mirror of
https://github.com/neondatabase/neon.git
synced 2026-01-07 13:32:57 +00:00
10cf5e7a38
## Problem There are two (related) problems with the previous handling of `cargo-deny`: - When a new advisory is added to rustsec that affects a dependency, unrelated pull requests will fail. - New advisories rely on pushes or PRs to be surfaced. Problems that already exist on main will only be found if we try to merge new things into main. ## Summary of changes We split out `cargo-deny` into a separate workflow that runs on all PRs that touch `Cargo.lock`, and on a schedule on `main`, `release`, `release-compute` and `release-proxy` to find new advisories.
90 lines
3.3 KiB
YAML
90 lines
3.3 KiB
YAML
name: Check Codestyle Rust
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
build-tools-image:
|
|
description: "build-tools image"
|
|
required: true
|
|
type: string
|
|
archs:
|
|
description: "Json array of architectures to run on"
|
|
type: string
|
|
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash -euxo pipefail {0}
|
|
|
|
# No permission for GITHUB_TOKEN by default; the **minimal required** set of permissions should be granted in each job.
|
|
permissions: {}
|
|
|
|
jobs:
|
|
check-codestyle-rust:
|
|
strategy:
|
|
matrix:
|
|
arch: ${{ fromJson(inputs.archs) }}
|
|
runs-on: ${{ fromJson(format('["self-hosted", "{0}"]', matrix.arch == 'arm64' && 'small-arm64' || 'small')) }}
|
|
|
|
container:
|
|
image: ${{ inputs.build-tools-image }}
|
|
credentials:
|
|
username: ${{ secrets.NEON_DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.NEON_DOCKERHUB_PASSWORD }}
|
|
options: --init
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Cache cargo deps
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cargo/registry
|
|
!~/.cargo/registry/src
|
|
~/.cargo/git
|
|
target
|
|
key: v1-${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('./Cargo.lock') }}-${{ hashFiles('./rust-toolchain.toml') }}-rust
|
|
|
|
# Some of our rust modules use FFI and need those to be checked
|
|
- name: Get postgres headers
|
|
run: make postgres-headers -j$(nproc)
|
|
|
|
# cargo hack runs the given cargo subcommand (clippy in this case) for all feature combinations.
|
|
# This will catch compiler & clippy warnings in all feature combinations.
|
|
# TODO: use cargo hack for build and test as well, but, that's quite expensive.
|
|
# NB: keep clippy args in sync with ./run_clippy.sh
|
|
#
|
|
# The only difference between "clippy --debug" and "clippy --release" is that in --release mode,
|
|
# #[cfg(debug_assertions)] blocks are not built. It's not worth building everything for second
|
|
# time just for that, so skip "clippy --release".
|
|
- run: |
|
|
CLIPPY_COMMON_ARGS="$( source .neon_clippy_args; echo "$CLIPPY_COMMON_ARGS")"
|
|
if [ "$CLIPPY_COMMON_ARGS" = "" ]; then
|
|
echo "No clippy args found in .neon_clippy_args"
|
|
exit 1
|
|
fi
|
|
echo "CLIPPY_COMMON_ARGS=${CLIPPY_COMMON_ARGS}" >> $GITHUB_ENV
|
|
- name: Run cargo clippy (debug)
|
|
run: cargo hack --features default --ignore-unknown-features --feature-powerset clippy $CLIPPY_COMMON_ARGS
|
|
|
|
- name: Check documentation generation
|
|
run: cargo doc --workspace --no-deps --document-private-items
|
|
env:
|
|
RUSTDOCFLAGS: "-Dwarnings -Arustdoc::private_intra_doc_links"
|
|
|
|
# Use `${{ !cancelled() }}` to run quck tests after the longer clippy run
|
|
- name: Check formatting
|
|
if: ${{ !cancelled() }}
|
|
run: cargo fmt --all -- --check
|
|
|
|
# https://github.com/facebookincubator/cargo-guppy/tree/bec4e0eb29dcd1faac70b1b5360267fc02bf830e/tools/cargo-hakari#2-keep-the-workspace-hack-up-to-date-in-ci
|
|
- name: Check rust dependencies
|
|
if: ${{ !cancelled() }}
|
|
run: |
|
|
cargo hakari generate --diff # workspace-hack Cargo.toml is up-to-date
|
|
cargo hakari manage-deps --dry-run # all workspace crates depend on workspace-hack
|