Skip to content
CI

chore(deps): bump the npm-minor-and-patch group across 1 directory with 5 updates #1404

Sign in to view logs

chore(deps): bump the npm-minor-and-patch group across 1 directory with 5 updates

chore(deps): bump the npm-minor-and-patch group across 1 directory with 5 updates #1404

Workflow file for this run

.github/workflows/ci.yml at 254ce6a
name: CI
on:
push:
pull_request:
workflow_call:
# Least privilege: every job in this workflow only needs to read the repo.
# (When called from deployment.yml the caller's permissions are the ceiling.)
permissions:
contents: read
# Cancel superseded runs for pull requests and feature-branch pushes. Pushes to
# master and reusable-workflow calls (e.g. the deployment quality gate) are
# keyed by run id, so they are never cancelled by a newer commit.
concurrency:
group: ci-${{ github.event_name }}-${{ (github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref != 'refs/heads/master')) && github.ref || github.run_id }}
cancel-in-progress: true
env:
CARGO_TERM_COLOR: always
CARGO_INCREMENTAL: 0
jobs:
root-allowlist:
name: Root File Allowlist
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- name: Check intentional root files
run: bash scripts/check-root-allowlist.sh
canonical-urls:
name: Canonical Repository URLs
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- name: Reject links to non-canonical StarForge repositories
run: bash scripts/check-canonical-urls.sh
fmt:
name: Rustfmt
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
components: rustfmt
- name: Check formatting
run: cargo fmt --all --check
actionlint:
name: Actionlint
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- name: Install actionlint
uses: taiki-e/install-action@v2
with:
tool: actionlint
- name: Lint all workflow files
run: actionlint -color
msrv:
name: MSRV (Rust 1.80)
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@1.80.0
with:
toolchain: 1.80.0
- name: Install system dependencies
run: sudo apt-get update && sudo apt-get install -y libudev-dev
- name: Verify compilation on Rust 1.80 MSRV
run: cargo check --locked --workspace
deny:
name: Cargo Deny
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Install cargo-deny
uses: EmbarkStudios/cargo-deny-action@v2
with:
command: check
arguments: --all-features
secure-defaults:
name: Secure Defaults Audit
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Install system dependencies
run: sudo apt-get update && sudo apt-get install -y libudev-dev
- name: Run secure defaults audit
run: cargo test --test secure_defaults_audit --locked
plugin-capabilities:
name: Plugin Capability Enforcement
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Install system dependencies
run: sudo apt-get update && sudo apt-get install -y libudev-dev
# Malicious fixtures must be denied filesystem/network access and benign
# fixtures with declared capabilities must succeed. See
# docs/plugins/capabilities.md#5-testing-capability-enforcement.
- name: Run plugin capability integration tests
run: cargo test --test plugin_capability_integration --locked
doctests:
name: Documentation Tests
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Install system dependencies
run: sudo apt-get update && sudo apt-get install -y libudev-dev
- name: Run doctests
run: cargo test --doc --locked
feature-matrix:
name: Feature Matrix
runs-on: ubuntu-24.04
strategy:
fail-fast: false
matrix:
features: ["", "--no-default-features", "--features ai", "--features hardware-wallet"]
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Install system dependencies
run: sudo apt-get update && sudo apt-get install -y libudev-dev libusb-1.0-0-dev build-essential
- name: Build
run: cargo build --locked ${{ matrix.features }}
- name: CLI JSON contract stability
run: cargo test --test json_contract_stability --locked ${{ matrix.features }}
- name: Test
run: cargo test --locked ${{ matrix.features }} -- --test-threads=1
- name: Verify Cargo.lock immutability
if: matrix.features == ''
run: git diff --exit-code Cargo.lock
docs-cheatsheet:
name: Docs Cheat Sheet (anti-drift)
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Install system dependencies
run: sudo apt-get update && sudo apt-get install -y libudev-dev
- name: Build (regenerates cheat sheet from clap metadata)
run: cargo build --locked
- name: Fail when cheat sheet is stale
run: git diff --exit-code -- docs/COMMAND_CHEATSHEET.md
# Builds and tests the example plugins from docs/plugins/cookbook.md so the
# cookbook cannot drift from the plugin API. They live in their own
# workspace under examples/plugins and depend on this crate by path.
plugin-examples:
name: Plugin Cookbook Examples
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Install system dependencies
run: sudo apt-get update && sudo apt-get install -y libudev-dev
- name: Pin example dependencies to the CLI's lockfile
run: cp Cargo.lock examples/plugins/Cargo.lock
- name: Build example plugins
run: cargo build --manifest-path examples/plugins/Cargo.toml --workspace
- name: Test example plugins
run: cargo test --manifest-path examples/plugins/Cargo.toml --workspace
hardware-wallet:
name: Hardware Wallet (optional backends)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- name: Install system dependencies
# libudev-dev: hidapi's Linux HID backend (Ledger)
# libusb-1.0-0-dev: trezor-client's rusb transport (Trezor)
run: sudo apt-get update && sudo apt-get install -y libudev-dev libusb-1.0-0-dev
- name: Build with hardware-wallet feature
run: cargo build --locked --features hardware-wallet
- name: Test with hardware-wallet feature
run: cargo test --locked --features hardware-wallet -- --test-threads=1
clippy:
name: Clippy Lint
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
components: clippy
- uses: Swatinem/rust-cache@v2
- name: Install system dependencies
run: sudo apt-get update && sudo apt-get install -y libudev-dev libusb-1.0-0-dev
- name: Run Clippy
run: cargo clippy --all-features --locked -- -D warnings
smoke:
name: CLI Smoke Tests (Linux)
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Install system dependencies
run: sudo apt-get update && sudo apt-get install -y libudev-dev
- name: Build
run: cargo build --locked
- name: Cross-platform CLI Integration Tests
run: cargo test --test cli_cross_platform --locked
- name: Rust smoke tests
run: cargo test --test cli_smoke --locked
- name: Shell smoke script
run: bash scripts/e2e-smoke.sh
- name: Verify Cargo.lock immutability
run: git diff --exit-code Cargo.lock
cli-macos:
name: macOS CLI Tests
runs-on: macos-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Build CLI
run: cargo build --locked
- name: Cross-platform CLI Integration Tests
run: cargo test --test cli_cross_platform --locked
- name: Rust smoke tests
run: cargo test --test cli_smoke --locked
- name: Verify Cargo.lock immutability
run: git diff --exit-code Cargo.lock
cli-windows:
name: Windows CLI Tests
runs-on: windows-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Build CLI
run: cargo build --locked
- name: Cross-platform CLI Integration Tests
run: cargo test --test cli_cross_platform --locked
- name: Rust smoke tests
run: cargo test --test cli_smoke --locked
- name: Verify Cargo.lock immutability
run: git diff --exit-code Cargo.lock
reproducible-wasm:
name: Reproducible WASM Build
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- name: Build docker builder image
run: docker build -t starforge-wasm-builder docker/reproducible-wasm
- name: Prepare sample contract
run: |
cp -r templates/examples/simple-counter sample-contract
sed -i 's/{{PROJECT_NAME}}/sample-contract/g' sample-contract/Cargo.toml
cd sample-contract
cargo generate-lockfile
- name: First Clean Build
run: |
cd sample-contract
docker run --rm -v $(pwd):/workspace starforge-wasm-builder --release --locked
mkdir ../build1
cp target/wasm32-unknown-unknown/release/*.wasm ../build1/
rm -rf target
- name: Second Clean Build
run: |
cd sample-contract
docker run --rm -v $(pwd):/workspace starforge-wasm-builder --release --locked
mkdir ../build2
cp target/wasm32-unknown-unknown/release/*.wasm ../build2/
- name: Verify Hashes Match
run: |
HASH1=$(sha256sum build1/*.wasm | awk '{print $1}')
HASH2=$(sha256sum build2/*.wasm | awk '{print $1}')
echo "Build 1: $HASH1"
echo "Build 2: $HASH2"
if [ "$HASH1" != "$HASH2" ]; then
echo "Error: Hashes do not match!"
exit 1
fi
echo "Success: Hashes match."
starforge-action:
name: StarForge Action (self-test)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- name: Install system dependencies
run: sudo apt-get update && sudo apt-get install -y libudev-dev
# Use install-mode: source so the action is exercised from this checkout,
# without depending on a published release artifact existing yet.
- name: Exercise the local StarForge composite action
uses: ./.github/actions/starforge
with:
install-mode: source
command: info