Define retention roots and GC liveness #153
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| quality: | |
| name: Rust quality gates | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install pinned toolchain | |
| run: rustup show | |
| - name: Install independent vector tool | |
| uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 | |
| with: | |
| tool: b3sum@1.8.5 | |
| - name: Check Golden File Worldline corpus | |
| run: cargo xtask golden-file-worldline-check | |
| - name: Run process-death crash matrix (debug) | |
| run: cargo xtask durability-crash-matrix | |
| - name: Run process-death crash matrix (optimized) | |
| run: cargo run --quiet --release --locked --package xtask -- durability-crash-matrix | |
| - name: Check protocol conformance corpora | |
| run: cargo xtask conformance-check | |
| - name: Check source structure | |
| run: cargo xtask source-structure-check | |
| - name: Check formatting | |
| run: cargo fmt --all --check | |
| - name: Check all features | |
| run: cargo check --workspace --all-targets --all-features --locked | |
| - name: Check minimal features | |
| run: cargo check --workspace --all-targets --no-default-features --locked | |
| - name: Lint all features | |
| run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings | |
| - name: Lint minimal features | |
| run: cargo clippy --workspace --all-targets --no-default-features --locked -- -D warnings | |
| - name: Test debug profile | |
| run: cargo test --workspace --all-features --locked | |
| - name: Test release profile | |
| run: cargo test --workspace --all-features --release --locked | |
| - name: Test documentation | |
| run: cargo test --workspace --doc --locked | |
| - name: Check MSRV contract | |
| run: cargo +1.96.0 check --workspace --all-targets --all-features --locked | |
| - name: Check fuzz targets | |
| run: | | |
| cargo fmt --manifest-path fuzz/Cargo.toml --all --check | |
| cargo check --manifest-path fuzz/Cargo.toml --bins --locked | |
| cargo clippy --manifest-path fuzz/Cargo.toml --bins --locked -- -D warnings | |
| documentation: | |
| name: Documentation and workflow integrity | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install pinned toolchain | |
| run: rustup show | |
| - name: Install pinned Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24.18.0 | |
| - name: Install pinned documentation tools | |
| run: | | |
| documentation_tools="$RUNNER_TEMP/documentation-tools" | |
| scripts/install_documentation_tools.sh "$documentation_tools" | |
| printf '%s\n' \ | |
| "$documentation_tools/bin" \ | |
| "$documentation_tools/npm/node_modules/.bin" >> "$GITHUB_PATH" | |
| - name: Verify malformed-input refusal laws | |
| run: cargo xtask documentation-refusal-check | |
| - name: Check documentation and workflows | |
| run: cargo xtask documentation-integrity-check | |
| - name: Check repository whitespace | |
| run: git diff --check "$(git hash-object -t tree /dev/null)" HEAD | |
| fuzz-smoke: | |
| name: Runtime fuzz smoke | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Verify fuzz campaign laws | |
| run: cargo test --locked --package xtask fuzz_campaign | |
| - name: Load bounded fuzz policy | |
| run: | | |
| cargo xtask fuzz github-env --profile smoke \ | |
| >> "$GITHUB_ENV" | |
| - name: Install pinned fuzz toolchain | |
| run: rustup toolchain install "$FUZZ_TOOLCHAIN" --profile minimal | |
| - name: Install pinned fuzz runner | |
| run: cargo install cargo-fuzz --version "$CARGO_FUZZ_VERSION" --locked | |
| - name: Prepare deterministic fuzz seeds | |
| run: cargo xtask prepare-fuzz-corpus | |
| - name: Build every fuzz target | |
| run: cargo xtask fuzz build --profile smoke | |
| - name: Exercise every fuzz target | |
| run: cargo xtask fuzz run --profile smoke | |
| - name: Retain fuzz failures | |
| if: failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: fuzz-failures | |
| path: fuzz/artifacts/ | |
| if-no-files-found: ignore | |
| retention-days: ${{ env.FUZZ_SMOKE_FAILURE_RETENTION_DAYS }} | |
| dependency-policy: | |
| name: Dependency policy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install pinned toolchain | |
| run: rustup show | |
| - name: Install dependency policy tools | |
| uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 | |
| with: | |
| tool: cargo-deny@0.18.9,cargo-audit@0.22.0 | |
| - name: Check dependency policy | |
| run: cargo deny check | |
| - name: Check fuzz dependency policy | |
| run: cargo deny --manifest-path fuzz/Cargo.toml check --config ../deny.toml | |
| - name: Check security advisories | |
| run: cargo audit | |
| - name: Check fuzz security advisories | |
| run: cargo audit --file fuzz/Cargo.lock |