chore(deps): remove expired quarantine excludes #863
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| env: | |
| HAWK_RUST_TOOLCHAIN: "1.97.1" | |
| HAWK_VERSION: "0.1.12" | |
| HAWK_X86_64_UNKNOWN_LINUX_GNU_SHA256: "f9cafbbc5777b2b00c362619b8b62af942d2900a121acae2e73210a8ebffd857" | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| types: | |
| [ | |
| opened, | |
| synchronize, | |
| reopened, | |
| ready_for_review, | |
| labeled, | |
| ] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check-changes: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| rust-changed: ${{ steps.filter.outputs.rust }} | |
| build-changed: ${{ steps.filter.outputs.build }} | |
| provenance-changed: ${{ steps.filter.outputs.provenance }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4 | |
| id: filter | |
| with: | |
| filters: | | |
| rust: | |
| - 'package.json' | |
| - '.github/workflows/**' | |
| - 'VERSION' | |
| - 'src/**' | |
| - 'crates/**' | |
| - 'build.rs' | |
| - 'Cargo.toml' | |
| - 'Cargo.lock' | |
| - 'clippy.toml' | |
| - 'deny.toml' | |
| - 'hawk.toml' | |
| - 'rust-toolchain.toml' | |
| - 'rustfmt.toml' | |
| - '.github/workflows/ci.yml' | |
| build: | |
| - '.github/workflows/**' | |
| - 'VERSION' | |
| - 'src/**' | |
| - 'crates/**' | |
| - 'build.rs' | |
| - 'Cargo.toml' | |
| - 'Cargo.lock' | |
| - 'package.json' | |
| - 'bun.lock' | |
| - 'index.cjs' | |
| - 'tsdown.config.ts' | |
| - 'scripts/**' | |
| - 'wasm/**' | |
| - 'npm/**' | |
| - '.github/workflows/ci.yml' | |
| provenance: | |
| - '.github/workflows/**' | |
| - 'VERSION' | |
| - 'bun.lock' | |
| - 'Cargo.lock' | |
| - '**/package.json' | |
| - 'Cargo.toml' | |
| - 'src/**' | |
| - 'crates/**' | |
| - 'wasm/**' | |
| - '*.js' | |
| - '*.cjs' | |
| - '*.mjs' | |
| - '.provenance.yml' | |
| - 'provenance/**' | |
| - '.github/workflows/ci.yml' | |
| - name: Enforce Bun workflow installs | |
| run: node scripts/check-workflow-package-manager.mjs | |
| trust-check: | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| trusted: ${{ steps.check.outputs.trusted }} | |
| steps: | |
| - name: Check if PR is trusted | |
| id: check | |
| env: | |
| HEAD_REPO: >- | |
| ${{ github.event.pull_request.head.repo.full_name }} | |
| BASE_REPO: ${{ github.repository }} | |
| run: | | |
| if [[ "$HEAD_REPO" == "$BASE_REPO" ]]; then | |
| echo "trusted=true" >> "$GITHUB_OUTPUT" | |
| elif [[ '${{ contains(github.event.pull_request.labels.*.name, 'run-ci') }}' == 'true' ]]; then | |
| echo "trusted=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "trusted=false" >> "$GITHUB_OUTPUT" | |
| echo "::notice::Fork PR without 'run-ci' label — CI skipped." | |
| fi | |
| changeset: | |
| name: Changeset | |
| if: >- | |
| github.event_name == 'pull_request' | |
| && needs.trust-check.outputs.trusted == 'true' | |
| needs: [trust-check] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: stella/.github/.github/actions/changeset-policy@5628b97fb3c560c0d961baa60c272c598eddcab5 # v1.7.0 | |
| with: | |
| release-paths: | | |
| src/** | |
| crates/core/src/** | |
| Cargo.toml | |
| crates/core/Cargo.toml | |
| package.json | |
| wasm/package.json | |
| index.cjs | |
| tsdown.config.ts | |
| generated-paths: | | |
| CHANGELOG.md | |
| VERSION | |
| Cargo.toml | |
| crates/core/Cargo.toml | |
| Cargo.lock | |
| bun.lock | |
| package.json | |
| wasm/package.json | |
| npm/*/package.json | |
| index.cjs | |
| provenance/THIRD-PARTY-NOTICES.txt | |
| provenance/report.json | |
| provenance/sbom.cdx.json | |
| package-files: package.json | |
| napi-ci: | |
| if: ${{ always() && !cancelled() && needs.check-changes.result == 'success' && (needs.trust-check.result == 'success' || needs.trust-check.result == 'skipped') }} | |
| needs: [check-changes, trust-check] | |
| uses: stella/.github/.github/workflows/rust-napi-ci.yml@48aacae31829ce15216a6b766b03a92fd2e84da3 | |
| with: | |
| node-version: "22" | |
| trusted: ${{ (github.event_name != 'pull_request' || needs.trust-check.outputs.trusted == 'true') && 'true' || 'false' }} | |
| rust-changed: ${{ needs.check-changes.outputs.rust-changed }} | |
| build-changed: ${{ needs.check-changes.outputs.build-changed }} | |
| provenance-changed: ${{ needs.check-changes.outputs.provenance-changed }} | |
| provenance-version: v0.1.3 | |
| property-test-command: bun run test:props | |
| install-command: bun install --frozen-lockfile | |
| secrets: inherit | |
| hawk: | |
| name: Hawk | |
| if: >- | |
| always() | |
| && !cancelled() | |
| && needs.check-changes.result == 'success' | |
| && needs.check-changes.outputs.rust-changed == 'true' | |
| && (github.event_name != 'pull_request' | |
| || needs.trust-check.outputs.trusted == 'true') | |
| needs: [check-changes, trust-check] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version-file: package.json | |
| - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 | |
| with: | |
| toolchain: ${{ env.HAWK_RUST_TOOLCHAIN }} | |
| - name: Install pinned Hawk | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| expected_hawk_script="cargo +${HAWK_RUST_TOOLCHAIN} hawk check --target-dir target/hawk -D warnings -A hawk::dead_public -A hawk::unnecessary_public" | |
| jq -e --arg expected "$expected_hawk_script" \ | |
| '.scripts["rust:hawk"] == $expected' package.json >/dev/null | |
| archive="${RUNNER_TEMP}/cargo-hawk.tar.gz" | |
| install_dir="${RUNNER_TEMP}/cargo-hawk" | |
| curl --proto '=https' --tlsv1.2 --retry 3 -fsSL \ | |
| -o "$archive" \ | |
| "https://github.com/astral-sh/hawk/releases/download/${HAWK_VERSION}/cargo-hawk-x86_64-unknown-linux-gnu.tar.gz" | |
| echo "${HAWK_X86_64_UNKNOWN_LINUX_GNU_SHA256} ${archive}" | sha256sum --check | |
| mkdir -p "$install_dir" | |
| tar -xzf "$archive" -C "$install_dir" --strip-components=1 | |
| echo "$install_dir" >> "$GITHUB_PATH" | |
| - name: Check internal Rust visibility | |
| run: bun run rust:hawk | |
| contract-perf: | |
| name: Contract fixture perf | |
| if: >- | |
| always() | |
| && !cancelled() | |
| && (github.event_name != 'pull_request' | |
| || needs.trust-check.outputs.trusted == 'true') | |
| needs: [check-changes, trust-check] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| if: needs.check-changes.outputs.build-changed == 'true' | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| if: needs.check-changes.outputs.build-changed == 'true' | |
| with: | |
| bun-version-file: package.json | |
| - name: Skip when perf checks are not required | |
| if: needs.check-changes.outputs.build-changed != 'true' | |
| run: echo "No trusted build changes; contract perf skipped." | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| if: needs.check-changes.outputs.build-changed == 'true' | |
| with: | |
| repository: stella/anonymize | |
| path: .perf/anonymize | |
| sparse-checkout: | | |
| crates/anonymize-core/tests/fixtures/assemble | |
| packages/anonymize/src/__test__/fixtures/contracts | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| if: needs.check-changes.outputs.build-changed == 'true' | |
| with: | |
| node-version: "22" | |
| - run: bun install --frozen-lockfile | |
| if: needs.check-changes.outputs.build-changed == 'true' | |
| - run: bun run build | |
| if: needs.check-changes.outputs.build-changed == 'true' | |
| - name: Run contract fixture perf guard | |
| if: needs.check-changes.outputs.build-changed == 'true' | |
| env: | |
| ANONYMIZE_REPOSITORY_DIR: ${{ github.workspace }}/.perf/anonymize | |
| run: timeout 180s bun run perf:contracts |