mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-10-24 10:08:00 -06:00
aiongg
d1756e487d
* CI: the shared gate workflow; nightly fuzzing in fuzz.yml * CI: run the gate now that the shared workflow is on craft-common-actions main * CI: adding full-ci to an open PR runs the gate; fuzz checkout keeps no token
90 lines
4.5 KiB
YAML
90 lines
4.5 KiB
YAML
name: CI
|
|
|
|
# Quality gates for every push to main and every pull request (`cargo xtask ci`), through the
|
|
# suite's shared gate workflow in craft-common-actions. Nightly fuzzing is in fuzz.yml.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
# `labeled` so that adding `full-ci` to an open PR starts a run with Windows in it.
|
|
types: [opened, synchronize, reopened, labeled]
|
|
workflow_dispatch:
|
|
|
|
# The token is only used to check out the code: no job writes to the repository.
|
|
permissions:
|
|
contents: read
|
|
|
|
# A newer push to a PR branch cancels its older run; every push to main runs to the end. Adding
|
|
# any label but `full-ci` gets a group of its own, so it neither runs the gate nor cancels a run.
|
|
concurrency:
|
|
group: ci-${{ github.event_name == 'pull_request' && (github.event.action != 'labeled' || github.event.label.name == 'full-ci') && github.ref || github.run_id }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
# The shared gate doesn't check where git dependencies come from; release.yml runs the same job.
|
|
git-sources:
|
|
if: github.event.action != 'labeled' || github.event.label.name == 'full-ci'
|
|
name: Git dependencies come from storytold
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Git dependencies come from storytold
|
|
run: |
|
|
set -euo pipefail
|
|
test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
|
|
# Source replacement, patches and path overrides in cargo config never show up
|
|
# in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
|
|
# Cargo still reads the legacy .cargo/config.
|
|
python3 - <<'PY'
|
|
import os, sys, tomllib
|
|
for path in (".cargo/config", ".cargo/config.toml"):
|
|
if not os.path.exists(path):
|
|
continue
|
|
config = tomllib.load(open(path, "rb"))
|
|
replaced = [name for name, source in config.get("source", {}).items()
|
|
if isinstance(source, dict) and "replace-with" in source]
|
|
if replaced or "patch" in config or "paths" in config:
|
|
print(f"{path} replaces, patches or overrides a source")
|
|
sys.exit(1)
|
|
PY
|
|
# Fails when Cargo.lock is out of date with the manifests.
|
|
cargo metadata --locked --format-version 1 > /dev/null
|
|
python3 - <<'PY'
|
|
import sys, tomllib
|
|
lock = tomllib.load(open("Cargo.lock", "rb"))
|
|
bad = sorted({p["source"] for p in lock.get("package", [])
|
|
if p.get("source", "").startswith("git+")
|
|
and not p["source"].startswith("git+https://github.com/storytold/")})
|
|
if bad:
|
|
print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
|
|
sys.exit(1)
|
|
PY
|
|
|
|
gate:
|
|
if: github.event.action != 'labeled' || github.event.label.name == 'full-ci'
|
|
# Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
|
|
uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
|
|
with:
|
|
# Windows on main, manual runs and pull requests labelled `full-ci`. No macOS on PRs or main:
|
|
# the org's 5 macOS slots are kept for release builds, and release.yml builds macOS.
|
|
os: ${{ (github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'full-ci')) && '["ubuntu-24.04","windows-latest"]' || '["ubuntu-24.04"]' }}
|
|
# Same craft-fonts commit as release.yml and freebsd.yml.
|
|
craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
|
|
# egui/winit/rfd, and the independent oracles (crates/oracle).
|
|
packages: >-
|
|
libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev
|
|
libgtk-3-dev qpdf poppler-utils
|
|
# cargo-deny for the deny step of `cargo xtask ci`, which requires it under CI.
|
|
tools: cargo-nextest@0.9.149,cargo-deny@0.20.2
|
|
# A missing oracle fails the job instead of printing a skip notice that reads as a pass.
|
|
linux-env: PDFCRAFT_ORACLES_REQUIRED=1
|
|
windows-env: PDFCRAFT_REQUIRE_WINRES=1
|
|
# Windows checks what differs by platform: the build (with resources) and the tests.
|
|
windows-command: |
|
|
cargo clippy --workspace --all-targets --locked -- -D warnings
|
|
cargo test --workspace --locked
|