feat(vc): refuse an expired continuity snapshot #953
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ["**"] | |
| pull_request: | |
| branches: [main, develop] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| jobs: | |
| fmt: | |
| name: Format check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable | |
| with: | |
| components: rustfmt | |
| - name: cargo fmt --check | |
| run: cargo fmt --all --check | |
| clippy: | |
| name: Clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 | |
| - name: cargo clippy | |
| run: cargo clippy --workspace --all-targets --all-features -- -D warnings | |
| test: | |
| name: Tests (unit + integration) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 | |
| - name: Install cargo-nextest | |
| uses: taiki-e/install-action@cbc0d781df01b1867f3d6401299786f6193ad0b1 # nextest | |
| # --all-features is load-bearing: no crate in this workspace enables | |
| # dpp-rules' `bundle` feature, so without it the signed-ruleset format and | |
| # its fail-closed verification are never built or tested in CI. | |
| - name: Unit tests | |
| run: cargo nextest run --workspace --all-features --lib | |
| - name: Integration tests | |
| run: cargo nextest run --workspace --all-features --test '*' | |
| - name: Assert integration count > 0 | |
| run: | | |
| COUNT=$(cargo test -p dpp-tests --all-features --tests -- --list 2>&1 | grep -c ': test' || echo 0) | |
| printf '[A-02] dpp-tests integration tests found: %s\n' "$COUNT" | |
| [ "$COUNT" -gt 0 ] || { echo 'ERROR: zero integration tests — dpp-tests may be orphaned from workspace'; exit 1; } | |
| doc: | |
| name: Docs (rustdoc + doctests) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 | |
| # `just check` has always run both of these and CI never did, which left a | |
| # locally-run command as the only thing between a broken intra-doc link and | |
| # a published crate. That is not hypothetical: two such links reached a | |
| # branch that passed every other job here, and were caught only because | |
| # someone ran the local gate — and one of them nearly slipped past that | |
| # too, because piping `just check` through `tail` reports `tail`'s exit | |
| # code rather than the recipe's. | |
| # | |
| # `-D warnings` is what turns this into a gate. A broken intra-doc link is | |
| # a warning by default, and a warning nobody reads is not a check. | |
| - name: cargo doc | |
| run: RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --all-features | |
| # Separate from the test job on purpose: `cargo nextest` does not run | |
| # doctests at all, which is how README examples in this workspace went a | |
| # long time without being compiled, several advertising functions that did | |
| # not exist. Each publishable crate pulls its README in via a | |
| # `ReadmeDoctests` item, so this compiles those too. | |
| - name: cargo test --doc | |
| run: cargo test --doc --workspace --all-features | |
| audit: | |
| name: Security audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| - name: cargo audit | |
| run: cargo audit | |
| plugins: | |
| name: Sector plugin tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 | |
| - uses: taiki-e/install-action@3d23c1bbdafe696dfccad2664945a04f47d03dc3 # just | |
| # Plugins are excluded from the workspace, so `cargo nextest run | |
| # --workspace` above never reaches them. This mirrors `just | |
| # test-plugins` so a plugin regression fails CI, not only a local | |
| # `just check`. | |
| - name: Sector plugin tests | |
| run: just test-plugins |