ci: per-push gate, e2e and audit workflows

Gate runs fmt, clippy with warnings denied, cargo-machete, and nextest. nextest comes from a prebuilt binary rather than `cargo install` to keep the run short. Cache covers ~/.cargo and target/, keyed on Cargo.lock plus the toolchain file. Nothing builds --release. e2e is a separate workflow, main plus PRs touching the crates whose seams it covers. cargo-deny is weekly, off the push path. Closes #2 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-22 19:20:47 +01:00
parent f4e63f1ac5
commit bbe53bac80
4 changed files with 258 additions and 0 deletions
@@ -0,0 +1,47 @@
+name: audit
+
+# Advisories and licences. Deliberately off the per-push gate — DESIGN.md §12.
+on:
+  schedule:
+    - cron: '17 4 * * 1'
+  workflow_dispatch:
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  deny:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build deps
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            git curl ca-certificates build-essential pkg-config
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: ${{ runner.os }}-audit-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-audit-
+
+      - name: Toolchain
+        run: |
+          if ! command -v cargo >/dev/null; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+              | sh -s -- -y --profile minimal --no-modify-path
+          fi
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: cargo-deny
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          command -v cargo-deny >/dev/null || cargo install cargo-deny --locked
+          cargo deny check
@@ -0,0 +1,112 @@
+name: ci
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+env:
+  CARGO_TERM_COLOR: always
+  # Debug symbols are the bulk of the target/ cache and nothing here reads them.
+  CARGO_PROFILE_DEV_DEBUG: "0"
+
+jobs:
+  rust:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build deps
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            git curl ca-certificates build-essential pkg-config
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Toolchain
+        run: |
+          if ! command -v cargo >/dev/null; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+              | sh -s -- -y --profile minimal --no-modify-path
+          fi
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Gate tools
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          # Prebuilt binaries — `cargo install` from source costs minutes.
+          command -v cargo-nextest >/dev/null || \
+            curl -LsSf https://get.nexte.st/latest/linux \
+              | tar zxf - -C "$HOME/.cargo/bin"
+          command -v cargo-machete >/dev/null || \
+            cargo install cargo-machete --locked
+
+      - name: fmt
+        run: cargo fmt --all -- --check
+
+      - name: clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: unused deps
+        run: cargo machete
+
+      - name: test
+        run: cargo nextest run --workspace --exclude arr-e2e
+
+  web:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Skip when the frontend does not exist yet
+        id: probe
+        run: |
+          if [ -d web ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "web/ not present yet (issue #6), skipping"
+          fi
+
+      - name: Node and pnpm
+        if: steps.probe.outputs.present == 'true'
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends curl ca-certificates
+          curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+          apt-get install -y --no-install-recommends nodejs
+          corepack enable
+          corepack prepare pnpm@latest --activate
+
+      - name: Cache pnpm store
+        if: steps.probe.outputs.present == 'true'
+        uses: actions/cache@v4
+        with:
+          path: ~/.local/share/pnpm/store
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('web/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-
+
+      - name: install
+        if: steps.probe.outputs.present == 'true'
+        run: pnpm -C web install --frozen-lockfile
+
+      - name: biome
+        if: steps.probe.outputs.present == 'true'
+        run: pnpm -C web exec biome ci .
+
+      - name: typecheck
+        if: steps.probe.outputs.present == 'true'
+        run: pnpm -C web exec tsc -b --noEmit
@@ -0,0 +1,74 @@
+name: e2e
+
+# Kept off the per-push gate deliberately — DESIGN.md §12. Runs on main, and on
+# pull requests that touch the crates whose seams these tests cover.
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths:
+      - 'crates/arr-e2e/**'
+      - 'crates/arr-dl/**'
+      - 'crates/arr-indexer/**'
+      - 'crates/arr-probe/**'
+      - 'crates/arr-daemon/**'
+      - '.gitea/workflows/e2e.yml'
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_PROFILE_DEV_DEBUG: "0"
+
+jobs:
+  e2e:
+    runs-on: ubuntu-latest
+
+    services:
+      transmission:
+        image: linuxserver/transmission:latest
+        env:
+          PUID: "1000"
+          PGID: "1000"
+        ports:
+          - 9091:9091
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build deps and ffmpeg
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            git curl ca-certificates build-essential pkg-config ffmpeg
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Toolchain
+        run: |
+          if ! command -v cargo >/dev/null; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+              | sh -s -- -y --profile minimal --no-modify-path
+          fi
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: nextest
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          command -v cargo-nextest >/dev/null || \
+            curl -LsSf https://get.nexte.st/latest/linux \
+              | tar zxf - -C "$HOME/.cargo/bin"
+
+      - name: e2e
+        env:
+          TRANSMISSION_RPC_URL: http://transmission:9091/transmission/rpc
+        run: cargo nextest run -p arr-e2e
@@ -0,0 +1,25 @@
+[advisories]
+version = 2
+yanked = "deny"
+
+[licenses]
+version = 2
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Unicode-3.0",
+    "Zlib",
+    "MPL-2.0",
+]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"