chore(deps): bump the rust-dependencies group with 3 updates #3672
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_call: | |
| permissions: | |
| contents: read | |
| checks: write | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| RG_VERSION: 15.1.0 | |
| jobs: | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@1.95.0 | |
| with: | |
| components: rustfmt, clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Check formatting | |
| run: cargo fmt --all -- --check | |
| - name: Run clippy | |
| run: cargo clippy --all-targets --all-features -- -D warnings | |
| - name: Build documentation | |
| run: cargo doc --no-deps --all-features | |
| env: | |
| RUSTDOCFLAGS: "-D warnings" | |
| audit: | |
| name: Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@1.95.0 | |
| - name: Security audit (cargo-audit) | |
| uses: rustsec/audit-check@v2.0.0 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| ignore: RUSTSEC-2023-0071 | |
| - name: License check (cargo-deny) | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check licenses sources | |
| - name: Install cargo-vet | |
| uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-vet | |
| - name: Supply chain audit (cargo-vet) | |
| run: cargo vet --locked | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@1.95.0 | |
| - uses: Swatinem/rust-cache@v2 | |
| # Pre-installed on `ubuntu-latest` images, but make the dependency | |
| # explicit so a future runner image change can't silently turn the | |
| # `sqlite_differential_tests` suite into a no-op (it skips when | |
| # `sqlite3` isn't on PATH). | |
| - name: Install host sqlite3 for differential tests | |
| run: | | |
| which sqlite3 || sudo apt-get update && sudo apt-get install -y sqlite3 | |
| sqlite3 --version | |
| # Install the uutils multicall binary for | |
| # `coreutils_differential_tests`. The harness gracefully skips when | |
| # the binary is unavailable, so `continue-on-error` keeps the | |
| # regular Test job green when the upstream install action has a | |
| # bad day — the drift workflow (`coreutils-args-drift.yml`) is the | |
| # authoritative body-drift gate, building uutils from the pinned | |
| # tree before running the harness. | |
| - name: Install uutils coreutils multicall for differential tests | |
| id: install_uutils | |
| continue-on-error: true | |
| uses: taiki-e/install-action@v2 | |
| with: | |
| tool: coreutils | |
| - name: Verify uutils on PATH | |
| if: steps.install_uutils.outcome == 'success' | |
| run: coreutils --version | |
| # `rg` differential tests compare against real ripgrep. Pin the | |
| # binary so upstream formatting/path semantics cannot drift under CI. | |
| - name: Install pinned ripgrep for differential tests | |
| run: scripts/install-ripgrep-ci.sh "$RG_VERSION" | |
| # Examples have a dedicated job below; skipping them here avoids | |
| # duplicated example links that can exhaust runner disk on main. | |
| - name: Run tests | |
| run: cargo test --workspace --lib --bins --tests --features http_client,ssh,sqlite | |
| - name: Run strict bash parity tests | |
| run: cargo test -p bashkit --test integration --features http_client,ssh -- spec_tests::bash_comparison_tests --ignored | |
| - name: Run doc tests | |
| run: cargo test --workspace --doc --features http_client,ssh,sqlite | |
| - name: Run realfs tests | |
| run: cargo test --features realfs -p bashkit --test realfs_tests -p bashkit-cli | |
| - name: Run fail-point tests (single-threaded) | |
| run: cargo test --features failpoints --test security_failpoint_tests -- --test-threads=1 | |
| - name: Run property-based security tests (proptest) | |
| run: cargo test --test proptest_security -- --test-threads=1 | |
| env: | |
| PROPTEST_CASES: 50 | |
| examples: | |
| name: Examples | |
| runs-on: ubuntu-latest | |
| # Fork-PR secret exfiltration guard: secrets are NOT exposed at job | |
| # level here, because PR-controlled code (examples, build.rs, scripts) | |
| # executes in this job. Steps that need real secrets gate on | |
| # `github.event.pull_request.head.repo.fork != true` and only set the | |
| # secret in their own step `env:`. See response in PR discussion; | |
| # mirrors the pattern in `coverage.yml` and `js.yml`. | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@1.95.0 | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Build examples | |
| run: cargo build --examples --features "git,http_client,ssh,sqlite" | |
| - name: Run examples | |
| run: | | |
| cargo run --example basic | |
| cargo run --example custom_fs | |
| cargo run --example clap_builtin | |
| cargo run --example clap_builtin_subcommands | |
| cargo run --example resource_limits | |
| cargo run --example text_processing | |
| cargo run --example live_mounts | |
| cargo run --example git_workflow --features git | |
| cargo run --example python_external_functions --features python | |
| cargo run --example typescript_external_functions --features typescript | |
| cargo run --example realfs_readonly --features realfs | |
| cargo run --example realfs_readwrite --features realfs | |
| cargo run --example sqlite_basic --features sqlite | |
| cargo run --example sqlite_workflow --features sqlite | |
| # SSH tests | |
| - name: Run ssh builtin tests (mock handler) | |
| run: cargo test --features ssh -p bashkit --test ssh_builtin_tests | |
| - name: Run ssh supabase.sh example and tests | |
| run: | | |
| cargo run --example ssh_supabase --features ssh | |
| cargo test --features ssh -p bashkit --test ssh_supabase_tests | |
| - name: Run realfs bash example | |
| run: | | |
| cargo build -p bashkit-cli --features realfs | |
| bash examples/realfs_mount.sh | |
| - name: Run ticket CLI example | |
| env: | |
| TICKET_REF: 194b71a8bbc3771da1ce9f579395937c976bbddc | |
| run: bash examples/ticket-cli.sh | |
| # Detect whether DOPPLER_TOKEN is configured. Only set on non-fork | |
| # PRs/pushes; fork PRs never see the secret. Subsequent Doppler | |
| # steps gate on `env.DOPPLER_AVAILABLE` so this job stays green | |
| # in repos/forks without the secret configured. | |
| - name: Detect Doppler availability (trusted runs only) | |
| if: github.event.pull_request.head.repo.fork != true | |
| env: | |
| DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }} | |
| run: | | |
| if [ -n "$DOPPLER_TOKEN" ]; then | |
| echo "DOPPLER_AVAILABLE=true" >> "$GITHUB_ENV" | |
| fi | |
| - name: Install Doppler CLI | |
| if: github.event.pull_request.head.repo.fork != true && env.DOPPLER_AVAILABLE == 'true' | |
| env: | |
| DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }} | |
| uses: dopplerhq/cli-action@v4 | |
| # External API dependency — don't block CI on Anthropic outages. | |
| # ANTHROPIC_API_KEY is sourced from Doppler (single source of truth | |
| # for non-GitHub secrets), so this step also requires Doppler to be | |
| # available, which already implies a non-fork event. | |
| # `--only-secrets` keeps the principle of least privilege: the | |
| # PR-controlled cargo step sees ANTHROPIC_API_KEY only, not every | |
| # secret in the Doppler config. | |
| - name: Run LLM agent example | |
| if: github.event.pull_request.head.repo.fork != true && env.DOPPLER_AVAILABLE == 'true' | |
| continue-on-error: true | |
| env: | |
| DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }} | |
| run: doppler run --only-secrets ANTHROPIC_API_KEY -- cargo run --example agent_tool --features http_client | |
| - name: Run harness OpenAI joke example | |
| if: github.event.pull_request.head.repo.fork != true && env.DOPPLER_AVAILABLE == 'true' | |
| env: | |
| DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }} | |
| run: | | |
| cargo build -p bashkit-cli --features realfs --quiet | |
| doppler run --only-secrets OPENAI_API_KEY -- bash examples/harness-openai-joke.sh | |
| fuzz-check: | |
| name: Fuzz Compile Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install Rust nightly | |
| uses: dtolnay/rust-toolchain@nightly | |
| - name: Install cargo-fuzz | |
| uses: taiki-e/cache-cargo-install-action@v3 | |
| with: | |
| tool: cargo-fuzz | |
| locked: true | |
| - name: Verify fuzz targets compile | |
| working-directory: crates/bashkit | |
| run: cargo +nightly fuzz build | |
| # Gate job for branch protection — name must stay "Check" | |
| check: | |
| name: Check | |
| if: always() | |
| needs: [lint, audit, test, examples, fuzz-check] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Verify all jobs passed | |
| run: | | |
| if [[ "${{ needs.lint.result }}" != "success" ]] || \ | |
| [[ "${{ needs.audit.result }}" != "success" ]] || \ | |
| [[ "${{ needs.test.result }}" != "success" ]] || \ | |
| [[ "${{ needs.examples.result }}" != "success" ]] || \ | |
| [[ "${{ needs.fuzz-check.result }}" != "success" ]]; then | |
| echo "One or more required jobs failed" | |
| exit 1 | |
| fi |