[P0] green lock evidence regen (CLI audit P0-3) #187
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse | |
| CARGO_INCREMENTAL: 0 | |
| # Clippy job uses -D warnings. Do not also deny rustc edition-migration | |
| # warnings here — those are allowed in [workspace.lints.rust] where needed. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| quality: | |
| name: Source and dependency policy | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| env: | |
| QUALITY_BASE: ${{ github.event.pull_request.base.sha || github.event.before }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - uses: dtolnay/rust-toolchain@1.98.0 | |
| with: | |
| components: rustfmt, clippy | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-machete@0.9.1 | |
| - run: python -m pip install -r scripts/readiness/requirements.txt | |
| - run: python -B -m unittest discover -s scripts/readiness -p 'test_*.py' | |
| - run: python scripts/readiness/quality.py --base "$QUALITY_BASE" | |
| - run: cargo machete --with-metadata | |
| - run: python scripts/readiness/release_age.py --base "$QUALITY_BASE" | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: source-quality | |
| path: target/readiness/quality.json | |
| retention-days: 14 | |
| version-check: | |
| name: CLI Version and Distribution (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, macos-15-intel, windows-latest] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - run: python -m pip install -r scripts/readiness/requirements.txt | |
| - name: Verify CLI version consistency | |
| shell: bash | |
| run: ./scripts/check-cli-version.sh | |
| - name: Verify installer fixtures and package contracts | |
| run: python -B -m unittest discover -s scripts/readiness -p test_distribution.py -v | |
| - name: Verify Windows installer arch detection | |
| shell: pwsh | |
| run: ./scripts/test-install-ps1.ps1 | |
| fmt: | |
| name: Format | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@1.98.0 | |
| with: | |
| components: rustfmt | |
| - name: Check formatting | |
| run: cargo fmt --all -- --check | |
| clippy: | |
| name: Clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libasound2-dev libssl-dev pkg-config | |
| - uses: dtolnay/rust-toolchain@1.98.0 | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| prefix-key: rust-clippy | |
| - name: Run clippy | |
| run: ./scripts/clippy.sh | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libasound2-dev libssl-dev pkg-config git ripgrep | |
| - uses: dtolnay/rust-toolchain@1.98.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| prefix-key: rust-test | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-nextest@0.9.102 | |
| - name: Run tests | |
| run: python3 scripts/readiness/tests.py | |
| - name: Run documentation tests | |
| run: cargo test --locked --workspace --doc | |
| - name: Verify generated API contracts | |
| run: python3 scripts/readiness/schema.py | |
| - name: Build local QA applications | |
| run: cargo build --locked -p cortex-cli -p cortex-app-server | |
| - name: Local functional QA and dynamic security tests | |
| run: python3 scripts/readiness/qa.py | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: test-performance | |
| path: target/readiness/tests/ | |
| retention-days: 30 | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: local-qa | |
| # Diagnostic journals and aggregates remain local to the runner. | |
| path: target/readiness/qa/report.json | |
| retention-days: 14 | |
| coverage: | |
| name: Changed-line coverage | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| env: | |
| QUALITY_BASE: ${{ github.event.pull_request.base.sha || github.event.before }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - run: sudo apt-get update && sudo apt-get install -y libasound2-dev libssl-dev pkg-config git ripgrep | |
| - uses: dtolnay/rust-toolchain@1.98.0 | |
| with: | |
| components: llvm-tools-preview | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| prefix-key: rust-coverage | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-llvm-cov@0.6.21,cargo-nextest@0.9.102 | |
| - name: Collect application coverage | |
| run: | | |
| mkdir -p target/readiness | |
| cargo llvm-cov nextest --locked -p cortex-cli -p cortex-app-server -p cortex-common --profile ci --lcov --output-path target/readiness/lcov.info | |
| - run: python3 scripts/readiness/coverage.py --base "$QUALITY_BASE" | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: coverage | |
| path: | | |
| target/readiness/lcov.info | |
| target/readiness/coverage.json | |
| retention-days: 14 | |
| tui: | |
| name: TUI checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libasound2-dev libssl-dev pkg-config | |
| - uses: dtolnay/rust-toolchain@1.98.0 | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| prefix-key: rust-tui | |
| - name: Headless TUI / snapshot tests | |
| run: | | |
| cargo test -p cortex-tui -p cortex-tui-capture -p cortex-tui-components \ | |
| -p cortex-tui-framework -p cortex-tui-core -p cortex-tui-buffer \ | |
| -p cortex-tui-widgets -p cortex-tui-layout -p cortex-tui-text \ | |
| -p cortex-tui-input -p cortex-tui-terminal -p cortex-tui-syntax | |
| audit: | |
| name: Security Audit | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| env: | |
| RUSTFLAGS: "" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@1.98.0 | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-audit@0.22.2 | |
| - name: Audit Rust dependencies | |
| run: cargo audit | |
| ci-success: | |
| name: CI Success | |
| runs-on: ubuntu-latest | |
| needs: [version-check, fmt, clippy, test, tui, audit, quality, coverage] | |
| if: always() | |
| steps: | |
| - name: Check all jobs | |
| run: | | |
| if [[ "${{ needs.version-check.result }}" != "success" || \ | |
| "${{ needs.fmt.result }}" != "success" || \ | |
| "${{ needs.clippy.result }}" != "success" || \ | |
| "${{ needs.test.result }}" != "success" || \ | |
| "${{ needs.tui.result }}" != "success" || \ | |
| "${{ needs.audit.result }}" != "success" || \ | |
| "${{ needs.quality.result }}" != "success" || \ | |
| "${{ needs.coverage.result }}" != "success" ]]; then | |
| echo "One or more required CI jobs failed" | |
| exit 1 | |
| fi | |
| echo "All CI checks passed" |