diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml new file mode 100644 index 0000000..28b92cd --- /dev/null +++ b/.gitea/workflows/ci.yml @@ -0,0 +1,110 @@ +name: Rust CI + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +env: + CARGO_TERM_COLOR: always + +jobs: + fmt: + name: cargo fmt + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - name: Install Rust toolchain + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2 + with: + components: rustfmt + cache: false + - name: Check formatting + run: cargo fmt --all -- --check + + clippy: + name: cargo clippy + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - name: Install Rust toolchain + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2 + with: + components: clippy + cache: false + - name: Run clippy with all features + run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings + - name: Run clippy without default features + run: cargo clippy --workspace --all-targets --no-default-features --features toml --locked -- -D warnings + + verify: + name: cargo ${{ matrix.task }} (${{ matrix.target }}) + runs-on: ubuntu-latest + timeout-minutes: 30 + strategy: + fail-fast: false + matrix: + include: + - task: check + target: x86_64-unknown-linux-gnu + musl: false + - task: test + target: x86_64-unknown-linux-gnu + musl: false + - task: check + target: x86_64-unknown-linux-musl + musl: true + - task: test + target: x86_64-unknown-linux-musl + musl: true + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - name: Install musl toolchain + if: matrix.musl + run: | + sudo apt-get update + sudo apt-get install --no-install-recommends musl-tools + - name: Install Rust toolchain + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2 + with: + target: ${{ matrix.target }} + cache: false + - name: Run ${{ matrix.task }} with all features + run: cargo ${{ matrix.task }} --workspace --all-targets --all-features --target ${{ matrix.target }} --locked + - name: Run ${{ matrix.task }} without default features + run: cargo ${{ matrix.task }} --workspace --all-targets --no-default-features --features toml --target ${{ matrix.target }} --locked + + docs: + name: cargo doc + runs-on: ubuntu-latest + timeout-minutes: 20 + env: + RUSTDOCFLAGS: -D warnings + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - name: Install Rust toolchain + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2 + with: + cache: false + - name: Check documentation + run: cargo doc --workspace --all-features --no-deps --locked + - name: Run doctests + run: cargo test --workspace --doc --all-features --locked diff --git a/.gitea/workflows/supply-chain.yml b/.gitea/workflows/supply-chain.yml new file mode 100644 index 0000000..983ff59 --- /dev/null +++ b/.gitea/workflows/supply-chain.yml @@ -0,0 +1,63 @@ +name: Supply chain + +on: + push: + branches: [master] + pull_request: + branches: [master] + schedule: + - cron: "41 2 * * 1" + workflow_dispatch: + +permissions: + contents: read + +env: + ACTIONLINT_VERSION: 1.7.7 + CARGO_DENY_VERSION: 0.20.2 + +jobs: + cargo-deny: + name: cargo-deny ${{ matrix.checks }} + runs-on: ubuntu-latest + timeout-minutes: 15 + strategy: + fail-fast: false + matrix: + include: + - checks: advisories + continue-on-error: true + - checks: bans licenses sources + continue-on-error: false + continue-on-error: ${{ matrix.continue-on-error }} + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - name: Install cargo-deny + run: cargo install cargo-deny --version "${CARGO_DENY_VERSION}" --locked + - name: Run cargo-deny + run: cargo deny --manifest-path Cargo.toml --all-features check ${{ matrix.checks }} + + actionlint: + name: actionlint + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - name: Install actionlint + run: go install "github.com/rhysd/actionlint/cmd/actionlint@v${ACTIONLINT_VERSION}" + - name: Check workflow syntax + run: | + "$(go env GOPATH)/bin/actionlint" \ + .gitea/workflows/ci.yml \ + .gitea/workflows/supply-chain.yml \ + .github/workflows/actions-security.yml \ + .github/workflows/ci-arm.yml \ + .github/workflows/devskim.yml \ + .github/workflows/osv-scanner.yml \ + .github/workflows/rust-clippy.yml diff --git a/.github/workflows/actions-security.yml b/.github/workflows/actions-security.yml new file mode 100644 index 0000000..4a319f0 --- /dev/null +++ b/.github/workflows/actions-security.yml @@ -0,0 +1,35 @@ +name: GitHub Actions Security + +on: + push: + branches: [master] + pull_request: + branches: [master] + schedule: + - cron: "11 3 * * 1" + workflow_dispatch: + +permissions: + contents: read + +jobs: + zizmor: + name: zizmor + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + actions: read + security-events: write + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - name: Run zizmor + uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + with: + persona: regular + inputs: | + .github/workflows + .gitea/workflows diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml deleted file mode 100644 index 534076f..0000000 --- a/.github/workflows/build.yml +++ /dev/null @@ -1,26 +0,0 @@ -name: Build - -on: - push: - branches: [ "master" ] - pull_request: - branches: [ "master" ] - workflow_dispatch: - -env: - CARGO_TERM_COLOR: always - -jobs: - build: - - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v7 - - name: Install Mold - run: sudo apt install mold - - name: Install Rust toolchain - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2 - - - name: Build - run: cargo build --verbose diff --git a/.github/workflows/ci-arm.yml b/.github/workflows/ci-arm.yml new file mode 100644 index 0000000..b5fcb38 --- /dev/null +++ b/.github/workflows/ci-arm.yml @@ -0,0 +1,55 @@ +name: Rust ARM CI + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +env: + CARGO_TERM_COLOR: always + +jobs: + verify: + name: cargo ${{ matrix.task }} (${{ matrix.target }}) + runs-on: ubuntu-24.04-arm + timeout-minutes: 30 + strategy: + fail-fast: false + matrix: + include: + - task: check + target: aarch64-unknown-linux-gnu + musl: false + - task: test + target: aarch64-unknown-linux-gnu + musl: false + - task: check + target: aarch64-unknown-linux-musl + musl: true + - task: test + target: aarch64-unknown-linux-musl + musl: true + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - name: Install musl toolchain + if: matrix.musl + run: | + sudo apt-get update + sudo apt-get install --no-install-recommends musl-tools + - name: Install Rust toolchain + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2 + with: + target: ${{ matrix.target }} + cache: false + - name: Run ${{ matrix.task }} with all features + run: cargo ${{ matrix.task }} --workspace --all-targets --all-features --target ${{ matrix.target }} --locked + - name: Run ${{ matrix.task }} without default features + run: cargo ${{ matrix.task }} --workspace --all-targets --no-default-features --features toml --target ${{ matrix.target }} --locked diff --git a/.github/workflows/devskim.yml b/.github/workflows/devskim.yml index 9eade41..03d5db3 100644 --- a/.github/workflows/devskim.yml +++ b/.github/workflows/devskim.yml @@ -1,33 +1,29 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - +# This workflow uploads SARIF results to GitHub Code Scanning. name: DevSkim on: push: - branches: [ "master" ] + branches: [master] pull_request: - branches: [ "master" ] + branches: [master] schedule: - cron: '18 0 * * 4' +permissions: + contents: read + jobs: lint: name: DevSkim runs-on: ubuntu-latest permissions: - actions: read contents: read security-events: write steps: - name: Checkout code uses: actions/checkout@v7 - - name: Run DevSkim scanner uses: microsoft/DevSkim-Action@v1 - - name: Upload DevSkim scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@v4 with: diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 276bb96..6566034 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -1,55 +1,34 @@ # Copyright 2023 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. +# Licensed under the Apache License, Version 2.0. -name: OSV-Scanner Scheduled Scan +name: OSV-Scanner on: pull_request: - branches: ["master", "v1"] + branches: [master, v1] schedule: - cron: "12 12 * * 1" push: - branches: ["master", "v1"] + branches: [master, v1] -# Restrict jobs in this workflow to have no permissions by default; permissions -# should be granted per job as needed using a dedicated `permissions` block permissions: {} jobs: scan-scheduled: permissions: - contents: read # to fetch code (actions/checkout) - security-events: write # for uploading SARIF files + contents: read + security-events: write actions: read if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }} - # If you want to copy this config, highly suggest pinning this version to a release rather than tracking the main branch - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.6.0" + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.6.0 with: - # Just scan the root directory and docs, since everything else is fixtures - scan-args: |- - ./ - ./docs/ + scan-args: ./ scan-pr: permissions: - contents: read # to fetch code (actions/checkout) - security-events: write # for uploading SARIF files + contents: read + security-events: write actions: read if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} - # If you want to copy this config, highly suggest pinning this version to a release rather than tracking the main branch - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.6.0" + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.6.0 with: - # Just scan the root directory and docs, since everything else is fixtures - scan-args: |- - ./ - ./docs/ + scan-args: ./ diff --git a/.github/workflows/rust-clippy.yml b/.github/workflows/rust-clippy.yml index c807921..9d48796 100644 --- a/.github/workflows/rust-clippy.yml +++ b/.github/workflows/rust-clippy.yml @@ -1,55 +1,61 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. -# rust-clippy is a tool that runs a bunch of lints to catch common -# mistakes in your Rust code and help improve your Rust code. -# More details at https://github.com/rust-lang/rust-clippy -# and https://rust-lang.github.io/rust-clippy/ - -name: rust-clippy analyze +name: Clippy SARIF on: push: - branches: [ "master" ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ "master" ] + branches: [master] schedule: - - cron: '28 20 * * 3' + - cron: "17 12 * * 4" + workflow_dispatch: + +permissions: + contents: read + security-events: write + actions: read + +env: + CARGO_TERM_COLOR: always jobs: - rust-clippy-analyze: - name: Run rust-clippy analyzing + clippy-sarif: + name: Clippy SARIF runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + timeout-minutes: 25 steps: - - name: Checkout code - uses: actions/checkout@v7 - + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Install Rust toolchain - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af #@v1 + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2 with: - profile: minimal - toolchain: stable components: clippy - override: true - - - name: Install required cargo - run: cargo install clippy-sarif sarif-fmt - - - name: Run rust-clippy - run: - cargo clippy - --all-features - --message-format=json | clippy-sarif | tee rust-clippy-results.sarif | sarif-fmt - continue-on-error: true - - - name: Upload analysis results to GitHub - uses: github/codeql-action/upload-sarif@v4 + cache: false + - name: Install SARIF tools + run: cargo install --locked clippy-sarif sarif-fmt + - name: Run Clippy and generate SARIF + id: clippy + shell: bash + run: | + set +e + cargo clippy \ + --workspace \ + --all-targets \ + --all-features \ + --locked \ + --message-format=json \ + | clippy-sarif \ + | tee rust-clippy-results.sarif \ + | sarif-fmt + clippy_status=${PIPESTATUS[0]} + echo "exit_code=${clippy_status}" >> "$GITHUB_OUTPUT" + exit 0 + - name: Upload Clippy SARIF + uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 + if: always() with: sarif_file: rust-clippy-results.sarif + category: clippy wait-for-processing: true + - name: Fail if Clippy failed + if: steps.clippy.outputs.exit_code != '0' + run: exit 1 diff --git a/deny.toml b/deny.toml new file mode 100644 index 0000000..02acd7a --- /dev/null +++ b/deny.toml @@ -0,0 +1,50 @@ +# cargo-deny policy for sqm-autorate-rust. +# Keep published dependency sources and license terms explicit while allowing +# advisory reports to be reviewed without blocking unrelated changes. + +[graph] +all-features = true +no-default-features = false +targets = [] + +[output] +feature-depth = 1 + +[advisories] +yanked = "deny" +unmaintained = "workspace" +unsound = "workspace" +ignore = [] + +[licenses] +confidence-threshold = 0.8 +allow = [ + "Apache-2.0", + "BSD-2-Clause", + "BSD-3-Clause", + "CC0-1.0", + "ISC", + "MIT", + "MPL-2.0", + "Unicode-3.0", + "Zlib", +] + +[bans] +multiple-versions = "warn" +wildcards = "allow" +highlight = "all" +workspace-default-features = "allow" +external-default-features = "allow" + +[sources] +unknown-registry = "deny" +unknown-git = "deny" +required-git-spec = "rev" +allow-registry = ["https://github.com/rust-lang/crates.io-index"] +allow-git = ["https://github.com/Lochnair/rust-uci"] + +[sources.allow-org] +github = [] +gitlab = [] +bitbucket = []