Resolve hook interpolation at the run boundary and enable secrets in ho… #1585
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Rust | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "lib/crates/**" | |
| - "test/**" | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - ".cargo/**" | |
| - ".config/**" | |
| - "bin/dev/**" | |
| - "docs/public/reference/cli.mdx" | |
| - "docs/public/reference/user-configuration.mdx" | |
| - "openapi/**" | |
| - ".github/workflows/rust.yml" | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "lib/crates/**" | |
| - "test/**" | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - ".cargo/**" | |
| - ".config/**" | |
| - "bin/dev/**" | |
| - "docs/public/reference/cli.mdx" | |
| - "docs/public/reference/user-configuration.mdx" | |
| - "openapi/**" | |
| - ".github/workflows/rust.yml" | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| fmt: | |
| name: Format | |
| runs-on: ubuntu-24.04-x86-32-cores | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable | |
| with: | |
| toolchain: nightly-2026-04-14 | |
| components: rustfmt | |
| - run: cargo +nightly-2026-04-14 fmt --check --all | |
| clippy: | |
| name: Clippy | |
| runs-on: ubuntu-24.04-x86-32-cores | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable | |
| with: | |
| toolchain: nightly-2026-04-14 | |
| components: clippy | |
| - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 | |
| with: | |
| cache-on-failure: true | |
| - name: Verify legacy auth identity removal | |
| run: | | |
| ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*"disabled"' \ | |
| lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml | |
| - run: cargo +nightly-2026-04-14 clippy --locked --workspace --all-targets -- -D warnings | |
| generated-docs: | |
| name: Generated Docs | |
| runs-on: ubuntu-24.04-x86-32-cores | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable | |
| - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 | |
| with: | |
| cache-on-failure: true | |
| - run: cargo --locked dev docs check | |
| test: | |
| name: Test (Linux) | |
| runs-on: ubuntu-24.04-x86-32-cores | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable | |
| - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 | |
| with: | |
| cache-on-failure: true | |
| - uses: taiki-e/install-action@773334c0e05d7e699e4d78234494308223f3a2cf # nextest | |
| - run: cargo nextest run --locked --workspace --status-level slow --profile ci | |
| # Twin-mode e2e suites. These are hermetic (in-process twin provider, no | |
| # secrets): FABRO_TEST_MODE defaults to twin, so live-only tests | |
| # self-skip. Scoped to the packages whose ignored tests are fully green | |
| # in twin mode; widen as the remaining suites are fixed up for CI. | |
| # Must not use the e2e nextest profile here: NEXTEST_PROFILE=e2e implies | |
| # strict mode, which fails (rather than skips) live tests without keys. | |
| - run: cargo nextest run --locked --workspace --status-level slow --profile ci --run-ignored only -E 'package(fabro-agent) + package(fabro-llm) + package(twin-openai)' | |
| test-macos: | |
| name: Test (macOS) | |
| if: github.event_name == 'workflow_dispatch' | |
| runs-on: macos-15 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable | |
| - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 | |
| with: | |
| cache-on-failure: true | |
| - uses: taiki-e/install-action@773334c0e05d7e699e4d78234494308223f3a2cf # nextest | |
| - run: cargo nextest run --locked --workspace --status-level slow --profile ci |