chore(deps): improve supply chain security (#82) #434
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| workflow_dispatch: | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| test: | |
| name: Test ${{ matrix.os }} (${{ matrix.simd_mode }}) | |
| permissions: | |
| contents: read | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| simd_mode: [portable, native] | |
| env: | |
| FASTPFOR_SIMD_MODE: ${{ matrix.simd_mode }} | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: { persist-credentials: false, submodules: recursive } | |
| - if: github.event_name != 'release' && github.event_name != 'workflow_dispatch' | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| prefix-key: "v0-${{ matrix.simd_mode }}" | |
| - uses: taiki-e/install-action@56545b37b57562edd73171cb6c62cc509db4c34e # v2.81.7 | |
| with: { tool: 'just,cargo-binstall' } | |
| - run: just ci-test | |
| test-nightly: | |
| name: Nightly-specific tests | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: { persist-credentials: false, submodules: recursive } | |
| - if: github.event_name != 'release' && github.event_name != 'workflow_dispatch' | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - uses: taiki-e/install-action@56545b37b57562edd73171cb6c62cc509db4c34e # v2.81.7 | |
| with: { tool: 'just' } | |
| - run: rustup install nightly --profile minimal | |
| - run: just test-publish | |
| test-msrv: | |
| name: Test MSRV | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: { persist-credentials: false, submodules: recursive } | |
| - if: github.event_name != 'release' && github.event_name != 'workflow_dispatch' | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - uses: taiki-e/install-action@56545b37b57562edd73171cb6c62cc509db4c34e # v2.81.7 | |
| with: { tool: 'just' } | |
| - name: Read MSRV | |
| id: msrv | |
| run: echo "value=$(just get-msrv)" >> $GITHUB_OUTPUT | |
| - name: Install MSRV Rust ${{ steps.msrv.outputs.value }} | |
| uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 | |
| with: | |
| toolchain: ${{ steps.msrv.outputs.value }} | |
| - run: just ci_mode=0 ci-test-msrv # Ignore warnings in MSRV | |
| fuzz: | |
| name: Fuzz | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| env: | |
| # The number of seconds to run the fuzz target. | |
| FUZZ_TIME: 60 | |
| strategy: | |
| matrix: | |
| include: | |
| - fuzz_target: cpp_roundtrip | |
| - fuzz_target: encode_oracle | |
| - fuzz_target: decode_oracle | |
| - fuzz_target: decode_arbitrary | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: { persist-credentials: false, submodules: recursive } | |
| # Install the nightly Rust channel. | |
| - run: rustup toolchain install nightly | |
| - run: rustup default nightly | |
| # Install and cache `cargo-fuzz`. | |
| - uses: taiki-e/install-action@56545b37b57562edd73171cb6c62cc509db4c34e # v2.81.7 | |
| with: { tool: 'cargo-binstall' } | |
| - run: cargo binstall -y cargo-fuzz@0.13.1 # Pinned to avoid breakage. | |
| # Build and then run the fuzz target. | |
| # --target x86_64-unknown-linux-gnu is necessary to not default to musl, which is not supported by cargo-fuzz. | |
| - run: cargo fuzz build --target x86_64-unknown-linux-gnu ${{ matrix.fuzz_target }} | |
| - run: cargo fuzz run --target x86_64-unknown-linux-gnu ${{ matrix.fuzz_target }} -- -max_total_time=${{ env.FUZZ_TIME }} | |
| # Upload fuzzing artifacts on failure for post-mortem debugging. | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: failure() | |
| with: | |
| name: fuzzing-artifacts-${{ matrix.fuzz_target }}-${{ github.sha }} | |
| path: fuzz/artifacts | |
| coverage: | |
| name: Code Coverage | |
| permissions: | |
| contents: read | |
| if: github.event_name != 'release' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: { persist-credentials: false, submodules: recursive } | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - uses: taiki-e/install-action@56545b37b57562edd73171cb6c62cc509db4c34e # v2.81.7 | |
| with: { tool: 'just,cargo-llvm-cov' } | |
| - name: Generate code coverage | |
| run: just ci-coverage | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: target/llvm-cov/codecov.info | |
| # This job checks if any of the previous jobs failed or were canceled. | |
| # This approach also allows some jobs to be skipped if they are not needed. | |
| ci-passed: | |
| permissions: {} | |
| needs: [ test, test-nightly, test-msrv, fuzz ] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Result of the needed steps | |
| run: echo "${{ toJSON(needs) }}" | |
| - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') | |
| run: exit 1 | |
| release: | |
| # Some dependencies of the `ci-passed` job might be skipped, but we still want to run if the `ci-passed` job succeeded. | |
| if: always() && startsWith(github.ref, 'refs/tags/') && needs.ci-passed.result == 'success' | |
| name: Publish to crates.io | |
| permissions: | |
| contents: read | |
| needs: [ ci-passed ] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: { persist-credentials: false, submodules: recursive } | |
| - name: Publish to crates.io | |
| run: cargo publish | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} |