cargo-rail/.github/workflows/commit.yaml at main · loadingalias/cargo-rail · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
name: Commit

on:
  push:
    branches:
      - "**"

  pull_request:
    branches:
      - main

  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  RUST_BACKTRACE: 1
  CARGO_TERM_COLOR: always
  CARGO_RAIL_TEST_MODE: commit
  CARGO_INCREMENTAL: 0

permissions:
  contents: read
  checks: write
  pull-requests: write

jobs:
  # ==========================================================================
  # Job 1: Planner
  # ==========================================================================
  plan:
    name: Plan
    runs-on: ubuntu-latest
    outputs:
      build: ${{ steps.plan.outputs.build }}
      test: ${{ steps.plan.outputs.test }}
      docs: ${{ steps.plan.outputs.docs }}
      infra: ${{ steps.plan.outputs.infra }}
      surface: ${{ steps.surface.outputs.surface }}
      base-ref: ${{ steps.plan.outputs.base-ref }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Build Plan
        id: plan
        uses: loadingalias/cargo-rail-action@ebc8ef2740efefe2cd5c42826344a8f1213113ae # v6.1.2
        with:
          version: 0.20.1
          since: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
          args: "--explain"

      - name: Export surface gate
        id: surface
        shell: bash
        env:
          SURFACES_JSON: ${{ steps.plan.outputs.surfaces-json }}
        run: |
          set -euo pipefail
          # Planner 0.20.1 predates the native gate. Missing must broaden to true until
          # the action pin advances; a legacy plan must never skip Surface enforcement.
          surface="$(
            python3 <<'PY'
          import json
          import os

          surfaces = json.loads(os.environ["SURFACES_JSON"])
          print(str(surfaces.get("surface", True)).lower())
          PY
          )"
          echo "surface=$surface" >> "$GITHUB_OUTPUT"

  quality:
    name: Quality and Security
    needs: plan
    if: needs.plan.outputs.build == 'true' || needs.plan.outputs.test == 'true' || needs.plan.outputs.docs == 'true' || needs.plan.outputs.infra == 'true' || needs.plan.outputs.surface == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup
        uses: ./.github/actions/setup
        with:
          cache-key: commit-quality
          install-nextest: "true"

      - name: Install cargo-deny
        uses: taiki-e/install-action@91ddec75689c4c78665b598d188dc821c5a43e5c # v2.85.9
        with:
          tool: cargo-deny

      - name: Quality checks
        run: just check-ci

      - name: Exact compiler fact driver
        run: |
          rustup component add rustc-dev
          just check-compiler-fact-driver

  compatibility:
    name: Compatibility
    needs: [quality, plan]
    if: needs.plan.outputs.build == 'true' || needs.plan.outputs.test == 'true' || needs.plan.outputs.infra == 'true' || needs.plan.outputs.surface == 'true'
    uses: ./.github/workflows/compatibility.yaml
    with:
      ref: ${{ github.sha }}
      cache-prefix: commit

  release-archives:
    name: Release Archive Gate
    needs: [quality, plan]
    if: needs.plan.outputs.infra == 'true'
    permissions:
      contents: read
    uses: ./.github/workflows/release-archives.yaml
    with:
      ref: ${{ github.sha }}
      stage: false

  surface:
    name: Rust Surface
    needs: [quality, plan]
    if: needs.plan.outputs.surface == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup
        uses: ./.github/actions/setup
        with:
          cache-key: commit-surface

      - name: Enforce planner-selected surface
        run: |
          rustup component add rustc-dev
          scripts/with-compiler-fact-driver.sh cargo build --locked \
            --bin cargo-rail --bin cargo-rail-compiler-observation
          target/debug/cargo-rail rail surface --check --format github