feat: release 0.8.3 #358
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Merge Check - Ramparts | |
| on: | |
| pull_request: | |
| types: | |
| - opened | |
| - synchronize | |
| - reopened | |
| branches: | |
| - "main" | |
| merge_group: | |
| types: | |
| - checks_requested | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| GH_SEC_REPORT: false | |
| TRIVY_SEVERITY: "HIGH,CRITICAL" | |
| TRIVY_REPORT_FILE: "trivy-scan-result" | |
| jobs: | |
| highflame-lint-check: | |
| permissions: | |
| contents: 'read' | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt, clippy | |
| - name: Install YARA (Ubuntu) | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y yara libyara-dev | |
| - name: Install YARA (macOS) | |
| if: runner.os == 'macOS' | |
| run: | | |
| brew install yara | |
| # Set environment variables for yara-sys | |
| echo "YARA_LIBRARY_PATH=/opt/homebrew/lib" >> $GITHUB_ENV | |
| echo "BINDGEN_EXTRA_CLANG_ARGS=-I/opt/homebrew/include" >> $GITHUB_ENV | |
| # Also set for Intel Macs | |
| if [ -d "/usr/local/lib" ]; then | |
| echo "YARA_LIBRARY_PATH=/usr/local/lib" >> $GITHUB_ENV | |
| echo "BINDGEN_EXTRA_CLANG_ARGS=-I/usr/local/include" >> $GITHUB_ENV | |
| fi | |
| shell: bash | |
| - name: Install YARA (Windows) | |
| if: runner.os == 'Windows' | |
| run: | | |
| # Windows doesn't have a standard YARA package manager | |
| # We'll build without YARA features for Windows | |
| echo "YARA not available on Windows, will build without YARA features" | |
| - name: Cache dependencies | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo- | |
| - name: Check code without building | |
| run: | | |
| if [[ "${{ runner.os }}" == "Windows" ]]; then | |
| cargo check --no-default-features | |
| else | |
| cargo check --all-features | |
| fi | |
| shell: bash | |
| - name: Check formatting | |
| run: cargo fmt --all -- --check | |
| # Strict lint pass — same gate as highflame-firehog. `-D warnings` | |
| # makes everything fatal; `-D unused` is the lint group that | |
| # covers dead_code, unused_imports, unused_variables, unused_mut, | |
| # unused_must_use, unused_assignments, and friends. `-D warnings` | |
| # alone would catch these (they're warn-by-default) but `-D unused` | |
| # is explicit about intent: a forgotten helper / leftover stub / | |
| # unneeded `mut` should fail CI rather than accumulate on main. | |
| # `--all-targets` covers tests + benches (without it, test code is | |
| # silently unlinted); `--all-features` lints feature-gated code | |
| # too. The Windows branch drops `--all-features` because the | |
| # yara-x feature requires platform-specific YARA bindings. | |
| - name: Run Clippy linter (strict) | |
| run: | | |
| if [[ "${{ runner.os }}" == "Windows" ]]; then | |
| cargo clippy --no-default-features --all-targets -- -D warnings -D unused | |
| else | |
| cargo clippy --all-features --all-targets -- -D warnings -D unused | |
| fi | |
| shell: bash | |
| highflame-sast-check: | |
| permissions: | |
| contents: 'read' | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install YARA (Ubuntu) | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y yara libyara-dev | |
| - name: Install YARA (macOS) | |
| if: runner.os == 'macOS' | |
| run: | | |
| brew install yara | |
| # Set environment variables for yara-sys | |
| echo "YARA_LIBRARY_PATH=/opt/homebrew/lib" >> $GITHUB_ENV | |
| echo "BINDGEN_EXTRA_CLANG_ARGS=-I/opt/homebrew/include" >> $GITHUB_ENV | |
| # Also set for Intel Macs | |
| if [ -d "/usr/local/lib" ]; then | |
| echo "YARA_LIBRARY_PATH=/usr/local/lib" >> $GITHUB_ENV | |
| echo "BINDGEN_EXTRA_CLANG_ARGS=-I/usr/local/include" >> $GITHUB_ENV | |
| fi | |
| shell: bash | |
| - name: Install YARA (Windows) | |
| if: runner.os == 'Windows' | |
| run: | | |
| # Windows doesn't have a standard YARA package manager | |
| # We'll build without YARA features for Windows | |
| echo "YARA not available on Windows, will build without YARA features" | |
| - name: Cache dependencies | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo- | |
| - name: Run tests | |
| run: | | |
| if [[ "${{ runner.os }}" == "Windows" ]]; then | |
| cargo test --no-default-features | |
| else | |
| cargo test --all-features | |
| fi | |
| shell: bash | |
| - name: Run tests with coverage | |
| run: | | |
| cargo install cargo-tarpaulin | |
| if [[ "${{ runner.os }}" == "Windows" ]]; then | |
| cargo tarpaulin --no-default-features --out Html --output-dir coverage | |
| else | |
| cargo tarpaulin --all-features --out Html --output-dir coverage | |
| fi | |
| shell: bash | |
| continue-on-error: true | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v6 | |
| with: | |
| files: ./coverage/tarpaulin-report.html | |
| flags: unittests | |
| name: codecov-umbrella | |
| fail_ci_if_error: false | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| highflame-security-check: | |
| permissions: | |
| contents: 'read' | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install YARA (Ubuntu) | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y yara libyara-dev | |
| - name: Install YARA (macOS) | |
| if: runner.os == 'macOS' | |
| run: | | |
| brew install yara | |
| # Set environment variables for yara-sys | |
| echo "YARA_LIBRARY_PATH=/opt/homebrew/lib" >> $GITHUB_ENV | |
| echo "BINDGEN_EXTRA_CLANG_ARGS=-I/opt/homebrew/include" >> $GITHUB_ENV | |
| # Also set for Intel Macs | |
| if [ -d "/usr/local/lib" ]; then | |
| echo "YARA_LIBRARY_PATH=/usr/local/lib" >> $GITHUB_ENV | |
| echo "BINDGEN_EXTRA_CLANG_ARGS=-I/usr/local/include" >> $GITHUB_ENV | |
| fi | |
| shell: bash | |
| - name: Install YARA (Windows) | |
| if: runner.os == 'Windows' | |
| run: | | |
| # Windows doesn't have a standard YARA package manager | |
| # We'll build without YARA features for Windows | |
| echo "YARA not available on Windows, will build without YARA features" | |
| - name: Cache dependencies | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo- | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit | |
| - name: Run cargo audit | |
| run: cargo audit --deny warnings | |
| highflame-build-check: | |
| permissions: | |
| contents: 'read' | |
| strategy: | |
| matrix: | |
| os: [ ubuntu-24.04, windows-2022, macOS-15 ] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install YARA (Ubuntu) | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y yara libyara-dev | |
| - name: Install YARA (macOS) | |
| if: runner.os == 'macOS' | |
| run: | | |
| brew install yara | |
| # Set environment variables for yara-sys | |
| echo "YARA_LIBRARY_PATH=/opt/homebrew/lib" >> $GITHUB_ENV | |
| echo "BINDGEN_EXTRA_CLANG_ARGS=-I/opt/homebrew/include" >> $GITHUB_ENV | |
| # Also set for Intel Macs | |
| if [ -d "/usr/local/lib" ]; then | |
| echo "YARA_LIBRARY_PATH=/usr/local/lib" >> $GITHUB_ENV | |
| echo "BINDGEN_EXTRA_CLANG_ARGS=-I/usr/local/include" >> $GITHUB_ENV | |
| fi | |
| shell: bash | |
| - name: Install YARA (Windows) | |
| if: runner.os == 'Windows' | |
| run: | | |
| # Windows doesn't have a standard YARA package manager | |
| # We'll build without YARA features for Windows | |
| echo "YARA not available on Windows, will build without YARA features" | |
| - name: Cache dependencies | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo- | |
| - name: Build release | |
| run: | | |
| if [[ "${{ runner.os }}" == "Windows" ]]; then | |
| cargo build --release --no-default-features | |
| else | |
| cargo build --release | |
| fi | |
| shell: bash | |
| - name: Build debug | |
| run: | | |
| if [[ "${{ runner.os }}" == "Windows" ]]; then | |
| cargo build --no-default-features | |
| else | |
| cargo build | |
| fi | |
| shell: bash | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: ramparts-${{ runner.os }} | |
| path: target/release/ramparts* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| highflame-trivy-scan: | |
| permissions: | |
| contents: 'read' | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: true | |
| - name: Manual Trivy Setup | |
| uses: aquasecurity/setup-trivy@v0.2.6 | |
| with: | |
| cache: true | |
| version: ${{ env.TRIVY_VER }} | |
| - name: Trivy Scan - Text Security Report | |
| id: trivy_scan_txt | |
| if: ${{ env.GH_SEC_REPORT == 'false' }} | |
| uses: aquasecurity/trivy-action@v0.35.0 | |
| continue-on-error: true | |
| with: | |
| ignore-unfixed: true | |
| skip-setup-trivy: true | |
| scan-type: "fs" | |
| cache: "false" | |
| format: "table" | |
| output: "${{ env.TRIVY_REPORT_FILE }}.txt" | |
| severity: "${{ env.TRIVY_SEVERITY }}" | |
| exit-code: 1 | |
| - name: Upload Report - Text Security Report | |
| if: ${{ env.GH_SEC_REPORT == 'false' && steps.trivy_scan_txt.outcome == 'failure' }} | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: "${{ env.TRIVY_REPORT_FILE }}" | |
| path: "${{ env.TRIVY_REPORT_FILE }}.txt" | |
| if-no-files-found: error | |
| retention-days: 1 | |
| - name: Trivy Scan - GitHub Security Report | |
| id: trivy_scan_sec | |
| if: ${{ env.GH_SEC_REPORT == 'true' }} | |
| uses: aquasecurity/trivy-action@v0.35.0 | |
| with: | |
| ignore-unfixed: true | |
| skip-setup-trivy: true | |
| scan-type: "fs" | |
| cache: "false" | |
| format: "sarif" | |
| output: "${{ env.TRIVY_REPORT_FILE }}.sarif" | |
| severity: "${{ env.TRIVY_SEVERITY }}" | |
| timeout: "${{ env.TRIVY_TIMEOUT }}" | |
| exit-code: 1 | |
| - name: Upload Report - GitHub Security Report | |
| if: ${{ env.GH_SEC_REPORT == 'true' && steps.trivy_scan_sec.outcome == 'failure' }} | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: "${{ env.TRIVY_REPORT_FILE }}.sarif" | |
| - name: Failing the Job | |
| if: ${{ steps.trivy_scan_txt.outcome == 'failure' || steps.trivy_scan_sec.outcome == 'failure' }} | |
| shell: bash | |
| run: |- | |
| echo "Vulnerabilities Found.....!" | |
| exit 1 |