chore(ci): scaffold Rust + static-analysis gates before implementation - #5
Merged
Conversation
Establish CI and static-test gates now, so the first implementation PR passes through a complete set of checks rather than retrofitting them later. - Rust quality gate (rust.yml): cargo fmt / clippy -D warnings / test / build over a minimal verity-types canary crate; toolchain pinned to 1.94.0, Swatinem/rust-cache for speed. - Supply-chain: cargo-deny (deny.toml) + Dependabot (github-actions + cargo). - Docs quality: markdownlint + offline lychee link check added to docs.yml. - Quality workflow: repo-wide typos spell-check + weekly online link check. - Secret scanning: betterleaks pinned image (secret-scan.yml). - .gitignore for Rust/Lean build artifacts. Lean proof CI is intentionally out of scope: the Verified Core (Verity Consensus) lives in a separate repository. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- secret-scan: inject `safe.directory=/repo` via GIT_CONFIG_* env so betterleaks' in-container git accepts the bind-mounted, differently-owned working tree (was failing with "detected dubious ownership"). - lychee.toml: drop unsupported `exclude_mail` (mail is excluded by default in lychee 0.23) — it broke config parsing and failed the docs link check. - secret-scan + quality: restrict the `push` trigger to main so feature-branch pushes don't double-run alongside the pull_request trigger. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drop Dependabot version updates entirely (github-actions + cargo ecosystems). Dependency and action update PRs will no longer be auto-opened.
- edition 2021 -> 2024, resolver 2 -> 3 (kickoff toolchain decision) - pin toolchain to current latest stable 1.97.1 (was 1.94.0, latest at PR creation time) - rename the canary crate verity-types -> verity-consensus: kickoff settled on a single starting crate with shared types as a module; the ARCHITECTURE.md workspace layout is what it later splits into
- typos: exclude vendored mdbook-mermaid assets (minified JS false positives) - markdownlint: don't treat frontmatter title as the page H1 (it is stripped by the preprocessor before rendering) and allow bold lead-in labels (MD036)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Verity is pre-implementation — the only working component is the mdBook docs site, gated by
docs.yml. This PR establishes CI and static-test gates now, so the first implementation PR passes through a complete set of checks instead of retrofitting them later.What this adds
Rust quality gate —
.github/workflows/rust.ymlcargo fmt --check,cargo clippy -D warnings,cargo test,cargo build, path-filtered to Rust paths, withSwatinem/rust-cache.verity-typescanary crate (one trivial fn + test) so the gate has real code from day one — the first real PR replaces it.rust-toolchain.toml(matches the project's "pin the exact version" philosophy, cf. mdBook 0.4.40). Workspace lints:unsafe_code = "deny",clippy::all = warn.Supply-chain audit
cargo-deny(deny.toml: advisories, license allowlist, bans) as a job inrust.yml..github/dependabot.ymlforgithub-actions+cargo(weekly, grouped).Docs quality — added to existing
docs.ymlas alintjobmarkdownlint(.markdownlint.jsonc) ondocs/src(SUMMARY.md excluded — its multiple H1s are mdBook TOC convention).lychee --offlineinternal/relative link check (deterministic on PRs).Quality workflow —
.github/workflows/quality.ymltyposrepo-wide spell-check on every push/PR (_typos.toml).lycheelink check (cron) — kept off PRs to avoid flaky external rate-limits.Secret scanning —
.github/workflows/secret-scan.ymlghcr.io/betterleaks/betterleaks:v1.3.1image;--exit-code 1fails CI on findings..gitignorefor Rust/Lean build artifacts (/target,.lake/,*.olean).Out of scope
.editorconfig/ docs.yml hardening) — not requested.