pg-migration-lint/.github/workflows/ci.yml at f14fb59e5f1d3997a37bb274dadbbb653e7921bf · robert-sjoblom/pg-migration-lint · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly audit on Mondays at 06:00 UTC
    - cron: "0 6 * * 1"

env:
  CARGO_TERM_COLOR: always
  # The ubuntu-latest runner has clang-18 + libclang pre-installed;
  # point bindgen at it so we can skip apt-get install libclang-dev.
  LIBCLANG_PATH: /usr/lib/llvm-18/lib

jobs:
  check:
    name: Check (fmt, clippy, compile)
    runs-on: ubuntu-latest
    # Skip on scheduled runs (only audit needs the weekly trigger)
    if: github.event_name != 'schedule'
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2

      - name: Check formatting
        run: cargo fmt --check

      - name: Run Clippy
        run: cargo clippy --all-targets -- -D warnings

      - name: Check compilation
        run: cargo check

  test:
    name: Test
    runs-on: ubuntu-latest
    needs: check
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2

      - name: Run tests
        run: cargo test

  build:
    name: Build (release)
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2

      - name: Build release binary
        run: cargo build --release

      - name: Upload release binary
        uses: actions/upload-artifact@v6
        with:
          name: pg-migration-lint
          path: target/release/pg-migration-lint
          if-no-files-found: error
          retention-days: 14

  build-bridge:
    name: Build Liquibase bridge JAR
    runs-on: ubuntu-latest
    # Skip on scheduled runs (only audit needs the weekly trigger)
    if: github.event_name != 'schedule'
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Build fat JAR with Maven (via Docker)
        run: |
          docker run --rm \
            -v "$PWD/bridge:/build" \
            -w /build \
            maven:3.9-eclipse-temurin-21 \
            sh -c 'mvn package -q -DskipTests && cp target/liquibase-bridge-1.0.0.jar target/liquibase-bridge.jar'

      - name: Upload bridge JAR
        uses: actions/upload-artifact@v6
        with:
          name: liquibase-bridge
          path: bridge/target/liquibase-bridge.jar
          if-no-files-found: error
          retention-days: 14

  deny:
    name: Deny (licenses, advisories, duplicates)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: EmbarkStudios/cargo-deny-action@v2

  audit:
    name: Security audit
    runs-on: ubuntu-latest
    # Run on PRs, pushes to main, and the weekly schedule
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Run audit
        run: cargo audit