docs(science): add mathematical basis and clarify numerical guarantees #246
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Advanced Clippy analysis with SARIF output for security integration | |
| # Note: Basic clippy checks are also run in the main CI workflow | |
| name: "Clippy Security Analysis" | |
| concurrency: | |
| group: >- | |
| clippy-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| on: | |
| pull_request: | |
| branches: ["main"] | |
| schedule: | |
| - cron: "17 22 * * 0" # Weekly on Sunday | |
| workflow_dispatch: | |
| # Run on main branch pushes for security scanning | |
| push: | |
| branches: ["main"] | |
| # Security: Define minimal required permissions | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| jobs: | |
| clippy-sarif: | |
| name: Clippy SARIF Analysis | |
| runs-on: ubuntu-latest | |
| env: | |
| CLIPPY_SARIF_VERSION: "0.8.0" | |
| SARIF_FMT_VERSION: "0.8.0" | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust toolchain | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| cache: true # toolchain/components are specified in rust-toolchain.toml | |
| cache-bin: false | |
| - name: Install clippy-sarif | |
| uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7 | |
| with: | |
| tool: clippy-sarif@${{ env.CLIPPY_SARIF_VERSION }} | |
| - name: Install sarif-fmt | |
| uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7 | |
| with: | |
| tool: sarif-fmt@${{ env.SARIF_FMT_VERSION }} | |
| - name: Run clippy with SARIF output | |
| run: | | |
| set -euo pipefail | |
| # Lint levels are owned by Cargo.toml. | |
| cargo clippy \ | |
| --workspace \ | |
| --all-targets \ | |
| --all-features \ | |
| --message-format=json | \ | |
| clippy-sarif | \ | |
| tee rust-clippy-results.sarif | \ | |
| sarif-fmt | |
| - name: Upload SARIF results | |
| if: >- | |
| always() | |
| && hashFiles('rust-clippy-results.sarif') != '' | |
| && ( | |
| github.event_name != 'pull_request' | |
| || github.event.pull_request.head.repo.full_name == github.repository | |
| ) | |
| uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 | |
| with: | |
| sarif_file: rust-clippy-results.sarif | |
| category: "clippy" | |
| wait-for-processing: true |