ci: Automate version bump to v2.1.0 #245
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Continuous Integration | |
| on: | |
| pull_request: | |
| paths-ignore: | |
| - "docs/**" | |
| - "*.md" | |
| - "LICENSE" | |
| push: | |
| branches: | |
| - main | |
| paths-ignore: | |
| - "docs/**" | |
| - "*.md" | |
| - "LICENSE" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| # Principle of least privilege: all jobs only read the repo (checkout + cargo). | |
| # Per-job override is unnecessary because no job pushes, creates releases or PRs. | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_INCREMENTAL: 0 | |
| CARGO_TERM_COLOR: always | |
| CARGO_NET_RETRY: 10 | |
| CARGO_NET_TIMEOUT: 60 | |
| jobs: | |
| fast-checks: | |
| name: 🏁 Fast Checks (Format) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: ./.github/actions/ubuntu | |
| - name: Install taplo | |
| run: cargo install taplo-cli --locked | |
| - name: Run format checks | |
| run: | | |
| taplo format --check --config taplo.toml | |
| cargo +nightly fmt --all -- --check | |
| build-and-test-matrix: | |
| name: 🛠️ Build & Test Matrix | |
| needs: fast-checks | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 45 | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| os: | |
| - ubuntu-latest | |
| - macos-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Setup Ubuntu | |
| if: matrix.os == 'ubuntu-latest' | |
| uses: ./.github/actions/ubuntu | |
| - name: Setup macOS | |
| if: matrix.os == 'macos-latest' | |
| uses: ./.github/actions/macos | |
| - name: Cache cargo registry & target | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-build-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-build- | |
| - name: Build | |
| run: cargo build --locked --release | |
| - name: Test | |
| run: cargo test --locked --release | |
| analysis: | |
| name: 🤖 Analysis (Clippy & Doc) | |
| needs: fast-checks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: ./.github/actions/ubuntu | |
| - name: Cache cargo registry & target | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-analysis-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-analysis- | |
| - name: Run clippy (workspace, all targets, all features) | |
| run: cargo clippy --workspace --all-targets --all-features --locked --release -- -D warnings | |
| - name: Generate documentation (workspace) | |
| run: cargo doc --workspace --locked --no-deps --all-features --release | |
| security-audit: | |
| name: 🔐 Security Audit (non-blocking) | |
| needs: fast-checks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Cache cargo-audit binary | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.cargo/bin/cargo-audit | |
| key: cargo-audit-bin-${{ runner.os }}-0.22.1 | |
| - name: Cache RustSec advisory database | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.cargo/advisory-db | |
| key: cargo-advisory-db-${{ runner.os }}-${{ github.run_id }} | |
| restore-keys: | | |
| cargo-advisory-db-${{ runner.os }}- | |
| - name: Install cargo-audit | |
| run: | | |
| if ! command -v cargo-audit >/dev/null 2>&1; then | |
| cargo install cargo-audit --locked --version 0.22.1 | |
| fi | |
| - name: Run cargo audit (informational only) | |
| # Only this step is non-blocking — every other step in this job | |
| # (checkout, caches, cargo-audit install) must fail loudly so we | |
| # don't silently skip the audit. | |
| continue-on-error: true | |
| run: cargo audit |