mirror of
https://github.com/storytold/figcraft.git
synced 2026-10-24 18:36:44 -06:00
Dylan M. Taylor
a86897dc91
Pin third-party actions to full-length commit SHAs (with version comments) instead of mutable tags/branches to prevent supply-chain tampering via retagged releases. Resolves SonarCloud rule githubactions:S7637.
89 lines
3.0 KiB
YAML
89 lines
3.0 KiB
YAML
# CI for pull requests and main: format, clippy, tests, dependency layering, asset attribution and
|
|
# the wasm32 check (the same gates as `cargo xtask ci`). Linux only: macOS is built and tested only
|
|
# by release.yml (the org's macOS runners are kept for releases; craftrules release/playbook.md),
|
|
# and Windows/FreeBSD packaging have their own workflows.
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
CARGO_INCREMENTAL: 0
|
|
RUST_BACKTRACE: 1
|
|
# Debug and test builds keep line tables (file:line in panic backtraces) but drop the rest of the
|
|
# debug info: faster codegen and links, and a smaller target dir.
|
|
CARGO_PROFILE_DEV_DEBUG: line-tables-only
|
|
|
|
# A newer push to a PR branch cancels its older run. Runs on main are never cancelled, so every
|
|
# main state that gets a run is checked to the end.
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
test:
|
|
timeout-minutes: 35
|
|
name: test (ubuntu-latest)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Install Linux system dependencies (egui/winit/rfd)
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends \
|
|
libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
|
|
libgl1-mesa-dev libgtk-3-dev
|
|
|
|
- uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
|
|
with:
|
|
components: clippy, rustfmt
|
|
|
|
# Only main saves caches; PRs restore main's, so PR caches don't evict main's.
|
|
- uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
|
|
with:
|
|
save-if: ${{ github.ref == 'refs/heads/main' }}
|
|
cache-on-failure: true
|
|
|
|
- name: Format
|
|
run: cargo fmt --all -- --check
|
|
|
|
- name: Clippy
|
|
run: cargo clippy --workspace --all-targets --locked -- -D warnings
|
|
|
|
# Without craft-fonts (the optional CRAFT_FONTS_DIR input, which .cargo/config.toml points at
|
|
# a sibling checkout that CI doesn't have): everything must build and pass without it.
|
|
- name: Test
|
|
run: cargo test --workspace --locked
|
|
|
|
- name: Dependency layering
|
|
run: cargo run --locked -q -p xtask -- layers
|
|
|
|
- name: Asset attribution
|
|
run: cargo run --locked -q -p xtask -- assets
|
|
|
|
wasm:
|
|
timeout-minutes: 30
|
|
name: wasm32 check
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
|
|
with:
|
|
targets: wasm32-unknown-unknown
|
|
- uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
|
|
with:
|
|
key: wasm32
|
|
save-if: ${{ github.ref == 'refs/heads/main' }}
|
|
cache-on-failure: true
|
|
# The engine, the UI crate and apps/figcraft-web must keep compiling for the browser.
|
|
- name: Check wasm-safe crates
|
|
run: cargo run --locked -q -p xtask -- wasm
|