rulesxp/.github/workflows/ci.yml at main · microsoft/rulesxp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
name: CI

on:
  push:
    branches: [ main, feature/pipeline-test ]
  pull_request:
    branches: [ main ]

env:
  CARGO_TERM_COLOR: always
  MSRV: '1.90'

jobs:
  test:
    name: Test Suite
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        rust-version: ['msrv', 'stable']
        cargo-args:
          - '--no-default-features'
          - '--no-default-features --features scheme'
          - '--no-default-features --features jsonlogic'
          - '--no-default-features --features scheme,jsonlogic'

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Resolve toolchain
      id: resolve
      shell: bash
      run: |
        rust="${{ matrix.rust-version }}"
        [[ "$rust" == "msrv" ]] && rust="$MSRV"
        echo "toolchain=$rust" >> "$GITHUB_OUTPUT"

    - name: Install Rust
      uses: dtolnay/rust-toolchain@master
      with:
        toolchain: ${{ steps.resolve.outputs.toolchain }}

    - name: Install clippy (stable only)
      if: matrix.rust-version == 'stable'
      run: rustup component add clippy

    - name: Cache dependencies
      uses: Swatinem/rust-cache@v2

    - name: Run tests
      run: cargo test --all-targets ${{ matrix.cargo-args }} --verbose

    - name: Run clippy
      if: matrix.rust-version == 'stable'
      run: cargo clippy --all-targets ${{ matrix.cargo-args }} -- -D warnings

    - name: Run doc tests (all features)
      run: cargo test --doc --all-features

  coverage:
    name: Code Coverage
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable
      with:
        components: llvm-tools-preview

    - name: Cache dependencies
      uses: Swatinem/rust-cache@v2

    - name: Install cargo-llvm-cov
      uses: taiki-e/install-action@cargo-llvm-cov

    - name: Generate code coverage
      run: |
        cargo llvm-cov --all-features --workspace --html --output-dir coverage-html
        cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info --no-run

    - name: Upload coverage HTML
      uses: actions/upload-artifact@v7
      with:
        name: coverage-report
        path: coverage-html/
        retention-days: 30

    - name: Upload to Codecov
      if: env.CODECOV_TOKEN != ''
      uses: codecov/codecov-action@v6
      with:
        files: lcov.info
        fail_ci_if_error: true
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  fmt:
    name: Formatting
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable
      with:
        components: rustfmt

    - name: Cache dependencies
      uses: Swatinem/rust-cache@v2

    - name: Check formatting
      run: cargo fmt --all -- --check

  docs:
    name: Documentation
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Cache dependencies
      uses: Swatinem/rust-cache@v2

    - name: Build documentation
      run: cargo doc --all-features --no-deps

    - name: Check for broken links in docs
      run: cargo doc --all-features --no-deps 2>&1 | grep -i "warning\|error" && exit 1 || exit 0

  fuzz-build:
    # This job ensures the fuzz crate compiles on the nightly toolchain.
    # Actual fuzzing runs on a schedule in fuzz.yml, not here.
    name: Fuzz Build Check
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Install Rust nightly
      uses: dtolnay/rust-toolchain@nightly

    - name: Cache dependencies
      uses: Swatinem/rust-cache@v2

    - name: Install cargo-fuzz
      run: cargo install cargo-fuzz

    - name: Check fuzz crate compilation
      run: cargo fuzz build

  security:
    name: Security Audit
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Install cargo-audit
      uses: taiki-e/install-action@v2
      with:
        tool: cargo-audit

    - name: Run security audit
      run: cargo audit

  minimal-versions:
    name: Minimal Versions
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Install Rust nightly
      uses: dtolnay/rust-toolchain@nightly

    - name: Install Rust stable
      uses: dtolnay/rust-toolchain@stable

    - name: Install cargo-hack and cargo-minimal-versions
      uses: taiki-e/install-action@v2
      with:
        tool: cargo-hack,cargo-minimal-versions

    - name: Check minimal versions
      run: cargo +nightly minimal-versions check --direct --all-features