.github/workflows/ci.yml
# **The checks, run where nobody has to remember to run them.**
#
# `xtask/src/main.rs` says it plainly and it is still true: `cargo xtask ci` is
# the whole of gunnar's CI, and it is host-agnostic on purpose — it reads no
# `GITHUB_*` variable, emits no `::error::` annotation and assumes no runner
# image. That decision is kept here. Every step below is ONE `cargo` line, so
# this file knows nothing about gunnar's rules and gunnar's rules know nothing
# about this file. The moment a rule is written in YAML instead of in Rust, the
# two copies start to drift and the one in YAML is the one people believe.
#
# ── what this closes ─────────────────────────────────────────────────────────
#
# The 0-known-CVE gate existed and nothing ran it per push: it was a step of a
# command a human types, plus a door inside one machine's deploy script. So
# "0 known CVE" was proved per deploy and per remembered invocation, and a
# branch that went straight to a tag was never asserted at all. The same was
# true of the test suite. A gate that runs when somebody remembers is a gate
# that is green on the days it matters least.
#
# ── what it does not cover, said out loud ────────────────────────────────────
#
# `cargo xtask ci` also runs `fmt`, the appliance build and the image-format
# guards. They are NOT here. This repository is deliberately not rustfmt-clean
# (see `xtask/src/fmt.rs`), and the appliance steps want tools a hosted runner
# does not have; adding them would make this red for reasons that are not
# defects, and a check that is always red teaches people to stop reading it.
#
# Two tests are skipped BY NAME below, and the names are in the command rather
# than in a comment so a green cannot quietly cover less than it claims. Both
# refuse to skip themselves — correctly: `cli_matrix` used to `return` and
# report `ok` on a box without a `dwarves` binary, which made the CLI door
# "tested" by a test that could not fail. They need a sibling repository's
# binary, which no hosted runner has. Skipping them here is a fact about the
# runner; failing them here would be a fact about nothing.
name: ci
on:
push:
branches: [master]
pull_request:
# Read the code, and nothing else. No step here writes to the repository, opens
# an issue, or touches a package, so nothing here needs a token that can.
permissions:
contents: read
concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true
jobs:
cve:
name: the 0-known-CVE gate
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
# `--locked` so the gate's own tool is resolved from cargo-deny's
# committed lockfile: a supply-chain check installed from a floating
# graph is a strange thing to trust.
- name: install cargo-deny
run: cargo install --locked cargo-deny
# A runner has no advisory database, so this FETCHES one — which is the
# whole point. `cve::may_stay_offline` refuses to read an absent or stale
# database offline, so a runner cannot produce the millisecond
# `advisories ok` that says nothing.
- name: cargo xtask cve
run: cargo xtask cve
test:
name: the suite
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
# `--no-fail-fast`: one red test must not hide the state of the rest.
# `--features`: exactly the list `cargo xtask ci` runs the suite with
# (`xtask::ci_check::SUITE_FEATURES`; `cargo xtask ci-check` holds the two
# equal). Each is default-off and gates whole test targets: without
# `gunnar-cli/http` the smart-HTTP suite (`http_transport`,
# `shallow_delta_blob`, …) is never compiled here and reports nothing.
# The two skips are the `dwarves` matrix — see the header.
- name: cargo test --workspace
run: >
cargo test --workspace --no-fail-fast
--features gunnar-lfs/fs,gunnar-cli/http,gunnar-server/fleet-pull,gunnar-server/mirror-http,gunnar-server/sso-egress
--
--skip every_declared_variant_passes_through_the_cli_door
--skip the_real_chain_pins_the_kernel_the_choice_names