Skip to content

Commit 272548f

Browse files
epageepage
authored
Merge pull request #223 from epage/template
chore: Update from _rust template
2 parents 919dd34 + a381c41 commit 272548f

18 files changed

Lines changed: 302 additions & 128 deletions

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,16 @@
1-
<!--
2-
Quick reminders:
3-
- Was CHANGELOG.md updated?
4-
- Were tests written?
5-
- Is commit history clean?
6-
- Were copyright statements updated?
7-
- Was the predicate guide updated?
8-
-->
1+
<!-- Thanks for helping out! -->
2+
3+
### What does this PR try to solve?
4+
5+
<!-- a maintainer-approved Issue is required for non-trivial changes -->
6+
Closes #<!-- Issue # -->
7+
8+
### Notes to reviewers
9+
10+
<!--
11+
Examples:
12+
- Larger context this fits within
13+
- Manual testing and why it wasn't automated
14+
-->
15+
16+
LLM involvement: <!-- TODO -->

‎.github/renovate.json5‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
{
2+
extends: ["helpers:pinGitHubActionDigests"],
23
schedule: [
34
'before 5am on the first day of the month',
45
],
6+
minimumReleaseAge: "3 days",
7+
internalChecksFilter: "strict",
58
semanticCommits: 'enabled',
69
commitMessageLowerCase: 'never',
710
configMigration: true,
@@ -64,11 +67,19 @@
6467
matchDepNames: [
6568
'prek',
6669
],
67-
extractVersion: '^(?<version>\\d+\\.\\d+\\.\\d+)',
68-
schedule: [
69-
'* * * * *',
70+
extractVersion: '^v(?<version>\\d+\\.\\d+\\.\\d+)',
71+
automerge: true,
72+
},
73+
{
74+
matchManagers: [
75+
'github-actions',
76+
],
77+
matchUpdateTypes: [
78+
'minor',
79+
'patch',
7080
],
7181
automerge: true,
82+
groupName: 'compatible (actions)',
7283
},
7384
// Goals:
7485
// - Keep version reqs low, ignoring compatible normal/build dependencies

‎.github/workflows/audit.yml‎

Lines changed: 44 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,10 @@
1-
name: Security audit
1+
name: Audit
22

33
permissions:
44
contents: read
55

66
on:
77
pull_request:
8-
paths:
9-
- '**/Cargo.toml'
10-
- '**/Cargo.lock'
118
push:
129
branches:
1310
- master
@@ -22,19 +19,38 @@ concurrency:
2219
cancel-in-progress: true
2320

2421
jobs:
25-
security_audit:
22+
audit:
23+
permissions:
24+
contents: none
25+
name: Audit
26+
needs: [advisories, cargo_deny, actions]
27+
runs-on: ubuntu-latest
28+
if: "always()"
29+
steps:
30+
- name: Failed
31+
run: exit 1
32+
if: "contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')"
33+
advisories:
2634
permissions:
2735
issues: write # to create issues (actions-rs/audit-check)
2836
checks: write # to create check (actions-rs/audit-check)
2937
runs-on: ubuntu-latest
3038
# Prevent sudden announcement of a new advisory from failing ci:
3139
continue-on-error: true
40+
strategy:
41+
matrix:
42+
checks:
43+
- advisories
3244
steps:
3345
- name: Checkout repository
34-
uses: actions/checkout@v7
35-
- uses: actions-rs/audit-check@v1
46+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
47+
with:
48+
persist-credentials: false
49+
- name: Lint advisories
50+
uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
3651
with:
37-
token: ${{ secrets.GITHUB_TOKEN }}
52+
command: check ${{ matrix.checks }}
53+
rust-version: stable
3854

3955
cargo_deny:
4056
permissions:
@@ -46,8 +62,26 @@ jobs:
4662
checks:
4763
- bans licenses sources
4864
steps:
49-
- uses: actions/checkout@v7
50-
- uses: EmbarkStudios/cargo-deny-action@v2
65+
- name: Checkout repository
66+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
67+
with:
68+
persist-credentials: false
69+
- name: Lint bans
70+
uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
5171
with:
5272
command: check ${{ matrix.checks }}
5373
rust-version: stable
74+
75+
actions:
76+
runs-on: ubuntu-latest
77+
permissions:
78+
security-events: write
79+
contents: read # only needed for private or internal repos
80+
actions: read # only needed for private or internal repos
81+
steps:
82+
- name: Checkout repository
83+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
84+
with:
85+
persist-credentials: false
86+
- name: Run zizmor
87+
uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2

‎.github/workflows/ci.yml‎

Lines changed: 72 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ env:
1313
RUST_BACKTRACE: 1
1414
CARGO_TERM_COLOR: always
1515
CLICOLOR: 1
16+
CARGO_INCREMENTAL: 0
17+
RUST_TOOLCHAIN_STABLE: "1.98" # STABLE
1618

1719
concurrency:
1820
group: "${{ github.workflow }}-${{ github.ref }}"
@@ -43,13 +45,17 @@ jobs:
4345
CARGO_PROFILE_DEV_DEBUG: line-tables-only
4446
steps:
4547
- name: Checkout repository
46-
uses: actions/checkout@v7
48+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
49+
with:
50+
persist-credentials: false
4751
- name: Install Rust
48-
uses: dtolnay/rust-toolchain@stable
52+
run: rustup update --no-self-update ${{ matrix.rust }} && rustup default ${{ matrix.rust }}
53+
- name: Initialize cache
54+
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
55+
- name: Install cargo-hack
56+
uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
4957
with:
50-
toolchain: ${{ matrix.rust }}
51-
- uses: Swatinem/rust-cache@v2
52-
- uses: taiki-e/install-action@cargo-hack
58+
tool: cargo-hack
5359
- name: Build
5460
run: cargo test --workspace --no-run
5561
- name: Test
@@ -62,13 +68,17 @@ jobs:
6268
runs-on: ${{ matrix.os }}
6369
steps:
6470
- name: Checkout repository
65-
uses: actions/checkout@v7
71+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
72+
with:
73+
persist-credentials: false
6674
- name: Install Rust
67-
uses: dtolnay/rust-toolchain@stable
75+
run: rustup update --no-self-update stable && rustup default stable
76+
- name: Initialize cache
77+
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
78+
- name: Install cargo-hack
79+
uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
6880
with:
69-
toolchain: stable
70-
- uses: Swatinem/rust-cache@v2
71-
- uses: taiki-e/install-action@cargo-hack
81+
tool: cargo-hack
7282
- name: Default features
7383
run: cargo hack check --each-feature --locked --rust-version --ignore-private --workspace --all-targets --keep-going
7484
minimal-versions:
@@ -79,15 +89,13 @@ jobs:
7989
runs-on: ${{ matrix.os }}
8090
steps:
8191
- name: Checkout repository
82-
uses: actions/checkout@v7
83-
- name: Install stable Rust
84-
uses: dtolnay/rust-toolchain@stable
92+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
8593
with:
86-
toolchain: stable
94+
persist-credentials: false
95+
- name: Install stable Rust
96+
run: rustup update --no-self-update stable && rustup default stable
8797
- name: Install nightly Rust
88-
uses: dtolnay/rust-toolchain@stable
89-
with:
90-
toolchain: nightly
98+
run: rustup update --no-self-update nightly && rustup default nightly
9199
- name: Downgrade dependencies to minimal versions
92100
run: cargo +nightly generate-lockfile -Z minimal-versions
93101
- name: Compile with minimal versions
@@ -96,41 +104,45 @@ jobs:
96104
runs-on: ubuntu-latest
97105
steps:
98106
- name: Checkout repository
99-
uses: actions/checkout@v7
100-
- name: Install Rust
101-
uses: dtolnay/rust-toolchain@stable
107+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
102108
with:
103-
toolchain: stable
104-
- uses: Swatinem/rust-cache@v2
109+
persist-credentials: false
110+
- name: Install Rust
111+
run: rustup update --no-self-update stable && rustup default stable
112+
- name: Initialize cache
113+
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
105114
- name: "Is lockfile updated?"
106115
run: cargo update --workspace --locked
107116
docs:
108117
name: Docs
109118
runs-on: ubuntu-latest
110119
steps:
111120
- name: Checkout repository
112-
uses: actions/checkout@v7
113-
- name: Install Rust
114-
uses: dtolnay/rust-toolchain@stable
121+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
115122
with:
116-
toolchain: "1.98" # STABLE
117-
- uses: Swatinem/rust-cache@v2
123+
persist-credentials: false
124+
- name: Install Rust
125+
run: rustup update --no-self-update $RUST_TOOLCHAIN_STABLE && rustup default $RUST_TOOLCHAIN_STABLE
126+
- name: Initialize cache
127+
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
118128
- name: Check documentation
119129
env:
120-
RUSTDOCFLAGS: -D warnings
130+
CARGO_BUILD_WARNINGS: deny
121131
run: cargo doc --workspace --all-features --no-deps --document-private-items --keep-going
122132
rustfmt:
123133
name: rustfmt
124134
runs-on: ubuntu-latest
125135
steps:
126136
- name: Checkout repository
127-
uses: actions/checkout@v7
128-
- name: Install Rust
129-
uses: dtolnay/rust-toolchain@stable
137+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
130138
with:
131-
toolchain: "1.98" # STABLE
132-
components: rustfmt
133-
- uses: Swatinem/rust-cache@v2
139+
persist-credentials: false
140+
- name: Install Rust
141+
run: rustup update --no-self-update $RUST_TOOLCHAIN_STABLE && rustup default $RUST_TOOLCHAIN_STABLE
142+
- name: Install rustfmt
143+
run: rustup component add rustfmt
144+
- name: Initialize cache
145+
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
134146
- name: Check formatting
135147
run: cargo fmt --check
136148
clippy:
@@ -140,13 +152,15 @@ jobs:
140152
security-events: write # to upload sarif results
141153
steps:
142154
- name: Checkout repository
143-
uses: actions/checkout@v7
144-
- name: Install Rust
145-
uses: dtolnay/rust-toolchain@stable
155+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
146156
with:
147-
toolchain: "1.98" # STABLE
148-
components: clippy
149-
- uses: Swatinem/rust-cache@v2
157+
persist-credentials: false
158+
- name: Install Rust
159+
run: rustup update --no-self-update $RUST_TOOLCHAIN_STABLE && rustup default $RUST_TOOLCHAIN_STABLE
160+
- name: Install clippy
161+
run: rustup component add clippy
162+
- name: Initialize cache
163+
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
150164
- name: Install SARIF tools
151165
run: cargo install clippy-sarif --locked
152166
- name: Install SARIF tools
@@ -159,28 +173,35 @@ jobs:
159173
| sarif-fmt
160174
continue-on-error: true
161175
- name: Upload
162-
uses: github/codeql-action/upload-sarif@v4
176+
uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
163177
with:
164178
sarif_file: clippy-results.sarif
165179
wait-for-processing: true
166180
- name: Report status
167-
run: cargo clippy --workspace --all-features --all-targets --keep-going -- -D warnings --allow deprecated
181+
env:
182+
CARGO_BUILD_WARNINGS: deny
183+
run: cargo clippy --workspace --all-features --all-targets --keep-going -- --allow deprecated --allow renamed_and_removed_lints
168184
coverage:
169185
name: Coverage
170186
runs-on: ubuntu-latest
187+
permissions:
188+
code-quality: write
171189
steps:
172190
- name: Checkout repository
173-
uses: actions/checkout@v7
174-
- name: Install Rust
175-
uses: dtolnay/rust-toolchain@stable
191+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
176192
with:
177-
toolchain: stable
178-
- uses: Swatinem/rust-cache@v2
193+
persist-credentials: false
194+
- name: Install Rust
195+
run: rustup update --no-self-update stable && rustup default stable
196+
- name: Initialize cache
197+
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
179198
- name: Install cargo-tarpaulin
180199
run: cargo install cargo-tarpaulin
181200
- name: Gather coverage
182-
run: cargo tarpaulin --output-dir coverage --out lcov
183-
- name: Publish to Coveralls
184-
uses: coverallsapp/github-action@master
201+
run: cargo tarpaulin --out xml
202+
- name: Upload coverage report
203+
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
204+
uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
185205
with:
186-
github-token: ${{ secrets.GITHUB_TOKEN }}
206+
file: cobertura.xml
207+
language: Rust

‎.github/workflows/committed.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,11 @@ jobs:
2020
name: Lint Commits
2121
runs-on: ubuntu-latest
2222
steps:
23-
- name: Checkout Actions Repository
24-
uses: actions/checkout@v7
23+
- name: Checkout repository
24+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2525
with:
2626
fetch-depth: 0
27+
filter: "tree:0"
28+
persist-credentials: false
2729
- name: Lint Commits
28-
uses: crate-ci/committed@master
30+
uses: crate-ci/committed@faeed42f2e10c244533a01525f13c4d8b6ce383f # v1.1.11

‎.github/workflows/pre-commit.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,11 @@ jobs:
2222
contents: read
2323
runs-on: ubuntu-latest
2424
steps:
25-
- uses: actions/checkout@v7
26-
- uses: j178/prek-action@v3.0.0
25+
- name: Checkout repository
26+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2727
with:
28-
prek-version: '0.2.27'
28+
persist-credentials: false
29+
- name: prek
30+
uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
31+
with:
32+
prek-version: '0.5.0'

0 commit comments

Comments
 (0)