Merge pull request #561 from DanielCharis1/fix/issues-436-437-438-439 #44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Management | |
| on: | |
| schedule: | |
| # Run every Monday at 08:00 UTC | |
| - cron: "0 8 * * 1" | |
| push: | |
| paths: | |
| - "**/Cargo.toml" | |
| - "**/Cargo.lock" | |
| branches: [main] | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| security-audit: | |
| name: Security Audit (cargo-audit) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.cargo/registry | |
| key: ${{ runner.os }}-cargo-audit-${{ hashFiles('**/Cargo.lock') }} | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| - name: Run security audit | |
| run: cargo audit | |
| continue-on-error: false | |
| - name: Upload audit report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: security-audit-report | |
| path: audit-report.json | |
| continue-on-error: true | |
| license-and-deny: | |
| name: License & Dependency Policy (cargo-deny) | |
| runs-on: ubuntu-latest | |
| # Don't block PRs on transitive dependency issues outside our control | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run cargo-deny | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check | |
| arguments: --all-features | |
| manifest-path: ./Cargo.toml | |
| outdated: | |
| name: Check Outdated Dependencies | |
| runs-on: ubuntu-latest | |
| # Only run on schedule or manual trigger to avoid noise on every PR | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install cargo-outdated | |
| run: cargo install cargo-outdated --locked | |
| - name: Check for outdated dependencies | |
| run: | | |
| cargo outdated --workspace --exit-code 0 | tee outdated-report.txt | |
| echo "## Outdated Dependencies" >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| cat outdated-report.txt >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| - name: Upload outdated report | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: outdated-dependencies-report | |
| path: outdated-report.txt | |
| compatibility: | |
| name: Version Compatibility Testing | |
| runs-on: ubuntu-latest | |
| # Only run on schedule or manual trigger — CI already covers stable build+test on PRs | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| strategy: | |
| matrix: | |
| rust: [stable, beta] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust ${{ matrix.rust }} | |
| uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: ${{ matrix.rust }} | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-${{ matrix.rust }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| - name: Build on ${{ matrix.rust }} | |
| run: cargo build --workspace --exclude e2e-tests | |
| - name: Test on ${{ matrix.rust }} | |
| run: cargo test --workspace --exclude e2e-tests | |
| dependency-summary: | |
| name: Dependency Management Summary | |
| runs-on: ubuntu-latest | |
| needs: [security-audit, license-and-deny, compatibility] | |
| if: always() | |
| steps: | |
| - name: Report status | |
| run: | | |
| echo "## Dependency Management Results" >> $GITHUB_STEP_SUMMARY | |
| echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY | |
| echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY | |
| echo "| Security Audit | ${{ needs.security-audit.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| License & Policy | ${{ needs.license-and-deny.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Compatibility | ${{ needs.compatibility.result }} |" >> $GITHUB_STEP_SUMMARY |