fix(ssh,docker): make the SSH and Docker backends build on Windows (#… #401
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| # Cancel superseded runs on the same ref. | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| # Backend SDKs (TLS-heavy: cloud, k8s, docker, ssh transport) live behind non-default Cargo | |
| # features (ADR-0006). The cross-platform `test`/`clippy` jobs build the LEAN default so | |
| # Windows/macOS never compile the cloud/aws-lc S3 stack; the Linux-only `*-full` jobs do | |
| # `--all-features`. Rule: NEVER run `cargo build`/`cargo test` with `--all-features` or the cloud | |
| # features (s3/gcs/azure/cloud) on a macOS/Windows job — that heavy stack stays Linux-only for fast | |
| # PR feedback and is verified cross-platform only in release.yml. The SOLE exception is the | |
| # `windows-portability` job below: a compile-only `cargo check` of the platform-sensitive transport | |
| # backends (`ssh,containers`) that guards against Unix-only API regressions the lean Windows build | |
| # cannot catch (it caught none before — russh/bollard Unix-only calls shipped unbuilt). It | |
| # deliberately excludes the cloud SDKs; keep it `check`, keep it transport-only. | |
| jobs: | |
| fmt: | |
| name: rustfmt | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt | |
| - run: cargo fmt --all --check | |
| clippy: | |
| name: clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo clippy --workspace --all-targets -- -D warnings | |
| clippy-full: | |
| name: clippy (all-features, linux) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo clippy --workspace --all-targets --all-features -- -D warnings | |
| test: | |
| name: test (${{ matrix.os }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| # LEAN: default features only — keeps the heavy backend SDKs off Windows/macOS. | |
| - run: cargo test --workspace | |
| test-full: | |
| name: test (all-features, linux) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo test --workspace --all-features | |
| windows-portability: | |
| name: portability (transport backends, windows) | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| # russh's default crypto provider (aws-lc-rs) builds its native lib from source on Windows. | |
| - name: Install NASM (required by aws-lc-rs via russh) | |
| uses: ilammy/setup-nasm@v1 | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: win-transport | |
| # Compile-only portability gate for the platform-sensitive transport backends (SSH + Docker/K8s), | |
| # which call OS-specific APIs the lean Windows `test` job never compiles — this is what let the | |
| # russh/bollard Unix-only calls ship unbuilt. `check` runs the full type/cfg pass but skips | |
| # codegen/linking. The cloud/aws-lc S3 stack (s3/gcs/azure) is intentionally excluded: it is | |
| # cross-platform and already built on Windows by release.yml. This is the ONE sanctioned | |
| # backend-feature build on a non-Linux CI runner (see the policy note at the top of this file). | |
| - run: cargo check -p cairn --features ssh,containers | |
| docs: | |
| name: rustdoc | |
| runs-on: ubuntu-latest | |
| env: | |
| RUSTDOCFLAGS: "-D warnings" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo doc --workspace --no-deps --all-features | |
| deny: | |
| name: cargo-deny | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Default-feature dependency graph. | |
| - id: deny-default | |
| continue-on-error: true | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check | |
| # Full graph: feature-gated backend SDKs are invisible to the default run, so check them too | |
| # (license/advisory drift in the TLS stack must not slip in behind a non-default feature). | |
| # `continue-on-error` + the gate below so a failure in the first check never SKIPS the second. | |
| - id: deny-full | |
| continue-on-error: true | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check | |
| arguments: --all-features | |
| - name: Fail if either deny check failed | |
| if: steps.deny-default.outcome == 'failure' || steps.deny-full.outcome == 'failure' | |
| run: exit 1 |