Fix cargo-deny installation in CI #323
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Rust CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| jobs: | |
| checks: | |
| name: Format, lint, test, and audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install Rust toolchain | |
| shell: bash | |
| run: scripts/ci_install_rust.sh | |
| - name: Cache Rust build output | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| cache-on-failure: true | |
| - name: Install security and test tools | |
| uses: taiki-e/install-action@c7eb1735f09259a5035e8e5d44b1406b1cddc0fb # v2.83.0 | |
| with: | |
| tool: cargo-audit@0.22.2,cargo-nextest@0.9.140 | |
| fallback: none | |
| - name: Install crates.io release tools | |
| run: | | |
| cargo install --locked cargo-deny --version 0.20.2 | |
| cargo install --locked cargo-license --version 0.7.0 | |
| cargo install --locked cargo-sbom --version 0.10.0 | |
| - name: Run checks | |
| run: scripts/checks.sh | |
| - name: Run nextest | |
| run: cargo nextest run --all-features | |
| - name: Check fuzz-only dependencies | |
| run: scripts/check_fuzz.sh | |
| - name: Check performance harness dependencies | |
| run: scripts/check_perf.sh | |
| - name: Check dudect timing harness dependencies | |
| run: scripts/check_dudect.sh | |
| - name: Generate constant-time assembly evidence | |
| run: scripts/generate_ct_asm_evidence.sh | |
| - name: Generate SBOM | |
| run: scripts/generate-sbom.sh | |
| - name: Reproducible package/build check | |
| run: scripts/reproducible_build_check.sh | |
| - name: Install SIMD feature-bundle targets | |
| run: rustup target add aarch64-unknown-linux-gnu wasm32-unknown-unknown | |
| - name: Check SIMD feature bundles | |
| run: scripts/check_simd_feature_bundles.sh | |
| rust-version-compat: | |
| name: Rust compatibility (${{ matrix.toolchain }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| toolchain: | |
| - 1.90.0 | |
| - 1.91.0 | |
| - 1.92.0 | |
| - 1.93.0 | |
| - 1.94.0 | |
| - 1.95.0 | |
| - 1.96.0 | |
| - 1.96.1 | |
| - 1.97.0 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install Rust toolchain | |
| run: rustup toolchain install ${{ matrix.toolchain }} | |
| - name: Cache Rust build output | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| cache-on-failure: true | |
| key: rust-${{ matrix.toolchain }} | |
| - name: Check all features | |
| run: cargo +${{ matrix.toolchain }} check --all-features | |
| - name: Check no-default-features library | |
| run: cargo +${{ matrix.toolchain }} check --no-default-features --lib | |
| platform: | |
| name: Platform tests (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: | |
| - ubuntu-latest | |
| - macos-latest | |
| - macos-15 | |
| - macos-26 | |
| - macos-15-intel | |
| - windows-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install Rust toolchain | |
| shell: bash | |
| run: scripts/ci_install_rust.sh | |
| - name: Cache Rust build output | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| cache-on-failure: true | |
| - name: Run macOS verification | |
| if: startsWith(matrix.os, 'macos') | |
| run: scripts/check_macos.sh | |
| - name: Test default features | |
| if: ${{ !startsWith(matrix.os, 'macos') }} | |
| run: cargo test --all-targets | |
| - name: Test all features | |
| if: ${{ !startsWith(matrix.os, 'macos') }} | |
| run: cargo test --all-targets --all-features | |
| - name: Check no_std library build | |
| if: ${{ !startsWith(matrix.os, 'macos') }} | |
| run: cargo check --no-default-features --lib | |
| - name: Test no default features | |
| if: ${{ !startsWith(matrix.os, 'macos') }} | |
| run: cargo test --no-default-features --all-targets | |
| target-build: | |
| name: no_std target build (${{ matrix.target }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - x86_64-unknown-linux-gnu | |
| - aarch64-unknown-linux-gnu | |
| - x86_64-unknown-freebsd | |
| - wasm32-unknown-unknown | |
| - thumbv7em-none-eabihf | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install Rust toolchain | |
| shell: bash | |
| run: scripts/ci_install_rust.sh | |
| - name: Install Rust target | |
| run: rustup target add ${{ matrix.target }} | |
| - name: Cache Rust build output | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| cache-on-failure: true | |
| - name: Check no_std simd-reserved build | |
| run: scripts/check_targets.sh ${{ matrix.target }} | |
| - name: Check no-alloc portability smoke | |
| run: scripts/check_no_alloc_smoke.sh ${{ matrix.target }} | |
| miri: | |
| name: Miri | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 180 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install Rust toolchain | |
| shell: bash | |
| run: scripts/ci_install_rust.sh | |
| - name: Install nightly with Miri | |
| run: | | |
| rustup toolchain install nightly --component miri | |
| cargo +nightly miri setup | |
| - name: Run Miri tests | |
| run: scripts/check_miri.sh |