roxy/.github/workflows/ci.yml at main · refcell/roxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
name: CI

on:
  push:
  pull_request:

env:
  CARGO_TERM_COLOR: always

permissions:
  contents: read
  checks: write

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: Install just
        uses: extractions/setup-just@v3
      - run: just build-all-targets

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: Install just
        uses: extractions/setup-just@v3
      - name: Install cargo-nextest
        uses: taiki-e/install-action@cargo-nextest
      - name: Run tests
        run: just test

  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: Install just
        uses: extractions/setup-just@v3
      - run: just check-format

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: Install just
        uses: extractions/setup-just@v3
      - run: just check-clippy

  udeps:
    name: Unused Dependencies
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - uses: taiki-e/install-action@cargo-udeps
      - name: Install just
        uses: extractions/setup-just@v3
      - run: just check-udeps

  security:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - uses: actions/checkout@v4
      - uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  docs:
    name: Documentation
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: Build documentation
        run: cargo doc --workspace --no-deps --document-private-items
        env:
          RUSTDOCFLAGS: -D warnings