Bound fragmented HTTP/2 body growth #1366
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Rust CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| jobs: | |
| checks: | |
| name: Format, lint, test, and audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 75 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Install Rust toolchain | |
| run: rustup show | |
| - name: Install security tools | |
| run: | | |
| cargo install --locked cargo-deny --version 0.20.2 | |
| cargo install --locked cargo-audit --version 0.22.2 | |
| - name: Install SBOM tool | |
| run: cargo install --locked cargo-sbom --version 0.10.0 | |
| - name: Check formatting | |
| run: cargo fmt --all --check | |
| - name: Validate release metadata | |
| run: scripts/validate-release-metadata.sh | |
| - name: Check Markdown links | |
| run: perl scripts/check-doc-links.pl | |
| - name: Validate feature policy | |
| run: | | |
| scripts/validate-features.sh default | |
| scripts/validate-features.sh profile-core | |
| scripts/validate-features.sh profile-core,acme-client | |
| scripts/validate-features.sh profile-load-balancer | |
| scripts/validate-features.sh profile-full | |
| scripts/validate-features.sh profile-development | |
| scripts/validate-features.sh profile-web-server | |
| scripts/validate-features.sh profile-cache-edge | |
| scripts/validate-features.sh profile-proxy-edge | |
| scripts/validate-features.sh profile-load-balancer-edge | |
| scripts/validate-features.sh profile-privacy | |
| scripts/validate-features.sh profile-fips-openssl | |
| scripts/validate-features.sh profile-iso19790-openssl | |
| scripts/validate-features.sh profile-fips-rustls | |
| scripts/validate-features.sh profile-iso19790-rustls | |
| if scripts/validate-features.sh profile-privacy,metrics; then | |
| echo "profile-privacy,metrics unexpectedly passed feature validation" >&2 | |
| exit 1 | |
| fi | |
| if scripts/validate-features.sh profile-core,tls-openssl; then | |
| echo "profile-core,tls-openssl unexpectedly passed feature validation" >&2 | |
| exit 1 | |
| fi | |
| if scripts/validate-features.sh tls-rustls,tls-openssl; then | |
| echo "tls-rustls,tls-openssl unexpectedly passed feature validation" >&2 | |
| exit 1 | |
| fi | |
| if scripts/validate-features.sh tls-rustls,tls-rustls-fips; then | |
| echo "tls-rustls,tls-rustls-fips unexpectedly passed feature validation" >&2 | |
| exit 1 | |
| fi | |
| - name: Run clippy | |
| run: cargo clippy --all-targets -- -D warnings | |
| - name: Validate instant-acme patch provenance | |
| run: scripts/validate-instant-acme-patch.sh | |
| - name: Validate ACME mount-boundary test plan | |
| run: scripts/validate-acme-mount-boundary-plan.sh | |
| - name: Validate FIPS backend image evidence plan | |
| run: scripts/validate-fips-image-evidence-plan.sh | |
| - name: Validate panic policy on feature profiles | |
| run: | | |
| cargo clippy --no-default-features --features proxy,tls-rustls,acme --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features proxy,tls-rustls,acme-client --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features tls-rustls --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features profile-full --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features profile-web-server --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features profile-cache-edge --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features profile-proxy-edge --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features profile-web-server,php-fpm --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features profile-load-balancer-edge --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features proxy,web,tls-rustls,privacy-mode --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features profile-fips-openssl --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features profile-iso19790-openssl --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features profile-fips-rustls --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features profile-iso19790-rustls --all-targets -- -D warnings | |
| cargo clippy --no-default-features --features web --all-targets -- -D warnings | |
| - name: Validate native web TLS proof profiles | |
| run: scripts/validate-native-web-tls.sh check | |
| - name: Run default tests | |
| run: cargo test | |
| - name: Run isolated ACME mount-boundary regression | |
| run: FLUXHEIM_ACME_MOUNT_TEST_MODE=container FLUXHEIM_ACME_MOUNT_TEST_RUNTIME=docker scripts/smoke_acme_mount_boundary.sh | |
| - name: Validate OWASP Top 10 2025 baseline | |
| run: scripts/validate-owasp-top10-2025.sh check | |
| - name: Validate 1.0 core feature matrix | |
| run: scripts/validate-1-0-core.sh check | |
| - name: Validate 1.0 gateway fixtures | |
| run: scripts/validate-1-0-fixtures.sh | |
| - name: Build 1.0 core release matrix | |
| run: scripts/validate-1-0-core.sh release | |
| - name: Run incubator feature build tests | |
| run: | | |
| scripts/validate-features.sh tls-rustls | |
| # These incubator profile permutations are build coverage. Use | |
| # `cargo check --tests` so test cfgs compile without linking many | |
| # large test binaries under CodeQL's instrumented environment. | |
| cargo check --tests --no-default-features --features proxy,load-balancer | |
| cargo check --tests --no-default-features --features proxy,cache | |
| cargo check --tests --no-default-features --features cache | |
| cargo check --tests --no-default-features --features web | |
| cargo check --tests --no-default-features --features wasm-wasi,wasm-proxy-abi | |
| cargo check --tests --no-default-features --features profile-core | |
| cargo check --no-default-features --features profile-core,acme-client | |
| cargo check --no-default-features --features profile-static-site | |
| cargo check --no-default-features --features profile-reverse-proxy | |
| cargo check --no-default-features --features profile-cache-server | |
| cargo check --no-default-features --features profile-load-balancer | |
| cargo check --no-default-features --features profile-full | |
| cargo check --no-default-features --features profile-development | |
| cargo check --no-default-features --features profile-web-server | |
| cargo check --no-default-features --features profile-cache-edge | |
| cargo check --no-default-features --features profile-proxy-edge | |
| cargo check --no-default-features --features profile-web-server,php-fpm | |
| cargo check --no-default-features --features profile-load-balancer-edge | |
| cargo check --no-default-features --features profile-observability | |
| cargo check --no-default-features --features profile-privacy | |
| cargo check --no-default-features --features profile-fips-openssl | |
| cargo check --no-default-features --features profile-iso19790-openssl | |
| cargo check --no-default-features --features profile-fips-rustls | |
| cargo check --no-default-features --features profile-iso19790-rustls | |
| cargo check --no-default-features --features tls-rustls | |
| cargo check --tests --no-default-features --features proxy,metrics | |
| cargo check --tests --no-default-features --features proxy,tls-rustls,acme | |
| cargo check --tests --no-default-features --features proxy,tls-rustls,acme-client | |
| cargo check --tests --no-default-features --features proxy,web,tls-rustls,privacy-mode | |
| cargo check --no-default-features --features proxy,tls-rustls | |
| - name: Clean build artifacts before config validation | |
| run: cargo clean | |
| - name: Validate example configs | |
| run: | | |
| cargo run --quiet -- --check-config --config examples/fluxheim.toml | |
| cargo run --quiet -- --check-config --config examples/admin.toml | |
| cargo run --quiet -- --check-config --config examples/vhosts.toml | |
| cargo run --quiet -- --check-config --config examples/acme-http-01.toml | |
| cargo run --quiet -- --check-config --config examples/acme-actalis.toml | |
| cargo run --quiet -- --check-config --config examples/cache-storage-bin.toml | |
| cargo run --quiet -- --check-config --config examples/cache-encryption-local.toml | |
| cargo run --quiet -- --check-config --config examples/cache-encryption-openbao.toml | |
| cargo run --quiet -- --check-config --config examples/cache-peer-fill.toml | |
| cargo run --quiet --no-default-features --features profile-development --bin fluxheim-config-tester -- --config examples/load-balancer-enterprise.toml --profile load-balancer --no-runtime-paths | |
| cargo run --quiet --no-default-features --features profile-development --bin fluxheim-config-tester -- --config examples/load-balancer-exec-health.toml --profile load-balancer --no-runtime-paths | |
| cargo run --quiet --no-default-features --features profile-development --bin fluxheim-config-tester -- --config examples/load-balancer-mysql-health.toml --profile load-balancer --no-runtime-paths | |
| cargo run --quiet --no-default-features --features profile-development --bin fluxheim-config-tester -- --config examples/load-balancer-postgres-health.toml --profile load-balancer --no-runtime-paths | |
| cargo run --quiet --no-default-features --features profile-development --bin fluxheim-config-tester -- --config examples/load-balancer-redis-health.toml --profile load-balancer --no-runtime-paths | |
| cargo run --quiet --no-default-features --features profile-web-server,php-fpm,acme-client -- --check-config --config examples/php-fpm.toml | |
| cargo run --quiet -- --check-config --config examples/tls-modern.toml | |
| cargo run --quiet -- --check-config --config examples/tls-intermediate.toml | |
| cargo run --quiet -- --check-config --config examples/privacy.toml | |
| cargo run --quiet -- --check-config --config examples/macos-dev.toml | |
| cargo run --quiet -- --check-config --config examples/container/fluxheim.toml | |
| cargo run --quiet -- --check-config --config packaging/container/fluxheim.toml | |
| cargo run --quiet --no-default-features --features profile-full,acme-client,metrics,metrics-otlp,otel-tracing,otel-otlp -- --check-config --config packaging/container/fluxheim.toml | |
| cargo run --quiet --no-default-features --features profile-web-server,acme-client -- --check-config --config packaging/container/fluxheim.toml | |
| cargo run --quiet --no-default-features --features profile-cache-edge,acme-client -- --validate-config --config packaging/container/cache.toml | |
| cargo run --quiet --no-default-features --features profile-proxy-edge,acme-client -- --validate-config --config packaging/container/proxy.toml | |
| cargo run --quiet --no-default-features --features profile-web-server,php-fpm,acme-client -- --check-config --config packaging/container/php.toml | |
| cargo run --quiet --no-default-features --features profile-development --bin fluxheim-config-tester -- --config packaging/container/load-balancer.toml --profile load-balancer --no-runtime-paths | |
| cargo run --quiet -- --check-config --config examples/conf.d | |
| cargo run --quiet -- --check-config --config examples/gateway-1-0 | |
| cargo run --quiet --no-default-features --features profile-privacy -- --check-config --config examples/privacy.toml | |
| cargo run --quiet --no-default-features --features profile-fips-openssl --bin fluxheim-config-tester -- --config examples/fips-openssl.toml --profile fips-openssl --no-runtime-paths --crypto | |
| cargo run --quiet --no-default-features --features profile-iso19790-openssl --bin fluxheim-config-tester -- --config examples/iso19790-openssl.toml --profile iso19790-openssl --no-runtime-paths --crypto | |
| cargo run --quiet --no-default-features --features profile-fips-rustls --bin fluxheim-config-tester -- --config examples/fips-rustls.toml --profile fips-rustls --no-runtime-paths --crypto | |
| cargo run --quiet --no-default-features --features profile-iso19790-rustls --bin fluxheim-config-tester -- --config examples/iso19790-rustls.toml --profile iso19790-rustls --no-runtime-paths --crypto | |
| - name: Validate OpenSSL FIPS-capable profile | |
| run: scripts/validate-fips-openssl.sh check | |
| - name: Validate rustls/AWS-LC FIPS-capable profile | |
| run: scripts/validate-fips-rustls.sh check | |
| - name: Run localhost smoke tests | |
| run: | | |
| FLUXHEIM_SMOKE_SKIP_CORE_MATRIX=1 sh scripts/smoke_1_0_core.sh | |
| sh scripts/smoke_admin_listener.sh | |
| sh scripts/smoke_snapshot_lifecycle.sh | |
| sh scripts/smoke_static_local.sh | |
| sh scripts/smoke_stream_proxy.sh | |
| sh scripts/smoke_load_balancer.sh | |
| sh scripts/smoke_proxy_cache.sh | |
| sh scripts/smoke_storage_bin_cache.sh | |
| sh scripts/smoke_cache_encryption_local.sh | |
| sh scripts/smoke_peer_fill_cache.sh | |
| sh scripts/smoke_observability_local.sh | |
| - name: Check dependency policy | |
| run: cargo deny check | |
| - name: Check RustSec advisories | |
| run: cargo audit | |
| - name: Generate SBOM | |
| run: scripts/generate-sbom.sh | |
| - name: Verify reproducible release build | |
| run: scripts/reproducible_build_check.sh | |
| macos-arm64-dev: | |
| name: Apple Silicon macOS developer gate | |
| runs-on: macos-15 | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Install Rust toolchain | |
| run: rustup show | |
| - name: Check macOS developer profiles | |
| run: | | |
| cargo check --locked --no-default-features --features web --lib | |
| cargo check --locked --no-default-features --features profile-static-site --bin fluxheim | |
| cargo check --locked --no-default-features --features profile-reverse-proxy --bin fluxheim | |
| cargo check --locked --no-default-features --features profile-full --bin fluxheim | |
| cargo check --locked --no-default-features --features profile-development --bin fluxheim --bin fluxheim-acme --bin fluxheim-config-tester | |
| - name: Run macOS developer smoke | |
| run: sh scripts/smoke_macos_dev.sh |