Andy Dixon
b325097602
- ci.yml declares permissions: contents: read instead of the default token scope. - Every action is pinned to the commit its current tag points at (checkout v4.4.0, upload-artifact v4.6.2, action-gh-release v2.6.2), so a moved tag can't change what runs with release write access. - A cargo audit job runs on every push; the single ignored advisory (RUSTSEC-2023-0071, rsa via russh, no fix available) is recorded with its rationale in rust/.cargo/audit.toml (SEC-20261012-019, -012). Release signing and macOS notarisation are not part of this change.
45 lines
1.4 KiB
YAML
45 lines
1.4 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
test:
|
|
name: Test (${{ matrix.os }})
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-22.04, macos-14, windows-latest]
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
working-directory: rust
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
- name: Linux dependencies (GUI libs, and sshd for the SSH integration tests)
|
|
if: runner.os == 'Linux'
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev openssh-server
|
|
- run: cargo test --locked --workspace
|
|
- run: cargo fmt --all --check
|
|
- run: cargo clippy --locked --workspace --all-targets -- -D warnings
|
|
|
|
audit:
|
|
name: Dependency audit
|
|
runs-on: ubuntu-22.04
|
|
defaults:
|
|
run:
|
|
working-directory: rust
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
- run: cargo install cargo-audit --locked
|
|
# Ignored advisories and their reasons live in rust/.cargo/audit.toml.
|
|
- run: cargo audit
|