name: Check whether pgpq is already on crates.io
	id: detect
	run: \|
	python3 scripts/check_published.py \
	--registry crates --package pgpq --manifest core/Cargo.toml

	release:
	name: Release
	runs-on: ubuntu-latest
	needs:
	- check
	- detect-release
	if: ${{ github.ref == 'refs/heads/main' && needs.detect-release.outputs.should_release == 'true' }}
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
	with:
	toolchain: stable
	- run: cargo publish --locked --package pgpq --token ${{ secrets.CRATES_TOKEN }}

Navigation Menu

CI hardening: de-flake embedded Postgres, gate releases on version bump, edition 2024, MSRV check #342

Workflow file

CI hardening: de-flake embedded Postgres, gate releases on version bump, edition 2024, MSRV check #342

Uh oh!

Workflow file for this run