arch-audit v0.6.x — checkpoint: Batches F→J landed #96
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: just ci (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy, rustfmt | |
| - uses: Swatinem/rust-cache@v2 | |
| # WHY: `just ci` runs `cargo deny check`, `typos`, and | |
| # `cargo nextest run`. All three are external binaries — none ship | |
| # with the Rust toolchain. Using taiki-e/install-action fetches | |
| # prebuilt binaries (seconds) rather than `cargo install` (minutes), | |
| # which matters on the 3-OS matrix. Nextest swap landed in commit | |
| # adopting `cargo nextest run` workspace-wide (closes #121). | |
| # | |
| # WHY split Windows from Linux/macOS: taiki-e/install-action's | |
| # PowerShell wrapper aborts on windows-latest when the runner image | |
| # leaks BASH_FUNC_* env vars (Shellshock mitigation correctly | |
| # rejects them; their 10-iter retry doesn't catch it; manual reruns | |
| # don't help — see issue #137 for full analysis + reproduction). | |
| # cargo-binstall fetches the same prebuilt release binaries without | |
| # going through bash, sidestepping the env leak entirely. | |
| - name: Install just (Linux/macOS) | |
| if: runner.os != 'Windows' | |
| uses: taiki-e/install-action@just | |
| - name: Install cargo-deny (Linux/macOS) | |
| if: runner.os != 'Windows' | |
| uses: taiki-e/install-action@cargo-deny | |
| - name: Install typos (Linux/macOS) | |
| if: runner.os != 'Windows' | |
| uses: taiki-e/install-action@typos | |
| - name: Install cargo-nextest (Linux/macOS) | |
| if: runner.os != 'Windows' | |
| uses: taiki-e/install-action@cargo-nextest | |
| # WHY cargo-binstall on Windows only — workaround for #137. binstall | |
| # is a prebuilt-binary fetcher; doesn't invoke bash so the windows- | |
| # latest BASH_FUNC_* leak doesn't apply. Self-install is one zip | |
| # extract; per-tool install is ~5s. If the runner image fix lands | |
| # upstream, revert this step + drop the `if: runner.os != 'Windows'` | |
| # gates above and verify 5+ consecutive Windows runs stay green. | |
| - name: Install just/cargo-deny/typos/cargo-nextest (Windows via cargo-binstall — workaround #137) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| Invoke-WebRequest -Uri "https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-pc-windows-msvc.zip" -OutFile binstall.zip | |
| Expand-Archive binstall.zip -DestinationPath "$env:USERPROFILE\.cargo\bin" -Force | |
| cargo binstall --no-confirm --locked just cargo-deny typos-cli cargo-nextest | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22.12' | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| # WHY: Tauri v2 (crates/desktop) requires GTK3 + WebKit2GTK on | |
| # Linux. Without these, cargo build/clippy/test on the workspace | |
| # fails because tauri-build links against native libs. | |
| - name: Install Tauri Linux deps | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update -q | |
| sudo apt-get install -yq \ | |
| libgtk-3-dev \ | |
| libwebkit2gtk-4.1-dev \ | |
| libappindicator3-dev \ | |
| librsvg2-dev \ | |
| patchelf | |
| - name: Run just ci | |
| shell: bash | |
| run: just ci | |
| bindings-drift: | |
| name: bindings.ts drift check | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - uses: taiki-e/install-action@just | |
| # WHY: same Tauri Linux deps as the matrix job's Linux branch — | |
| # tauri-build links against GTK3 + WebKit2GTK on Linux. | |
| - name: Install Tauri Linux deps | |
| run: | | |
| sudo apt-get update -q | |
| sudo apt-get install -yq \ | |
| libgtk-3-dev \ | |
| libwebkit2gtk-4.1-dev \ | |
| libappindicator3-dev \ | |
| librsvg2-dev \ | |
| patchelf | |
| # WHY: regenerate bindings.ts via the specta-export feature and | |
| # fail the job if `git diff` shows the committed copy is stale. | |
| # Catches every Rust-side change to a #[tauri::command] signature, | |
| # a specta-derived type, or a CoreError variant that wasn't paired | |
| # with a bindings.ts commit. | |
| - name: Bindings drift check | |
| run: just bindings |