From 6671402ed5574d8c825a1b7627e466a06983cf30 Mon Sep 17 00:00:00 2001 From: Eric Scouten Date: Sun, 25 Oct 2026 08:54:37 -0700 Subject: [PATCH 1/2] ci: Modernize CI workflows Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 330 +++++++++++++++++++++------------ .github/workflows/pr_title.yml | 15 +- .github/workflows/release.yml | 72 ++++++- 3 files changed, 281 insertions(+), 136 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 58ec3ae..8e84af1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,5 +1,12 @@ name: CI +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + on: workflow_dispatch: pull_request: @@ -20,9 +27,7 @@ jobs: if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') runs-on: ${{ matrix.os }} @@ -38,22 +43,28 @@ jobs: uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master with: toolchain: ${{ matrix.rust_version }} components: llvm-tools-preview - name: Cache Rust dependencies - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 - name: Install cargo-llvm-cov - uses: taiki-e/install-action@72f835688cb6c15903b796f704b01e652a2b8835 # cargo-llvm-cov + if: matrix.rust_version == 'stable' + uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2 + with: + tool: cargo-llvm-cov - name: Generate code coverage + id: generate_coverage + if: matrix.rust_version == 'stable' run: cargo llvm-cov --lib --all-features --lcov --output-path lcov.info - name: Filter out tests - uses: scouten/uncover-tests@f3bbdfb953b5989f48d8dfad0a88a83c4d914389 # v1.1.1 + if: matrix.rust_version == 'stable' + uses: scouten/uncover-tests@f3bbdfb953b5989f48d8dfad0a88a83c4d914389 # v1 with: input-file: lcov.info output-file: lcov.filtered.info @@ -62,29 +73,26 @@ jobs: # so we don't attempt to upload code coverage in that case. - name: Upload code coverage results if: | - github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' - uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5 + steps.generate_coverage.outcome == 'success' && + (github.event_name != 'pull_request' || + github.event.pull_request.head.repo.full_name == github.repository) + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 with: token: ${{ secrets.CODECOV_ORG_TOKEN }} fail_ci_if_error: true verbose: true files: ./lcov.filtered.info + - name: Run unit tests (MSRV) + if: matrix.rust_version != 'stable' + run: cargo test --lib --all-features + doc-tests: - name: Doc tests (requires nightly Rust) - # TODO: Remove this once cargo-llvm-cov can run doc tests and generate - # coverage. (This requires a bug fix that is only available in nightly Rust.) - # Watch https://github.com/taiki-e/cargo-llvm-cov/issues/2 - # for progress. + name: Doc tests if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') runs-on: ubuntu-latest @@ -94,51 +102,20 @@ jobs: uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master - name: Cache Rust dependencies - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 - - name: Install cargo-llvm-cov - uses: taiki-e/install-action@72f835688cb6c15903b796f704b01e652a2b8835 # cargo-llvm-cov - - # Disabling code coverage for doc tests due to a new bug in Rust nightly - # as of 2025-01-08. Will investigate later to see if there's a repro case. - # Meanwhile, simply run the tests so we know if there are any failing - # doc tests. - - - name: Run doc tests (COVERAGE DISABLED) - run: | - cargo test --workspace --all-features --doc - - # - name: Generate code coverage - # env: - # RUST_BACKTRACE: "1" - # run: | - # cargo llvm-cov --workspace --all-features --lcov --doctests --output-path lcov.info - - # Tokens aren't available for PRs originating from forks, - # so we don't attempt to upload code coverage in that case. - # - name: Upload code coverage results - # if: | - # github.event_name != 'pull_request' || - # github.event.pull_request.author_association == 'COLLABORATOR' || - # github.event.pull_request.author_association == 'MEMBER' || - # github.event.pull_request.user.login == 'dependabot[bot]' - # uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5 - # with: - # token: ${{ secrets.CODECOV_TOKEN }} - # fail_ci_if_error: true - # verbose: true + - name: Run doc tests + run: cargo test --all-features --doc tests-cross: - name: Unit tests (cross) + name: Unit tests (cross, ${{ matrix.target }}, Rust ${{ matrix.rust_version }}) if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') runs-on: ubuntu-latest @@ -154,7 +131,7 @@ jobs: uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master with: toolchain: ${{ matrix.rust_version }} targets: ${{ matrix.target }} @@ -163,7 +140,7 @@ jobs: run: cargo install cross - name: Cache Rust dependencies - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 # Note that we do not run code coverage because # it isn't readily accessible from cross-compilation @@ -172,14 +149,75 @@ jobs: - name: Run unit tests (cross build) run: cross test --lib --all-features --target ${{ matrix.target }} + tests-windows-arm: + name: Unit tests (Windows ARM) + + if: | + github.event_name != 'pull_request' || + github.event.pull_request.head.repo.full_name == github.repository || + contains(github.event.pull_request.labels.*.name, 'safe to test') + + runs-on: windows-11-arm + + steps: + - name: Checkout repository + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + + - name: Install Rust toolchain + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master + with: + toolchain: stable + + - name: Cache Rust dependencies + uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 + + - name: Run unit tests + run: cargo test --lib --all-features + + tests-android: + name: Build (Android, ${{ matrix.target }}) + + if: | + github.event_name != 'pull_request' || + github.event.pull_request.head.repo.full_name == github.repository || + contains(github.event.pull_request.labels.*.name, 'safe to test') + + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + target: + - aarch64-linux-android + - armv7-linux-androideabi + - i686-linux-android + - x86_64-linux-android + + steps: + - name: Checkout repository + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + + - name: Install Rust toolchain + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master + with: + toolchain: stable + targets: ${{ matrix.target }} + + - name: Install cross-compilation toolset + run: cargo install cross + + - name: Cache Rust dependencies + uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 + + - name: Build library (cross build) + run: cross build --lib --all-features --target ${{ matrix.target }} + tests-ios: name: Unit tests (iOS simulator) if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') runs-on: macos-14 @@ -189,7 +227,7 @@ jobs: uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master with: toolchain: 1.87.0 targets: aarch64-apple-ios-sim @@ -198,7 +236,7 @@ jobs: run: | VERSION=0.8.1 URL="https://github.com/sonos/dinghy/releases/download/${VERSION}/cargo-dinghy-macos-${VERSION}.tgz" - wget -O - $URL | tar -xz --strip-components=1 -C ~/.cargo/bin + wget -O - "$URL" | tar -xz --strip-components=1 -C ~/.cargo/bin - name: Check cargo-dinghy version. run: cargo dinghy --version @@ -207,29 +245,58 @@ jobs: # Use the first installed iOS runtime and the first (i.e. oldest) supported iPhone device. run: | RUNTIME=$(xcrun simctl list runtimes --json | jq '.runtimes | map(select(.name | contains("iOS"))) | .[0]') - RUNTIME_ID=$(echo $RUNTIME | jq -r '.identifier') - echo "Using runtime:" $RUNTIME_ID - DEVICE_ID=$(echo $RUNTIME | jq -r '.supportedDeviceTypes | map(select(.productFamily == "iPhone")) | .[0].identifier') - echo "Using device:" $DEVICE_ID - SIM_ID=$(xcrun simctl create Test-iPhone $DEVICE_ID $RUNTIME_ID) - echo "Created simulator:" $SIM_ID - xcrun simctl boot $SIM_ID - echo "device=$SIM_ID" >> $GITHUB_ENV + RUNTIME_ID=$(echo "$RUNTIME" | jq -r '.identifier') + echo "Using runtime:" "$RUNTIME_ID" + DEVICE_ID=$(echo "$RUNTIME" | jq -r '.supportedDeviceTypes | map(select(.productFamily == "iPhone")) | .[0].identifier') + echo "Using device:" "$DEVICE_ID" + SIM_ID=$(xcrun simctl create Test-iPhone "$DEVICE_ID" "$RUNTIME_ID") + echo "Created simulator:" "$SIM_ID" + xcrun simctl boot "$SIM_ID" + echo "device=$SIM_ID" >> "$GITHUB_ENV" - name: Cache Rust dependencies - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 - name: Run unit tests (cross build) - run: cargo dinghy -p auto-ios-aarch64-sim -d ${{ env.device }} test --all-targets --all-features + run: cargo dinghy -p cimpl -d ${{ env.device }} test --all-targets --all-features + + tests-ios-build: + name: Build (iOS device, ${{ matrix.target }}) + + if: | + github.event_name != 'pull_request' || + github.event.pull_request.head.repo.full_name == github.repository || + contains(github.event.pull_request.labels.*.name, 'safe to test') + + runs-on: macos-14 + + strategy: + fail-fast: false + matrix: + target: [aarch64-apple-ios, x86_64-apple-ios] + + steps: + - name: Checkout repository + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + + - name: Install Rust toolchain + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master + with: + toolchain: stable + targets: ${{ matrix.target }} + + - name: Cache Rust dependencies + uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 + + - name: Build library + run: cargo build --lib --all-features --target ${{ matrix.target }} tests-wasm: name: Unit tests (Wasm) if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') || contains(github.event.pull_request.labels.*.name, 'check-release') @@ -240,7 +307,7 @@ jobs: uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master - name: Set up Chrome uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0 @@ -268,9 +335,7 @@ jobs: if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') || contains(github.event.pull_request.labels.*.name, 'check-release') @@ -283,14 +348,14 @@ jobs: # Nightly required for testing until this issue is resolved: # wasip2 target should not conditionally feature gate stdlib APIs rust-lang/rust#130323 https://github.com/rust-lang/rust/issues/130323 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master with: - toolchain: nightly-2026-01-16 + toolchain: nightly-2026-07-12 - name: Install wasmtime run: | curl https://wasmtime.dev/install.sh -sSf | bash - echo "$HOME/.wasmtime/bin" >> $GITHUB_PATH + echo "$HOME/.wasmtime/bin" >> "$GITHUB_PATH" - name: Install clang run: | @@ -298,10 +363,10 @@ jobs: sudo apt-get install -y clang - name: Add wasm32-wasip2 target - run: rustup target add --toolchain nightly-2026-01-16 wasm32-wasip2 + run: rustup target add --toolchain nightly-2026-07-12 wasm32-wasip2 - name: Cache Rust dependencies - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 - name: Run WASI tests env: @@ -309,16 +374,14 @@ jobs: CC: clang RUST_MIN_STACK: 16777216 run: | - cargo +nightly-2026-01-16 test --target wasm32-wasip2 --all-features -- --no-capture + cargo +nightly-2026-07-12 test --target wasm32-wasip2 --all-features -- --no-capture test-direct-minimal-versions: name: Unit tests with minimum versions of direct dependencies if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') runs-on: ${{ matrix.os }} @@ -333,25 +396,23 @@ jobs: uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master with: - toolchain: nightly-2025-12-06 + toolchain: nightly-2026-07-12 - name: Cache Rust dependencies - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 - name: Run tests run: | - cargo +nightly-2025-12-06 test -Z direct-minimal-versions --all-targets --all-features + cargo +nightly-2026-07-12 test -Z direct-minimal-versions --all-targets --all-features publish-preflight: name: Preflight crate publish if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') runs-on: ubuntu-latest @@ -361,10 +422,10 @@ jobs: uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master - name: Cache Rust dependencies - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 - name: Dry-run of crate publish run: cargo publish --dry-run @@ -374,9 +435,7 @@ jobs: if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') runs-on: ubuntu-latest @@ -386,12 +445,12 @@ jobs: uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master with: components: clippy - name: Cache Rust dependencies - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 - name: Run Clippy run: | @@ -402,9 +461,7 @@ jobs: if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') runs-on: ubuntu-latest @@ -414,7 +471,7 @@ jobs: uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install nightly toolchain - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master with: toolchain: nightly-2026-01-16 components: rustfmt @@ -426,9 +483,7 @@ jobs: name: Enforce TOML format if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') runs-on: ubuntu-latest @@ -448,9 +503,7 @@ jobs: if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') runs-on: ubuntu-latest @@ -460,13 +513,13 @@ jobs: uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install Rust toolchain - # Nightly is used here because the docs.rs build - # uses nightly and we use doc_cfg features that are - # not in stable Rust as of this writing (Rust 1.88). - uses: dtolnay/rust-toolchain@be39649afda95dbf70f87cce95f68b8d5797b296 # nightly + # Match the nightly toolchain used by docs.rs. + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master + with: + toolchain: nightly - name: Cache Rust dependencies - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 - name: Install cargo-docs-rs uses: dtolnay/install@982daea0f5d846abc3c83e01a6a1d73c040047c1 # cargo-docs-rs @@ -481,9 +534,7 @@ jobs: if: | github.event_name != 'pull_request' || - github.event.pull_request.author_association == 'COLLABORATOR' || - github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.head.repo.full_name == github.repository || contains(github.event.pull_request.labels.*.name, 'safe to test') runs-on: ubuntu-latest @@ -506,3 +557,38 @@ jobs: uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 with: command: check ${{ matrix.checks }} + + internal_docs: + name: Verify internal crate documentation + + if: | + github.event_name != 'pull_request' || + github.event.pull_request.head.repo.full_name == github.repository || + contains(github.event.pull_request.labels.*.name, 'safe to test') + + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + + - name: Install nightly Rust toolchain + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master + with: + toolchain: nightly + + - name: Check internal documentation + env: + RUSTDOCFLAGS: -Dwarnings + run: cargo +nightly doc --no-deps --document-private-items + + actionlint: + name: Lint GitHub Actions workflows + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + + - name: Check workflows + run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 diff --git a/.github/workflows/pr_title.yml b/.github/workflows/pr_title.yml index 4ddb573..4dbeb69 100644 --- a/.github/workflows/pr_title.yml +++ b/.github/workflows/pr_title.yml @@ -1,5 +1,12 @@ name: PR title +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + on: pull_request: types: [opened, synchronize, reopened, edited] @@ -94,10 +101,10 @@ jobs: cargo install --quiet commitlint-rs set -e - echo   - echo   - echo --- commitlint results for PR title \"$PR_TITLE\" --- - echo   + echo + echo + echo "--- commitlint results for PR title \"$PR_TITLE\" ---" + echo echo "$PR_TITLE" | commitlint -g .commitlintrc.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9e92516..115379e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,6 +4,10 @@ permissions: pull-requests: write contents: write +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + on: push: branches: @@ -14,6 +18,10 @@ jobs: name: Release-plz runs-on: ubuntu-latest + env: + CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse + CARGO_NET_GIT_FETCH_WITH_CLI: "true" + steps: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 @@ -22,19 +30,63 @@ jobs: token: ${{ secrets.RELEASE_PLZ_ORG_TOKEN }} - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master + with: + toolchain: stable - - name: Run release-plz - uses: MarcoIeni/release-plz-action@487eb7b5c085a664d5c5ca05f4159bd9b591182a # v0.5.120 + - name: Publish releases + uses: MarcoIeni/release-plz-action@8921286633dfa0c4020f7f30bd1c14fe19cbb10e # v0.5.142 + with: + command: release env: GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_ORG_TOKEN }} CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_ORG_TOKEN }} - - name: Clean up stale release-plz branches + release-pr: + name: Release PR + runs-on: ubuntu-latest + needs: release-plz + + steps: + - name: Checkout repository after publication + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + fetch-depth: 0 + token: ${{ secrets.RELEASE_PLZ_ORG_TOKEN }} + + - name: Install Rust toolchain + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master + with: + toolchain: stable + + - name: Open or update release PR + uses: MarcoIeni/release-plz-action@8921286633dfa0c4020f7f30bd1c14fe19cbb10e # v0.5.142 + with: + command: release-pr + env: + GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_ORG_TOKEN }} + + - name: Clean up closed release-plz branches + env: + GH_TOKEN: ${{ secrets.RELEASE_PLZ_ORG_TOKEN }} run: | - git --no-pager branch --remote |\ - grep 'origin/release-plz-' |\ - sort -r |\ - tail -n +2 |\ - sed 's/origin\///' |\ - xargs -I {} git push origin --delete {} + set -euo pipefail + + open_branches=$(gh api --paginate \ + "repos/$GITHUB_REPOSITORY/pulls?state=open&per_page=100" \ + --jq '.[] | select(.head.repo.full_name == env.GITHUB_REPOSITORY) | .head.ref' | + jq -Rsc 'split("\n") | map(select(length > 0))') + closed_branches=$(gh api --paginate \ + "repos/$GITHUB_REPOSITORY/pulls?state=closed&base=$GITHUB_REF_NAME&per_page=100" \ + --jq '.[] | select(.head.repo.full_name == env.GITHUB_REPOSITORY) | .head.ref' | + jq -Rr --argjson open "$open_branches" \ + 'select(startswith("release-plz-")) | select(. as $branch | $open | index($branch) | not)' | + sort -u) + + while IFS= read -r branch; do + [ -n "$branch" ] || continue + remote_ref=$(git ls-remote --heads origin "refs/heads/$branch") + if [ -n "$remote_ref" ]; then + git push origin --delete "$branch" + fi + done <<< "$closed_branches" From a91e667c55b8a862b306e8b3aec6bda526f8aa6f Mon Sep 17 00:00:00 2001 From: Eric Scouten Date: Sun, 25 Oct 2026 09:25:05 -0700 Subject: [PATCH 2/2] ci: Pin cross to revision with rustup detection fix Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d2a0a7a..b04a704 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -135,7 +135,8 @@ jobs: targets: ${{ matrix.target }} - name: Install cross-compilation toolset - run: cargo install cross --locked + # Includes the rustup toolchain-detection fix and regression tests. + run: cargo install cross --locked --git https://github.com/cross-rs/cross --rev 2332ad818a3cd763934d7ac14857ed60b7ca8e90 - name: Cache Rust dependencies uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3 @@ -202,7 +203,8 @@ jobs: targets: ${{ matrix.target }} - name: Install cross-compilation toolset - run: cargo install cross --locked + # Includes the rustup toolchain-detection fix and regression tests. + run: cargo install cross --locked --git https://github.com/cross-rs/cross --rev 2332ad818a3cd763934d7ac14857ed60b7ca8e90 - name: Cache Rust dependencies uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2