Andy Dixon
400d11ea4f
- Release Builds: the build/test matrix ran ~1,400 third-party build scripts and tests with a contents:write token persisted in .git/config. It now runs with contents:read and persist-credentials: false; a separate publish job (no project or dependency code) downloads the artefacts, writes SHA256SUMS and attaches both to the release. The release now waits for every platform instead of publishing partially. - CI/Fuzz checkouts don't persist credentials; cargo-audit is pinned (0.22.2), fails on yanked crates, and also audits fuzz/Cargo.lock; fuzz runs set -timeout=10 so slow-input bugs (like the IRC OSC one) are reported instead of hiding under libFuzzer's 20-minute default. - updates/index.php: array-valued query parameters no longer raise TypeErrors/warnings; nosniff header.
51 lines
1.8 KiB
YAML
51 lines
1.8 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
test:
|
|
name: Test (${{ matrix.os }})
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-22.04, macos-14, windows-latest]
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
working-directory: rust
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
persist-credentials: false
|
|
- name: Linux dependencies (GUI libs, and sshd for the SSH integration tests)
|
|
if: runner.os == 'Linux'
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev libasound2-dev openssh-server
|
|
- run: cargo test --locked --workspace
|
|
- run: cargo fmt --all --check
|
|
- run: cargo clippy --locked --workspace --all-targets -- -D warnings
|
|
|
|
audit:
|
|
name: Dependency audit
|
|
runs-on: ubuntu-22.04
|
|
defaults:
|
|
run:
|
|
working-directory: rust
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
persist-credentials: false
|
|
- run: cargo install cargo-audit --version 0.22.2 --locked
|
|
# Ignored advisories and their reasons live in rust/.cargo/audit.toml. Yanked crates
|
|
# fail the build; the fuzz workspace has its own lockfile, so it's audited too.
|
|
- run: cargo audit --deny yanked
|
|
- run: cargo audit --deny yanked --file fuzz/Cargo.lock
|