refactor: simplified raise layer #17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| pull_request: | |
| # Least privilege by default; the release/publish jobs elevate as needed. | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt, clippy | |
| - name: Format | |
| run: cargo fmt --all --check | |
| - name: Clippy | |
| run: cargo clippy --all-targets --all-features -- -D warnings | |
| - name: Build (all features) | |
| run: cargo build --all-features | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| # Some tests depend on local-only fixtures that are absent in CI; they skip | |
| # gracefully so the suite still runs green on a clean checkout. | |
| - name: Test | |
| run: cargo test --all-features | |
| msrv: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Verify the crate still builds on its declared minimum supported Rust version. | |
| - uses: dtolnay/rust-toolchain@1.85.0 | |
| - name: Build (MSRV) | |
| run: cargo build --all-features | |
| feature-matrix: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: Build without default features | |
| run: cargo build -p rpt --no-default-features | |
| - name: Build with serde | |
| run: cargo build -p rpt --no-default-features --features serde | |
| baseline: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: Install bubblewrap | |
| run: sudo apt-get update && sudo apt-get install -y bubblewrap | |
| # Ubuntu 24.04 (ubuntu-latest) ships an AppArmor profile that blocks unprivileged user | |
| # namespaces, which Bubblewrap needs to set up its uid map ("setting up uid map: | |
| # Permission denied"). Re-enable them so bwrap can run without privileges. | |
| - name: Allow unprivileged user namespaces | |
| run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 | |
| # Build the exporter, dump each fixture's XML in a Bubblewrap sandbox (fixed filesystem | |
| # path), and require an exact match against the committed baselines. RPT_REQUIRE_SANDBOX | |
| # makes the test fail rather than skip if the sandbox is unavailable. | |
| - name: XML baseline regression | |
| env: | |
| RPT_REQUIRE_SANDBOX: "1" | |
| run: cargo test -p rpt-to-xml --test baseline | |
| # Create the GitHub Release once, before the matrix upload jobs. The upload | |
| # action only uploads assets to an existing release; if the per-target jobs | |
| # each tried to create it they would race and fail with "release not found". | |
| # Idempotent so re-running a tag (or re-running failed jobs) is safe. | |
| create-release: | |
| needs: [check, test, msrv, feature-matrix, baseline] | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Create release if it does not exist | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| if ! gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then | |
| gh release create "$GITHUB_REF_NAME" \ | |
| --repo "$GITHUB_REPOSITORY" \ | |
| --title "$GITHUB_REF_NAME" \ | |
| --generate-notes \ | |
| --verify-tag | |
| fi | |
| # Release stage: only on a version tag (vX.Y.Z) and only after every CI job | |
| # above has passed, so a failing commit can never be published. Builds the | |
| # cross-platform binaries and uploads them to the release created above. | |
| release: | |
| name: release (${{ matrix.target }}) | |
| needs: [create-release] | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| runs-on: ${{ matrix.os }} | |
| permissions: | |
| contents: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: x86_64-unknown-linux-musl | |
| os: ubuntu-latest | |
| - target: aarch64-unknown-linux-musl | |
| os: ubuntu-latest | |
| - target: x86_64-apple-darwin | |
| os: macos-latest | |
| - target: aarch64-apple-darwin | |
| os: macos-latest | |
| - target: x86_64-pc-windows-msvc | |
| os: windows-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Builds both binaries for the target, archives them (.tar.gz on Unix, | |
| # .zip on Windows) with a sha256 checksum, creates the GitHub Release for | |
| # the tag if it does not exist yet, and uploads the archive as an asset. | |
| - name: Build and upload binaries | |
| uses: taiki-e/upload-rust-binary-action@v1 | |
| with: | |
| bin: rpt,rpt-to-xml | |
| target: ${{ matrix.target }} | |
| archive: rpt-rs-$tag-$target | |
| include: README.md,LICENSE | |
| checksum: sha256 | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| # Publish the Docker image to the GitHub Container Registry, tagged with the | |
| # release version and `latest`. Same gating as the release stage. | |
| docker: | |
| needs: [check, test, msrv, feature-matrix, baseline] | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Image tags and labels | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=raw,value=latest | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |