Skip to content

Define retention roots and GC liveness #153

Define retention roots and GC liveness

Define retention roots and GC liveness #153

Workflow file for this run

name: CI
on:
push:
branches: [main]
pull_request:
permissions:
contents: read
concurrency:
group: ci-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
quality:
name: Rust quality gates
runs-on: ubuntu-latest
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install pinned toolchain
run: rustup show
- name: Install independent vector tool
uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
with:
tool: b3sum@1.8.5
- name: Check Golden File Worldline corpus
run: cargo xtask golden-file-worldline-check
- name: Run process-death crash matrix (debug)
run: cargo xtask durability-crash-matrix
- name: Run process-death crash matrix (optimized)
run: cargo run --quiet --release --locked --package xtask -- durability-crash-matrix
- name: Check protocol conformance corpora
run: cargo xtask conformance-check
- name: Check source structure
run: cargo xtask source-structure-check
- name: Check formatting
run: cargo fmt --all --check
- name: Check all features
run: cargo check --workspace --all-targets --all-features --locked
- name: Check minimal features
run: cargo check --workspace --all-targets --no-default-features --locked
- name: Lint all features
run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
- name: Lint minimal features
run: cargo clippy --workspace --all-targets --no-default-features --locked -- -D warnings
- name: Test debug profile
run: cargo test --workspace --all-features --locked
- name: Test release profile
run: cargo test --workspace --all-features --release --locked
- name: Test documentation
run: cargo test --workspace --doc --locked
- name: Check MSRV contract
run: cargo +1.96.0 check --workspace --all-targets --all-features --locked
- name: Check fuzz targets
run: |
cargo fmt --manifest-path fuzz/Cargo.toml --all --check
cargo check --manifest-path fuzz/Cargo.toml --bins --locked
cargo clippy --manifest-path fuzz/Cargo.toml --bins --locked -- -D warnings
documentation:
name: Documentation and workflow integrity
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install pinned toolchain
run: rustup show
- name: Install pinned Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24.18.0
- name: Install pinned documentation tools
run: |
documentation_tools="$RUNNER_TEMP/documentation-tools"
scripts/install_documentation_tools.sh "$documentation_tools"
printf '%s\n' \
"$documentation_tools/bin" \
"$documentation_tools/npm/node_modules/.bin" >> "$GITHUB_PATH"
- name: Verify malformed-input refusal laws
run: cargo xtask documentation-refusal-check
- name: Check documentation and workflows
run: cargo xtask documentation-integrity-check
- name: Check repository whitespace
run: git diff --check "$(git hash-object -t tree /dev/null)" HEAD
fuzz-smoke:
name: Runtime fuzz smoke
runs-on: ubuntu-latest
timeout-minutes: 20
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Verify fuzz campaign laws
run: cargo test --locked --package xtask fuzz_campaign
- name: Load bounded fuzz policy
run: |
cargo xtask fuzz github-env --profile smoke \
>> "$GITHUB_ENV"
- name: Install pinned fuzz toolchain
run: rustup toolchain install "$FUZZ_TOOLCHAIN" --profile minimal
- name: Install pinned fuzz runner
run: cargo install cargo-fuzz --version "$CARGO_FUZZ_VERSION" --locked
- name: Prepare deterministic fuzz seeds
run: cargo xtask prepare-fuzz-corpus
- name: Build every fuzz target
run: cargo xtask fuzz build --profile smoke
- name: Exercise every fuzz target
run: cargo xtask fuzz run --profile smoke
- name: Retain fuzz failures
if: failure()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: fuzz-failures
path: fuzz/artifacts/
if-no-files-found: ignore
retention-days: ${{ env.FUZZ_SMOKE_FAILURE_RETENTION_DAYS }}
dependency-policy:
name: Dependency policy
runs-on: ubuntu-latest
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install pinned toolchain
run: rustup show
- name: Install dependency policy tools
uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
with:
tool: cargo-deny@0.18.9,cargo-audit@0.22.0
- name: Check dependency policy
run: cargo deny check
- name: Check fuzz dependency policy
run: cargo deny --manifest-path fuzz/Cargo.toml check --config ../deny.toml
- name: Check security advisories
run: cargo audit
- name: Check fuzz security advisories
run: cargo audit --file fuzz/Cargo.lock