CI #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| # Advisories land independently of code changes, so re-run on a schedule to | |
| # catch new CVEs in dependencies that are already merged. | |
| schedule: | |
| - cron: "0 6 * * 1" | |
| jobs: | |
| fmt: | |
| name: Rustfmt | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt | |
| - name: Check formatting | |
| run: cargo fmt --check | |
| clippy: | |
| name: Clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - name: Cache cargo dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Run Clippy | |
| run: cargo clippy --all-targets --all-features --locked -- -D warnings | |
| test: | |
| name: Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Run tests | |
| run: cargo test --all-features --locked | |
| # The database layer is only checked by the server: a rejected YQL statement | |
| # or a changed error code compiles cleanly and fails at runtime. These tests | |
| # are `#[ignore]`d so the job above stays hermetic, and run here against a | |
| # real YDB. | |
| integration: | |
| name: Integration tests | |
| runs-on: ubuntu-latest | |
| services: | |
| ydb: | |
| image: ydbplatform/local-ydb:latest | |
| env: | |
| YDB_ANONYMOUS_CREDENTIALS: 1 | |
| YDB_USE_IN_MEMORY_PDISKS: 1 | |
| ports: | |
| - 2136:2136 | |
| options: >- | |
| --health-cmd "/health_check" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 20 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| # Single-threaded: the tests share one schema and the counter is a single | |
| # row, so parallel runs would contend on it. | |
| - name: Run integration tests | |
| run: cargo test --all-features --locked -- --ignored --test-threads=1 | |
| audit: | |
| name: Security audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install cargo-audit | |
| uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-audit | |
| # Fails on any vulnerability except those documented in .cargo/audit.toml. | |
| # Unmaintained-crate warnings are reported but do not gate merges, since | |
| # every current one is transitive through ydb. | |
| - name: Audit dependencies for known vulnerabilities | |
| run: cargo audit |