chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2… #493
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| # Default every job to read-only. Jobs that need more declare it explicitly. | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| name: Test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # v (pinned SHA) | |
| with: | |
| toolchain: stable | |
| components: clippy, rustfmt | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - name: cargo fmt --check | |
| run: cargo fmt --all -- --check | |
| - name: cargo clippy | |
| run: cargo clippy --all-targets --all-features -- -D warnings | |
| - name: cargo test | |
| run: cargo test --all | |
| audit: | |
| name: Security audit | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| checks: write # rustsec/audit-check posts check-run annotations | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: cargo audit | |
| uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| msrv: | |
| name: MSRV (1.91) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # v (pinned SHA) | |
| with: | |
| toolchain: "1.91" | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - name: cargo build | |
| run: cargo build --all | |
| dependency-review: | |
| name: Dependency review | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Dependency review | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| mcp-smoke: | |
| name: MCP smoke test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # v (pinned SHA) | |
| with: | |
| toolchain: stable | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - name: Build vastlint-mcp | |
| run: cargo build --release -p vastlint-mcp | |
| - name: MCP smoke — initialize + tools/list returns 7 tools | |
| run: | | |
| RESPONSE=$( | |
| ( | |
| echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"ci","version":"1.0"}}}' | |
| sleep 0.2 | |
| echo '{"jsonrpc":"2.0","method":"notifications/initialized","params":{}}' | |
| sleep 0.2 | |
| echo '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' | |
| sleep 1 | |
| ) | ./target/release/vastlint-mcp 2>/dev/null | |
| ) | |
| # capabilities must include tools | |
| echo "$RESPONSE" | grep -q '"tools"' || { | |
| echo "FAIL: initialize response missing tools capability" | |
| echo "$RESPONSE" | |
| exit 1 | |
| } | |
| echo "capabilities.tools present ✓" | |
| # tools/list must return exactly 7 tools | |
| TOOL_COUNT=$(echo "$RESPONSE" | grep '"tools":\[' | grep -o '"name":"' | wc -l | tr -d ' ') | |
| if [ "$TOOL_COUNT" -ne 7 ]; then | |
| echo "FAIL: expected 7 tools, got $TOOL_COUNT" | |
| echo "$RESPONSE" | |
| exit 1 | |
| fi | |
| echo "tools/list returned $TOOL_COUNT tools ✓" | |
| # each expected tool must be present | |
| for TOOL in validate_vast validate_vast_url fix_vast list_rules explain_rule inspect_vast; do | |
| echo "$RESPONSE" | grep -q "\"$TOOL\"" || { | |
| echo "FAIL: tool '$TOOL' missing from tools/list" | |
| echo "$RESPONSE" | |
| exit 1 | |
| } | |
| echo " $TOOL ✓" | |
| done | |
| doc: | |
| name: Documentation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # v (pinned SHA) | |
| with: | |
| toolchain: stable | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - name: cargo doc | |
| run: cargo doc --no-deps --workspace | |
| env: | |
| RUSTDOCFLAGS: -D warnings | |
| codeql: | |
| name: CodeQL (SAST) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write # upload SARIF results to GitHub Security tab | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@66b39da20ccc656acc90dd27ea30f5d458ec33ce # v3.28.19 | |
| with: | |
| languages: rust | |
| queries: security-and-quality | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # v (pinned SHA) | |
| with: | |
| toolchain: stable | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - name: Build for CodeQL | |
| run: cargo build --all | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@66b39da20ccc656acc90dd27ea30f5d458ec33ce # v3.28.19 | |
| with: | |
| category: rust | |
| # ── Fuzz (short-circuit run) ───────────────────────────────────────────────── | |
| # Runs each libFuzzer target for a short burst on every CI push/PR to catch | |
| # regressions early. The full OSS-Fuzz integration runs continuously in the | |
| # background; this job gives fast feedback without the OSS-Fuzz latency. | |
| # | |
| # Each target runs for 30 seconds — long enough to exercise many paths but | |
| # short enough not to block the CI queue. The corpus/ directories are seeded | |
| # with representative valid and invalid VAST XML from the test fixtures so the | |
| # fuzzer starts from a useful state rather than from scratch every run. | |
| fuzz: | |
| name: Fuzz (${{ matrix.target }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: [validate, fix, validate_wrapper] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install Rust nightly | |
| uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # v (pinned SHA) | |
| with: | |
| toolchain: nightly | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - name: Install cargo-fuzz | |
| run: cargo install cargo-fuzz | |
| - name: Seed corpus from test fixtures | |
| run: | | |
| mkdir -p fuzz/corpus/${{ matrix.target }} | |
| cp crates/vastlint-core/tests/fixtures/*.xml fuzz/corpus/${{ matrix.target }}/ 2>/dev/null || true | |
| - name: Run fuzzer (30 s) | |
| run: | | |
| cargo +nightly fuzz run ${{ matrix.target }} \ | |
| fuzz/corpus/${{ matrix.target }} \ | |
| -- -max_total_time=30 -timeout=10 |