mirror of
https://github.com/devmobasa/wayscriber.git
synced 2026-11-01 07:36:42 +01:00
devmobasa
e009114d63
Add deny.toml and a dependency-policy job covering the whole workspace. Bans, licenses, and sources block; advisories report without blocking, so a newly published advisory cannot fail an unrelated pull request. zbus 6 absorbed zvariant, zvariant_derive, and zbus_names, so RustSec now lists them as unmaintained. ksni still requires zbus 5, so those advisories are ignored with that reason until it moves. Both packages now state their MIT license instead of leaving the check to detect it. The configurator is marked publish = false: it has an unversioned path dependency and cannot be published.
170 lines
5.0 KiB
YAML
170 lines
5.0 KiB
YAML
name: Checks
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
lint-and-test:
|
|
name: Rust lint and test
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up repository tool SDK
|
|
uses: actions/setup-dotnet@v4
|
|
with:
|
|
global-json-file: global.json
|
|
|
|
- name: Cache repository tool packages
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: ~/.nuget/packages
|
|
key: ${{ runner.os }}-nuget-${{ hashFiles('global.json', 'tools/**/*.cs') }}
|
|
|
|
- name: Build repository tool once
|
|
run: dotnet build tools/wayscriber.cs
|
|
|
|
- name: Build one-command C# installer
|
|
run: dotnet build tools/install.cs --disable-build-servers
|
|
|
|
- name: Build repository tool tests once
|
|
run: dotnet build tools/wayscriber.tests.cs
|
|
|
|
- name: Install system dependencies
|
|
run: dotnet run tools/wayscriber.cs --no-build -- ci install-dependencies checks
|
|
|
|
- name: Build gtk4-layer-shell
|
|
run: dotnet run tools/wayscriber.cs --no-build -- ci prepare-gtk4-layer-shell --library-mode both
|
|
|
|
- name: Set up Rust
|
|
uses: dtolnay/rust-toolchain@1.99.1
|
|
with:
|
|
components: clippy, rustfmt
|
|
|
|
- name: Cache cargo builds
|
|
uses: Swatinem/rust-cache@v2
|
|
with:
|
|
workspaces: |
|
|
.
|
|
|
|
- name: Check dynamic gtk4-layer-shell linkage
|
|
run: dotnet run tools/wayscriber.cs --no-build -- ci build-linkage dynamic
|
|
|
|
- name: Run canonical workspace and standalone release validation
|
|
run: dotnet run tools/wayscriber.cs --no-build -- ci lint-and-test
|
|
|
|
- name: Check static gtk4-layer-shell linkage
|
|
run: dotnet run tools/wayscriber.cs --no-build -- ci build-linkage static
|
|
|
|
- name: Record code health
|
|
if: always()
|
|
continue-on-error: true
|
|
run: dotnet run tools/wayscriber.cs --no-build -- report code-health --output code-health-report.txt --github-summary
|
|
|
|
- name: Upload code-health report
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: wayscriber-code-health
|
|
path: code-health-report.txt
|
|
if-no-files-found: warn
|
|
|
|
gtk-widgets:
|
|
name: Required GTK widget contracts
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up repository tool SDK
|
|
uses: actions/setup-dotnet@v4
|
|
with:
|
|
global-json-file: global.json
|
|
|
|
- name: Cache repository tool packages
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: ~/.nuget/packages
|
|
key: ${{ runner.os }}-nuget-${{ hashFiles('global.json', 'tools/**/*.cs') }}
|
|
|
|
- name: Build repository tools once
|
|
run: dotnet build tools/wayscriber.cs
|
|
|
|
- name: Install system dependencies
|
|
run: dotnet run tools/wayscriber.cs --no-build -- ci install-dependencies widgets
|
|
|
|
- name: Build gtk4-layer-shell
|
|
run: dotnet run tools/wayscriber.cs --no-build -- ci prepare-gtk4-layer-shell --library-mode both
|
|
|
|
- name: Set up Rust
|
|
uses: dtolnay/rust-toolchain@1.99.1
|
|
with:
|
|
components: clippy, rustfmt
|
|
|
|
- name: Cache cargo builds
|
|
uses: Swatinem/rust-cache@v2
|
|
with:
|
|
workspaces: |
|
|
.
|
|
|
|
- name: Exercise widgets on an isolated display
|
|
run: dotnet run tools/wayscriber.cs --no-build -- ci gtk-widgets
|
|
|
|
nix-flake:
|
|
name: Nix flake
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up repository tool SDK
|
|
uses: actions/setup-dotnet@v4
|
|
with:
|
|
global-json-file: global.json
|
|
|
|
- name: Build repository tools once
|
|
run: dotnet build tools/wayscriber.cs
|
|
|
|
- name: Install Nix
|
|
uses: cachix/install-nix-action@v31
|
|
with:
|
|
github_access_token: ${{ secrets.GITHUB_TOKEN }}
|
|
extra_nix_config: |
|
|
experimental-features = nix-command flakes
|
|
|
|
- name: Check flake package versions
|
|
run: dotnet run tools/wayscriber.cs --no-build -- check nix-versions
|
|
|
|
- name: Check flake package and development shell instantiation
|
|
run: dotnet run tools/wayscriber.cs --no-build -- check nix-instantiation
|
|
|
|
dependency-policy:
|
|
name: Dependency policy (${{ matrix.checks }})
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
checks:
|
|
- advisories
|
|
- bans licenses sources
|
|
# A newly published advisory must not block unrelated pull requests.
|
|
continue-on-error: ${{ matrix.checks == 'advisories' }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Check dependency policy
|
|
uses: EmbarkStudios/cargo-deny-action@v2
|
|
with:
|
|
arguments: --workspace --locked
|
|
command: check ${{ matrix.checks }}
|
|
rust-version: 1.99.1
|