fix(deps): update minor and patch dependencies #208
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: -Dwarnings | |
| jobs: | |
| build-and-test: | |
| name: Build, Test, Lint | |
| runs-on: ubuntu-latest | |
| container: archlinux:base-devel | |
| steps: | |
| - name: Install system dependencies | |
| run: | | |
| pacman -Syu --noconfirm \ | |
| git \ | |
| rust \ | |
| clang \ | |
| v4l-utils \ | |
| libxkbcommon \ | |
| wayland \ | |
| pam \ | |
| tpm2-tss | |
| - uses: actions/checkout@v6 | |
| - name: Cache cargo registry and build | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Check formatting | |
| run: cargo fmt --all -- --check | |
| - name: Build workspace | |
| run: cargo build --workspace | |
| - name: Build workspace with TPM | |
| run: cargo build --workspace --features tpm | |
| - name: Run clippy | |
| run: cargo clippy --workspace -- -D warnings | |
| - name: Run clippy with TPM | |
| run: cargo clippy --workspace --features tpm -- -D warnings | |
| - name: Run tests | |
| run: cargo test --workspace | |
| - name: Build release binaries | |
| run: | | |
| cargo build --release --workspace | |
| cargo build --release -p facelock-cli --features tpm | |
| - name: Upload release binaries | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: release-binaries | |
| path: | | |
| target/release/facelock | |
| target/release/libpam_facelock.so | |
| retention-days: 1 | |
| cargo-audit: | |
| name: Supply-chain Audit (cargo-audit) | |
| runs-on: ubuntu-latest | |
| container: archlinux:base-devel | |
| # Override the workflow-level -Dwarnings: this job compiles cargo-audit's | |
| # own third-party dependency tree, which we don't control. A future | |
| # warning upstream shouldn't fail this job for reasons unrelated to the | |
| # audit itself. The real build/test/clippy jobs above keep -Dwarnings. | |
| env: | |
| RUSTFLAGS: "" | |
| steps: | |
| - name: Install system dependencies | |
| run: | | |
| pacman -Syu --noconfirm \ | |
| git \ | |
| rust | |
| - uses: actions/checkout@v6 | |
| - name: Cache cargo registry and cargo-audit build | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| # Ignore policy (with justifications) lives in .cargo/audit.toml. | |
| # Deny policy matches `just audit`: fail on any vulnerability (default), | |
| # unmaintained, or unsound advisory that is not explicitly ignored. | |
| - name: Run cargo audit | |
| run: cargo audit --deny unmaintained --deny unsound | |
| tpm-tests: | |
| name: TPM Tests (swtpm) | |
| runs-on: ubuntu-latest | |
| container: archlinux:base-devel | |
| needs: build-and-test | |
| steps: | |
| - name: Install dependencies | |
| run: | | |
| pacman -Syu --noconfirm \ | |
| git \ | |
| rust \ | |
| clang \ | |
| v4l-utils \ | |
| libxkbcommon \ | |
| wayland \ | |
| pam \ | |
| tpm2-tss \ | |
| swtpm | |
| - uses: actions/checkout@v6 | |
| - name: Cache cargo registry and build | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Start swtpm | |
| run: | | |
| mkdir -p /tmp/swtpm | |
| swtpm socket \ | |
| --tpmstate dir=/tmp/swtpm \ | |
| --tpm2 \ | |
| --ctrl type=tcp,port=2322 \ | |
| --server type=tcp,port=2321 \ | |
| --flags startup-clear & | |
| sleep 2 | |
| - name: Run TPM tests | |
| env: | |
| TCTI: swtpm:host=localhost,port=2321 | |
| run: cargo test --workspace --features tpm | |
| container-pam-test: | |
| name: Container PAM Smoke Test | |
| runs-on: ubuntu-latest | |
| needs: build-and-test | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Download release binaries | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: release-binaries | |
| path: target/release | |
| - name: Make binaries executable | |
| run: chmod +x target/release/facelock target/release/libpam_facelock.so | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y podman | |
| - name: Build test container | |
| run: | | |
| if [ ! -f test/Containerfile ]; then | |
| echo "No Containerfile found, skipping" | |
| exit 0 | |
| fi | |
| podman build -t facelock-pam-test -f test/Containerfile . | |
| - name: Run container PAM tests | |
| run: | | |
| if [ -f test/Containerfile ]; then | |
| podman run --rm facelock-pam-test | |
| else | |
| echo "No Containerfile, skipping" | |
| fi |