Karti TripathiandClaude Opus 5
c24f71518a
cargo-deny correctly rejected webpki-root-certs (CDLA-Permissive-2.0), reached via hickory-resolver -> rustls-platform-verifier. CDLA-Permissive-2.0 is a data licence on the Mozilla CA root list, permissive, with no reciprocal obligation on code that uses the data. Allowed deliberately, with the reasoning in deny.toml rather than as a silent entry. MPL-2.0 removed: nothing needs it, and pre-authorising unused licences makes the policy something nobody reads carefully. If a dependency pulls it in, CI fails and someone decides on purpose. Diagnostic step removed — PATH in the workflow env is what fixed the runner; the .path/.env files were not being applied. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JkyvfNJGTshJNE9FtwPLk7
70 lines
2.5 KiB
YAML
70 lines
2.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
RUSTFLAGS: -D warnings
|
|
# The runner's .path/.env files are not reliably applied, so PATH is set
|
|
# here where it demonstrably is. /opt/rust holds the isolated toolchain.
|
|
PATH: /opt/rust/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
RUSTUP_HOME: /opt/rust/rustup
|
|
CARGO_HOME: /opt/rust/cargo
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# Every job runs on spark-1 (aarch64, 20 cores). Two reasons, and the second
|
|
# outlives the first:
|
|
#
|
|
# 1. GitHub-hosted runners are currently unavailable on this account for
|
|
# billing reasons. Public repos get them free, so this may be temporary.
|
|
# 2. aarch64 is the deployment target — Oracle Cloud's Ampere A1. Testing on
|
|
# the architecture we ship is worth more than testing on x86 and hoping.
|
|
#
|
|
# An x86_64 job is worth adding back once hosted runners work, to catch
|
|
# endianness- and width-dependent bugs. Tracked in ROADMAP.md.
|
|
#
|
|
# ⚠️ Do NOT add Swatinem/rust-cache to these jobs. On a self-hosted runner its
|
|
# post-step prunes ~/.cargo — which here is a real, persistent toolchain, not a
|
|
# disposable one. It silently deleted the rustup binary and every subsequent
|
|
# job failed with exit 127. The toolchain now lives at /opt/rust (wired via the
|
|
# runner's .env and .path) partly to put it out of reach, but do not re-add the
|
|
# action. The runner keeps its target dir between runs anyway, so caching buys
|
|
# nothing here.
|
|
|
|
jobs:
|
|
check:
|
|
name: check · test · clippy · fmt
|
|
runs-on: [self-hosted, Linux, ARM64, spark-1]
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- run: cargo fmt --all --check
|
|
- run: cargo clippy --workspace --all-targets --all-features
|
|
- run: cargo test --workspace --all-features
|
|
|
|
licences:
|
|
name: licence policy (ADR 0002)
|
|
runs-on: [self-hosted, Linux, ARM64, spark-1]
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- run: cargo deny check licenses bans sources advisories
|
|
|
|
release:
|
|
name: release build · aarch64
|
|
runs-on: [self-hosted, Linux, ARM64, spark-1]
|
|
if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- run: cargo build --release --workspace --locked
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: openmail-aarch64
|
|
path: target/release/openmail
|
|
if-no-files-found: error
|