Repository navigation
chore(deps): bump the cargo-minor-patch group across 1 directory with 5 updates #861
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Fast pull-request gate: type-check, unit tests and a cross-platform Rust | |
| # clippy/test pass. The heavy signed/notarized bundle build stays in | |
| # the default-branch release.yml (signalled by v* tags) — this never builds or | |
| # signs the .app. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| # Newer pushes to the same ref supersede in-flight runs. | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| frontend: | |
| name: Frontend | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| - run: npm ci | |
| - name: Type-check | |
| run: npm run check | |
| - name: Lint | |
| run: npm run lint | |
| - name: Unit tests | |
| run: npm run test --if-present | |
| - name: Build frontend | |
| run: npm run build | |
| rust: | |
| name: Rust | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [macos-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| - run: npm ci | |
| # tauri-build (frontendDist: ../dist) reads the built frontend at compile | |
| # time, so produce dist before touching cargo. We deliberately do NOT run | |
| # `tauri build` here — no bundling, no signing, no notarization. | |
| - name: Build frontend (for tauri-build) | |
| run: npm run build | |
| # Single Cargo workspace: src-tauri and all three engine crates are | |
| # workspace members, so one clippy/test pass at the root now covers | |
| # every member (previously the engines were only `cargo test`-ed | |
| # standalone and never linted with -D warnings). | |
| - name: Clippy (deny warnings) | |
| run: cargo clippy --workspace --all-targets --locked -- -D warnings | |
| - name: Test (workspace) | |
| run: cargo test --workspace --all-targets --locked | |
| audit: | |
| name: Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable | |
| - name: Audit npm lockfiles | |
| run: | | |
| npm audit --package-lock-only --audit-level=high | |
| npm --prefix website audit --package-lock-only --audit-level=high | |
| npm --prefix cloudflare/manager-download-router audit --package-lock-only --audit-level=high | |
| - name: Install pinned Rust audit tools | |
| run: | | |
| cargo install cargo-audit --version 0.22.0 --locked | |
| cargo install cargo-deny --version 0.18.9 --locked | |
| - name: Audit Rust lockfile | |
| run: cargo audit --file Cargo.lock | |
| - name: Enforce Rust dependency policy | |
| run: cargo deny check | |
| worker-test: | |
| name: Cloudflare worker tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Detect Cloudflare changes | |
| id: changes | |
| shell: bash | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$EVENT_NAME" = "pull_request" ] && [ -n "$BASE_SHA" ]; then | |
| git fetch --no-tags --depth=1 origin "$BASE_SHA" | |
| git diff --name-only "$BASE_SHA" HEAD > changed-files.txt | |
| elif [ -n "$BEFORE_SHA" ] && [ "$BEFORE_SHA" != "0000000000000000000000000000000000000000" ]; then | |
| git fetch --no-tags --depth=1 origin "$BEFORE_SHA" || true | |
| git diff --name-only "$BEFORE_SHA" HEAD > changed-files.txt || git show --name-only --format= HEAD > changed-files.txt | |
| else | |
| git show --name-only --format= HEAD > changed-files.txt | |
| fi | |
| if grep -q '^cloudflare/' changed-files.txt; then | |
| echo "run=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "run=false" >> "$GITHUB_OUTPUT" | |
| echo "No cloudflare/** changes; skipping worker tests." | |
| fi | |
| - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 | |
| if: steps.changes.outputs.run == 'true' | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: cloudflare/manager-download-router/package-lock.json | |
| - name: Install worker dependencies | |
| if: steps.changes.outputs.run == 'true' | |
| working-directory: cloudflare/manager-download-router | |
| run: npm ci | |
| - name: Run worker tests | |
| if: steps.changes.outputs.run == 'true' | |
| working-directory: cloudflare/manager-download-router | |
| run: npm test |