Claude
bbe53bac80
Gate runs fmt, clippy with warnings denied, cargo-machete, and nextest. nextest comes from a prebuilt binary rather than `cargo install` to keep the run short. Cache covers ~/.cargo and target/, keyed on Cargo.lock plus the toolchain file. Nothing builds --release. e2e is a separate workflow, main plus PRs touching the crates whose seams it covers. cargo-deny is weekly, off the push path. Closes #2 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
48 lines
1.2 KiB
YAML
48 lines
1.2 KiB
YAML
name: audit
|
|
|
|
# Advisories and licences. Deliberately off the per-push gate — DESIGN.md §12.
|
|
on:
|
|
schedule:
|
|
- cron: '17 4 * * 1'
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
deny:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Build deps
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends \
|
|
git curl ca-certificates build-essential pkg-config
|
|
|
|
- name: Cache cargo
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cargo/bin
|
|
~/.cargo/registry
|
|
~/.cargo/git
|
|
key: ${{ runner.os }}-audit-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-audit-
|
|
|
|
- name: Toolchain
|
|
run: |
|
|
if ! command -v cargo >/dev/null; then
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
|
|
| sh -s -- -y --profile minimal --no-modify-path
|
|
fi
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: cargo-deny
|
|
run: |
|
|
export PATH="$HOME/.cargo/bin:$PATH"
|
|
command -v cargo-deny >/dev/null || cargo install cargo-deny --locked
|
|
cargo deny check
|