Skip to content

Commit dff93a0

Browse files
dyrodyro
authored
Merge pull request #56 from contentauth/dyross/CI
chore: adds tests, clippy, formatting, and auditing to CI
2 parents 11745b9 + 345aba5 commit dff93a0

File tree

10 files changed

+322
-218
lines changed

10 files changed

+322
-218
lines changed

‎.github/workflows/build.yml‎

Lines changed: 212 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,185 @@ on:
1515
default: 'false'
1616

1717
jobs:
18+
tests:
19+
name: Unit tests
20+
21+
if: |
22+
github.event_name != 'pull_request' ||
23+
github.event.pull_request.author_association == 'COLLABORATOR' ||
24+
github.event.pull_request.author_association == 'MEMBER' ||
25+
github.event.pull_request.user.login == 'dependabot[bot]' ||
26+
contains(github.event.pull_request.labels.*.name, 'safe to test')
27+
28+
runs-on: ${{ matrix.os }}
29+
30+
strategy:
31+
fail-fast: false
32+
matrix:
33+
os: [ windows-latest, macos-latest, ubuntu-latest ]
34+
rust_version: [ stable, 1.76.0 ]
35+
36+
steps:
37+
- name: Checkout repository
38+
uses: actions/checkout@v4
39+
40+
- name: Install Rust toolchain
41+
uses: dtolnay/rust-toolchain@master
42+
with:
43+
toolchain: ${{ matrix.rust_version }}
44+
components: llvm-tools-preview
45+
46+
- name: Cache Rust dependencies
47+
uses: Swatinem/rust-cache@v2
48+
49+
clippy_check:
50+
name: Clippy
51+
52+
if: |
53+
github.event_name != 'pull_request' ||
54+
github.event.pull_request.author_association == 'COLLABORATOR' ||
55+
github.event.pull_request.author_association == 'MEMBER' ||
56+
github.event.pull_request.user.login == 'dependabot[bot]' ||
57+
contains(github.event.pull_request.labels.*.name, 'safe to test')
58+
59+
runs-on: ubuntu-latest
60+
61+
steps:
62+
- name: Checkout repository
63+
uses: actions/checkout@v4
64+
65+
- name: Install Rust toolchain
66+
uses: dtolnay/rust-toolchain@stable
67+
with:
68+
components: clippy
69+
70+
- name: Cache Rust dependencies
71+
uses: Swatinem/rust-cache@v2
72+
73+
- name: Run Clippy
74+
run: cargo clippy --all-features --all-targets -- -Dwarnings
75+
76+
cargo_fmt:
77+
name: Enforce Rust code format
78+
79+
if: |
80+
github.event_name != 'pull_request' ||
81+
github.event.pull_request.author_association == 'COLLABORATOR' ||
82+
github.event.pull_request.author_association == 'MEMBER' ||
83+
github.event.pull_request.user.login == 'dependabot[bot]' ||
84+
contains(github.event.pull_request.labels.*.name, 'safe to test')
85+
86+
runs-on: ubuntu-latest
87+
88+
steps:
89+
- name: Checkout repository
90+
uses: actions/checkout@v4
91+
92+
- name: Install nightly toolchain
93+
uses: dtolnay/rust-toolchain@nightly
94+
with:
95+
components: rustfmt
96+
97+
- name: Check format
98+
run: cargo +nightly fmt --all -- --check
99+
100+
docs_rs:
101+
name: Preflight docs.rs build
102+
103+
if: |
104+
github.event_name != 'pull_request' ||
105+
github.event.pull_request.author_association == 'COLLABORATOR' ||
106+
github.event.pull_request.author_association == 'MEMBER' ||
107+
github.event.pull_request.user.login == 'dependabot[bot]' ||
108+
contains(github.event.pull_request.labels.*.name, 'safe to test')
109+
110+
runs-on: ubuntu-latest
111+
112+
steps:
113+
- name: Checkout repository
114+
uses: actions/checkout@v4
115+
116+
- name: Install nightly Rust toolchain
117+
# Nightly is used here because the docs.rs build
118+
# uses nightly and we use doc_cfg features that are
119+
# not in stable Rust as of this writing (Rust 1.76).
120+
uses: dtolnay/rust-toolchain@nightly
121+
122+
- name: Run cargo docs
123+
# This is intended to mimic the docs.rs build
124+
# environment. The goal is to fail PR validation
125+
# if the subsequent release would result in a failed
126+
# documentation build on docs.rs.
127+
run: cargo +nightly doc --workspace --all-features --no-deps
128+
env:
129+
RUSTDOCFLAGS: --cfg docsrs
130+
DOCS_RS: 1
131+
cargo-deny:
132+
name: License / vulnerability audit
133+
134+
if: |
135+
github.event_name != 'pull_request' ||
136+
github.event.pull_request.author_association == 'COLLABORATOR' ||
137+
github.event.pull_request.author_association == 'MEMBER' ||
138+
github.event.pull_request.user.login == 'dependabot[bot]' ||
139+
contains(github.event.pull_request.labels.*.name, 'safe to test')
140+
141+
runs-on: ubuntu-latest
142+
143+
strategy:
144+
fail-fast: false
145+
matrix:
146+
checks:
147+
- advisories
148+
- bans licenses sources
149+
150+
# Prevent sudden announcement of a new advisory from failing CI:
151+
continue-on-error: ${{ matrix.checks == 'advisories' }}
152+
153+
steps:
154+
- name: Checkout repository
155+
uses: actions/checkout@v4
156+
157+
- name: Audit crate dependencies
158+
uses: EmbarkStudios/cargo-deny-action@v2
159+
with:
160+
command: check ${{ matrix.checks }}
161+
162+
unused_deps:
163+
name: Check for unused dependencies
164+
165+
if: |
166+
github.event_name != 'pull_request' ||
167+
github.event.pull_request.author_association == 'COLLABORATOR' ||
168+
github.event.pull_request.author_association == 'MEMBER' ||
169+
github.event.pull_request.user.login == 'dependabot[bot]' ||
170+
contains(github.event.pull_request.labels.*.name, 'safe to test')
171+
172+
runs-on: ubuntu-latest
173+
174+
steps:
175+
- name: Checkout repository
176+
uses: actions/checkout@v4
177+
178+
- name: Install nightly Rust toolchain
179+
uses: dtolnay/rust-toolchain@nightly
180+
181+
- name: Run cargo-udeps
182+
uses: aig787/cargo-udeps-action@v1
183+
with:
184+
version: latest
185+
args: --all-targets --all-features
186+
18187
linux:
19188
runs-on: ubuntu-latest
189+
190+
if: |
191+
github.event_name != 'pull_request' ||
192+
github.event.pull_request.author_association == 'COLLABORATOR' ||
193+
github.event.pull_request.author_association == 'MEMBER' ||
194+
github.event.pull_request.user.login == 'dependabot[bot]' ||
195+
contains(github.event.pull_request.labels.*.name, 'safe to test')
196+
20197
strategy:
21198
matrix:
22199
target: [x86_64, aarch64]
@@ -63,6 +240,14 @@ jobs:
63240

64241
windows:
65242
runs-on: windows-latest
243+
244+
if: |
245+
github.event_name != 'pull_request' ||
246+
github.event.pull_request.author_association == 'COLLABORATOR' ||
247+
github.event.pull_request.author_association == 'MEMBER' ||
248+
github.event.pull_request.user.login == 'dependabot[bot]' ||
249+
contains(github.event.pull_request.labels.*.name, 'safe to test')
250+
66251
strategy:
67252
matrix:
68253
target: [x64, x86]
@@ -88,6 +273,14 @@ jobs:
88273

89274
macos_x86:
90275
runs-on: macos-latest
276+
277+
if: |
278+
github.event_name != 'pull_request' ||
279+
github.event.pull_request.author_association == 'COLLABORATOR' ||
280+
github.event.pull_request.author_association == 'MEMBER' ||
281+
github.event.pull_request.user.login == 'dependabot[bot]' ||
282+
contains(github.event.pull_request.labels.*.name, 'safe to test')
283+
91284
steps:
92285
- uses: actions/checkout@v4
93286
- uses: actions/setup-python@v5
@@ -109,6 +302,14 @@ jobs:
109302

110303
macos_aarch64:
111304
runs-on: macos-latest-large
305+
306+
if: |
307+
github.event_name != 'pull_request' ||
308+
github.event.pull_request.author_association == 'COLLABORATOR' ||
309+
github.event.pull_request.author_association == 'MEMBER' ||
310+
github.event.pull_request.user.login == 'dependabot[bot]' ||
311+
contains(github.event.pull_request.labels.*.name, 'safe to test')
312+
112313
steps:
113314
- uses: actions/checkout@v4
114315
- uses: actions/setup-python@v5
@@ -130,6 +331,14 @@ jobs:
130331

131332
sdist:
132333
runs-on: ubuntu-latest
334+
335+
if: |
336+
github.event_name != 'pull_request' ||
337+
github.event.pull_request.author_association == 'COLLABORATOR' ||
338+
github.event.pull_request.author_association == 'MEMBER' ||
339+
github.event.pull_request.user.login == 'dependabot[bot]' ||
340+
contains(github.event.pull_request.labels.*.name, 'safe to test')
341+
133342
steps:
134343
- uses: actions/checkout@v4
135344
- name: Build sdist
@@ -145,9 +354,11 @@ jobs:
145354

146355
release:
147356
name: Release
357+
358+
if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true'
359+
148360
runs-on: ubuntu-latest
149361
environment: Publish
150-
if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true'
151362
needs: [linux, windows, macos_x86, macos_aarch64, sdist]
152363
steps:
153364
- uses: actions/download-artifact@v3

‎Cargo.toml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ authors = ["Gavin Peacock <[email protected]"]
99
name = "c2pa"
1010
crate-type = ["cdylib"]
1111

12+
[package.metadata.cargo-udeps.ignore]
13+
normal = ["openssl-src"]
1214

1315
[dependencies]
1416
c2pa = {version = "0.35.0", features = ["unstable_api", "file_io", "openssl", "pdf", "fetch_remote_manifests"]}
@@ -20,7 +22,6 @@ thiserror = "1.0.49"
2022
uniffi = "0.24.1"
2123
openssl-src = "=300.3.1" # Required for openssl-sys
2224
log = "0.4.21"
23-
env_logger = "0.11.3"
2425

2526
[build-dependencies]
2627
uniffi = { version = "0.24.1", features = ["build"] }

‎deny.toml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Configuration used for dependency checking with cargo-deny.
2+
#
3+
# For further details on all configuration options see:
4+
# https://embarkstudios.github.io/cargo-deny/checks/cfg.html
5+
6+
[graph]
7+
targets = [
8+
{ triple = "x86_64-unknown-linux-gnu" },
9+
{ triple = "x86_64-apple-darwin" },
10+
{ triple = "x86_64-pc-windows-msvc" },
11+
{ triple = "aarch64-apple-darwin" },
12+
{ triple = "wasm32-unknown-unknown" },
13+
]
14+
15+
[advisories]
16+
yanked = "deny"
17+
18+
ignore = [
19+
"RUSTSEC-2021-0127", # serde_cbor
20+
"RUSTSEC-2023-0071", # rsa Marvin Attack: (https://jira.corp.adobe.com/browse/CAI-5104)
21+
]
22+
23+
[bans]
24+
multiple-versions = "allow"
25+
26+
[licenses]
27+
allow = [
28+
"Apache-2.0",
29+
"BSD-2-Clause",
30+
"BSD-3-Clause",
31+
"CC0-1.0",
32+
"ISC",
33+
"LicenseRef-ring",
34+
"MIT",
35+
"MPL-2.0",
36+
"Unicode-DFS-2016",
37+
"Zlib",
38+
]
39+
confidence-threshold = 0.9
40+
41+
[[licenses.clarify]]
42+
name = "ring"
43+
expression = "LicenseRef-ring"
44+
license-files = [
45+
{ path = "LICENSE", hash = 3171872035 }
46+
]
47+
48+
[sources]
49+
unknown-registry = "deny"
50+
unknown-git = "deny"
51+
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
52+
allow-git = []

0 commit comments

Comments
 (0)