Skip to content

fix(deps): update minor and patch dependencies #208

fix(deps): update minor and patch dependencies

fix(deps): update minor and patch dependencies #208

Workflow file for this run

name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
env:
CARGO_TERM_COLOR: always
RUSTFLAGS: -Dwarnings
jobs:
build-and-test:
name: Build, Test, Lint
runs-on: ubuntu-latest
container: archlinux:base-devel
steps:
- name: Install system dependencies
run: |
pacman -Syu --noconfirm \
git \
rust \
clang \
v4l-utils \
libxkbcommon \
wayland \
pam \
tpm2-tss
- uses: actions/checkout@v6
- name: Cache cargo registry and build
uses: Swatinem/rust-cache@v2
- name: Check formatting
run: cargo fmt --all -- --check
- name: Build workspace
run: cargo build --workspace
- name: Build workspace with TPM
run: cargo build --workspace --features tpm
- name: Run clippy
run: cargo clippy --workspace -- -D warnings
- name: Run clippy with TPM
run: cargo clippy --workspace --features tpm -- -D warnings
- name: Run tests
run: cargo test --workspace
- name: Build release binaries
run: |
cargo build --release --workspace
cargo build --release -p facelock-cli --features tpm
- name: Upload release binaries
uses: actions/upload-artifact@v7
with:
name: release-binaries
path: |
target/release/facelock
target/release/libpam_facelock.so
retention-days: 1
cargo-audit:
name: Supply-chain Audit (cargo-audit)
runs-on: ubuntu-latest
container: archlinux:base-devel
# Override the workflow-level -Dwarnings: this job compiles cargo-audit's
# own third-party dependency tree, which we don't control. A future
# warning upstream shouldn't fail this job for reasons unrelated to the
# audit itself. The real build/test/clippy jobs above keep -Dwarnings.
env:
RUSTFLAGS: ""
steps:
- name: Install system dependencies
run: |
pacman -Syu --noconfirm \
git \
rust
- uses: actions/checkout@v6
- name: Cache cargo registry and cargo-audit build
uses: Swatinem/rust-cache@v2
- name: Install cargo-audit
run: cargo install cargo-audit --locked
# Ignore policy (with justifications) lives in .cargo/audit.toml.
# Deny policy matches `just audit`: fail on any vulnerability (default),
# unmaintained, or unsound advisory that is not explicitly ignored.
- name: Run cargo audit
run: cargo audit --deny unmaintained --deny unsound
tpm-tests:
name: TPM Tests (swtpm)
runs-on: ubuntu-latest
container: archlinux:base-devel
needs: build-and-test
steps:
- name: Install dependencies
run: |
pacman -Syu --noconfirm \
git \
rust \
clang \
v4l-utils \
libxkbcommon \
wayland \
pam \
tpm2-tss \
swtpm
- uses: actions/checkout@v6
- name: Cache cargo registry and build
uses: Swatinem/rust-cache@v2
- name: Start swtpm
run: |
mkdir -p /tmp/swtpm
swtpm socket \
--tpmstate dir=/tmp/swtpm \
--tpm2 \
--ctrl type=tcp,port=2322 \
--server type=tcp,port=2321 \
--flags startup-clear &
sleep 2
- name: Run TPM tests
env:
TCTI: swtpm:host=localhost,port=2321
run: cargo test --workspace --features tpm
container-pam-test:
name: Container PAM Smoke Test
runs-on: ubuntu-latest
needs: build-and-test
steps:
- uses: actions/checkout@v6
- name: Download release binaries
uses: actions/download-artifact@v8
with:
name: release-binaries
path: target/release
- name: Make binaries executable
run: chmod +x target/release/facelock target/release/libpam_facelock.so
- name: Install system dependencies
run: |
sudo apt-get update
sudo apt-get install -y podman
- name: Build test container
run: |
if [ ! -f test/Containerfile ]; then
echo "No Containerfile found, skipping"
exit 0
fi
podman build -t facelock-pam-test -f test/Containerfile .
- name: Run container PAM tests
run: |
if [ -f test/Containerfile ]; then
podman run --rm facelock-pam-test
else
echo "No Containerfile, skipping"
fi