137 lines
5.0 KiB
YAML
137 lines
5.0 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
tags: ["**"]
|
|
pull_request:
|
|
|
|
jobs:
|
|
rust:
|
|
name: cargo check + cargo test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: System deps (cpal / Opus / SQLite / SDL2)
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y \
|
|
libasound2-dev libpulse-dev pkg-config \
|
|
libdbus-1-dev \
|
|
libsdl2-dev \
|
|
libopus-dev
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: cargo check --workspace
|
|
run: cargo check --workspace --locked
|
|
- name: cargo test --workspace
|
|
env:
|
|
# Storage tests must not hit the real OS keyring on CI:
|
|
# there is no D-Bus session available and the call would
|
|
# block. The runtime code carries the same toggle for
|
|
# headless / sandboxed environments.
|
|
CHANORA_DISABLE_KEYRING: "1"
|
|
run: cargo test --workspace --locked --no-fail-fast
|
|
- name: cargo clippy
|
|
run: cargo clippy --workspace --all-targets -- -D warnings
|
|
continue-on-error: true
|
|
|
|
supply-chain:
|
|
name: cargo deny (licenses + advisories + bans + sources)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: EmbarkStudios/cargo-deny-action@v2
|
|
with:
|
|
command: check
|
|
# `licenses` enforces the DEC-020 license posture; the
|
|
# other three are minimal supply-chain hygiene per
|
|
# `docs/governance/legal-review-readiness.md` §5.
|
|
arguments: --workspace --all-features
|
|
|
|
license-inventory:
|
|
name: cargo about (license inventory)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: Install cargo-about
|
|
run: cargo install --locked --features cli cargo-about
|
|
- name: Regenerate inventory and compare
|
|
# Build the inventory in a temp file and diff against the
|
|
# committed copy. CI fails when the committed inventory is
|
|
# stale, forcing contributors to run the tool locally
|
|
# before opening a PR that touches the dependency tree.
|
|
run: |
|
|
cargo about generate --output-file /tmp/license-inventory.md about-md.hbs
|
|
diff docs/security/license-inventory.md /tmp/license-inventory.md \
|
|
|| { echo "::error::docs/security/license-inventory.md is stale; regenerate with 'cargo about generate --output-file docs/security/license-inventory.md about-md.hbs'"; exit 1; }
|
|
|
|
flutter-license-inventory:
|
|
name: flutter license inventory
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: stable
|
|
- name: flutter pub get
|
|
working-directory: apps/chanora_flutter
|
|
run: flutter pub get
|
|
- name: Regenerate Flutter license inventory and compare
|
|
env:
|
|
# Resolved by the wrapper from $HOME/sdks/flutter when
|
|
# not set; CI's subosito/flutter-action puts flutter on
|
|
# PATH but exports the SDK root under FLUTTER_ROOT.
|
|
FLUTTER_ROOT: ${{ env.FLUTTER_ROOT }}
|
|
run: |
|
|
./tools/dump_flutter_licenses.sh
|
|
if ! git diff --quiet docs/security/flutter-license-inventory.md; then
|
|
echo "::error::docs/security/flutter-license-inventory.md is stale; regenerate with 'tools/dump_flutter_licenses.sh'"
|
|
git --no-pager diff docs/security/flutter-license-inventory.md | head -40
|
|
exit 1
|
|
fi
|
|
|
|
flutter:
|
|
name: flutter analyze
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: stable
|
|
- name: flutter pub get
|
|
working-directory: apps/chanora_flutter
|
|
run: flutter pub get
|
|
- name: flutter analyze
|
|
working-directory: apps/chanora_flutter
|
|
run: flutter analyze
|
|
- name: flutter test (unit only)
|
|
working-directory: apps/chanora_flutter
|
|
run: flutter test --exclude-tags e2e
|
|
|
|
flutter-ios-release-build:
|
|
name: flutter iOS unsigned release build
|
|
runs-on: macos-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: stable
|
|
- name: flutter pub get
|
|
working-directory: apps/chanora_flutter
|
|
run: flutter pub get
|
|
- name: Check local SileroCoreML package
|
|
id: silero-coreml
|
|
run: |
|
|
if [ -d ../silero-coreml ]; then
|
|
echo "available=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "::notice::Skipping iOS build because ../silero-coreml is not available on this runner"
|
|
echo "available=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
- name: flutter build ios --no-codesign
|
|
if: steps.silero-coreml.outputs.available == 'true'
|
|
working-directory: apps/chanora_flutter
|
|
run: flutter build ios --release --no-codesign
|