ci: Automate hdwallet version bump to hdwallet-v3.0.0 #465
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Continuous Integration | |
| on: | |
| pull_request: | |
| paths-ignore: | |
| - "docs/**" | |
| - "*.md" | |
| - "LICENSE" | |
| push: | |
| branches: | |
| - master | |
| paths-ignore: | |
| - "docs/**" | |
| - "*.md" | |
| - "LICENSE" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| # Principle of least privilege: all jobs only read the repo (checkout + cargo). | |
| # Per-job override is unnecessary because no job pushes, creates releases or PRs. | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_INCREMENTAL: 0 | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| fast-checks: | |
| name: 🏁 Fast Checks (Format) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Install Rust toolchain (from rust-toolchain file) | |
| run: | | |
| rustup toolchain install | |
| rustup component add rustfmt --toolchain nightly | |
| - name: Install taplo | |
| run: cargo install taplo-cli --locked | |
| - name: Run format checks | |
| run: | | |
| taplo format --check --config taplo.toml | |
| cargo +nightly fmt --all -- --check | |
| test-workspace: | |
| name: 🧪 Test Workspace | |
| needs: fast-checks | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: | |
| - ubuntu-latest | |
| - macos-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Install Rust toolchain (from rust-toolchain file) | |
| run: rustup toolchain install | |
| - name: Cache cargo registry | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| - name: Build workspace | |
| run: cargo build --workspace --locked | |
| - name: Test workspace | |
| run: cargo test --workspace --locked | |
| no-std-build: | |
| name: 📦 no_std Build (wasm32v1-none) | |
| needs: fast-checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Install Rust toolchain (from rust-toolchain file) | |
| run: rustup toolchain install | |
| - name: Cache cargo registry | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-wasm-${{ hashFiles('**/Cargo.lock') }} | |
| # wasm32v1-none is the target used by Substrate runtimes (chain, chain-update2512, | |
| # libp2p-identity-pqc, qp-libp2p-identity) which depend on these crates as no_std. | |
| # A regression here breaks the entire downstream stack. | |
| - name: Build dilithium for wasm32v1-none (no_std) | |
| run: cargo build --locked --target wasm32v1-none -p qp-rusty-crystals-dilithium --no-default-features | |
| - name: Build hdwallet for wasm32v1-none (no_std) | |
| run: cargo build --locked --target wasm32v1-none -p qp-rusty-crystals-hdwallet --no-default-features | |
| analysis: | |
| name: 🤖 Analysis (Clippy & Doc) | |
| needs: fast-checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Install Rust toolchain (from rust-toolchain file) | |
| run: | | |
| rustup toolchain install | |
| rustup component add clippy rust-src | |
| - name: Cache cargo registry | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| - name: Run clippy (workspace) | |
| run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings | |
| - name: Generate documentation | |
| run: cargo doc --workspace --locked --no-deps --all-features | |
| - name: Check documentation | |
| run: cargo doc --workspace --locked --no-deps --all-features --document-private-items | |
| stack-budget: | |
| name: 📏 Stack Budget (thumbv7em) | |
| needs: fast-checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Cache cargo registry | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-stack-${{ hashFiles('**/Cargo.lock') }} | |
| # Worst single frame is currently ~107 KB (sign::signature). A 128 KB budget | |
| # leaves headroom for noise but trips if the ~56 KB materialized matrix A | |
| # ever comes back. The script installs its own pinned nightly + llvm-tools. | |
| - name: Check per-function stack frames against budget | |
| run: ./stack-check.sh 128 | |
| security-audit: | |
| name: 🔒 Security Audit | |
| needs: fast-checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| - name: Run security audit | |
| run: cargo audit |