Rust Security and Coverage #932
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Rust Security and Coverage | |
| on: | |
| pull_request: | |
| branches: [main, feat/engine] | |
| paths: | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - "crates/**" | |
| - "engine/**" | |
| - ".cargo/audit.toml" | |
| - ".config/coverage-baseline.json" | |
| - ".config/deny.toml" | |
| - ".github/workflows/rust-security-and-coverage.yml" | |
| - "docs/CI_SECURITY_AND_COVERAGE.md" | |
| - "docs/LICENSING.md" | |
| - "scripts/summarize-rust-coverage.mjs" | |
| - "scripts/verify-rustsec-exceptions.mjs" | |
| - "scripts/verify-rustsec-report.mjs" | |
| schedule: | |
| - cron: "23 5 * * *" | |
| workflow_dispatch: | |
| # Superseded PR commits share a group; pushes, schedules and manual runs are independent. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| cargo-audit: | |
| name: Cargo Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable | |
| with: | |
| toolchain: 1.98.0 | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2 | |
| - name: Install cargo-audit | |
| uses: taiki-e/install-action@724a716c48615d544d33401a24b782e907dc5881 # cargo-audit | |
| with: | |
| tool: cargo-audit@0.22.2 | |
| - name: Verify advisory exception governance | |
| run: node scripts/verify-rustsec-exceptions.mjs | |
| - name: Run cargo audit and initialize advisory database | |
| run: cargo audit | |
| - name: Run ignore-free RustSec reconciliation | |
| run: node scripts/verify-rustsec-report.mjs | |
| cargo-deny: | |
| name: Cargo Deny | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable | |
| with: | |
| toolchain: 1.98.0 | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2 | |
| # Pinned: the @cargo-deny ref installs latest, and 0.20 broke CI by | |
| # moving `check --config` to the root command. Bump deliberately. | |
| - name: Install cargo-deny | |
| uses: taiki-e/install-action@7572810d7dd469b651bb7793945692cf78da5dd7 # v2 | |
| with: | |
| tool: cargo-deny@0.20.2 | |
| - name: Check licenses and bans | |
| run: | | |
| echo "Using cargo-deny policy from .config/deny.toml" | |
| cargo deny --config .config/deny.toml check licenses bans sources | |
| - name: Check advisories | |
| run: cargo deny --config .config/deny.toml check advisories | |
| coverage: | |
| name: Governance Coverage | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 90 | |
| env: | |
| CARGO_PROFILE_DEV_DEBUG: "line-tables-only" | |
| CARGO_PROFILE_TEST_DEBUG: "line-tables-only" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Free runner disk space | |
| run: | | |
| df -h / | |
| sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \ | |
| /usr/local/.ghcup /opt/hostedtoolcache/CodeQL | |
| sudo docker image prune --all --force >/dev/null 2>&1 || true | |
| df -h / | |
| - name: Install Rust with llvm-tools | |
| uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable | |
| with: | |
| toolchain: 1.98.0 | |
| components: llvm-tools-preview | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2 | |
| - name: Install cargo-nextest | |
| uses: taiki-e/install-action@10ddf82bb4948219b68187f154decde56c89ee88 # nextest | |
| - name: Install cargo-llvm-cov | |
| uses: taiki-e/install-action@75a348306ce8f67c0b06fc62c32a8546140ba955 # cargo-llvm-cov | |
| - name: Run governance coverage | |
| run: | | |
| mkdir -p target/coverage | |
| cargo llvm-cov clean --workspace | |
| cargo llvm-cov nextest \ | |
| -p tandem-tools \ | |
| -p tandem-plan-compiler \ | |
| -p tandem-automation \ | |
| --profile ci \ | |
| --lcov \ | |
| --output-path target/coverage/lcov.info | |
| - name: Summarize coverage | |
| run: | | |
| node scripts/summarize-rust-coverage.mjs \ | |
| --lcov target/coverage/lcov.info \ | |
| --baseline .config/coverage-baseline.json \ | |
| --out-md target/coverage/rust-coverage-summary.md \ | |
| --out-json target/coverage/rust-coverage-summary.json | |
| cat target/coverage/rust-coverage-summary.md >> "$GITHUB_STEP_SUMMARY" | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: governance-coverage | |
| path: | | |
| target/coverage/lcov.info | |
| target/coverage/rust-coverage-summary.md | |
| target/coverage/rust-coverage-summary.json | |
| retention-days: 30 |