Skip to content

ci: add minimal compile gate for PRs and main #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sagnik11 merged 1 commit into from
Aug 16, 2026
Merged

ci: add minimal compile gate for PRs and main #42

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
name: CI

Check warning on line 1 in .github/workflows/ci.yml

View check run for this annotation

Autter.dev / autter/review-gate

🟠 Medium · Missing linked tracker issue 

The PR description explicitly states that no linked tracker issue was identified. This changes the repository-wide CI workflow and affects pull request and main-branch validation.
Suggested fix:
Add a valid tracker reference such as GitHub #123, Jira/Linear KEY-123, or a Fixes/Closes/Resolves reference to the PR description.

Check warning on line 1 in .github/workflows/ci.yml

View check run for this annotation

Autter.dev / autter/review-gate

🟠 Medium · Missing CODEOWNERS reviewer approval 

The changed workflow path has no CODEOWNERS entry in the provided repository context, and the only reviewer requested changes rather than approving. The new cargo check job controls CI status for pull requests and pushes to main.
Suggested fix:
Add an appropriate CODEOWNERS entry for.github/workflows/ci.yml and obtain an approving review from the matching owner before merging.

# Minimal compile gate for PRs and main. Until this existed, the release
# workflow was the repo's only build check, so uncompilable merges could land
# on main unnoticed — v1.6.8 alone shipped three separate "repair main" fixes.
#
# Deliberately just `cargo check`: fast enough to gate every PR, and it
# compiles the lib, bins, tests, and benches without running anything.

on:
pull_request:
push:
branches: [main]

permissions:
contents: read

concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true

jobs:
check:
name: cargo check
runs-on: ubuntu-22.04
steps:
- name: Checkout
uses: actions/checkout@v4

Check warning on line 28 in .github/workflows/ci.yml

View check run for this annotation

Autter.dev / autter/review-gate

🟠 Medium · External artefact pulled in without integrity pinning 

The CI workflow runs actions/checkout from mutable tag v4 rather than a 40-character commit SHA. A retagged or compromised action could execute code in the PR and main compile-gate runners, exposing the repository contents and any runner credentials available to subsequent steps.
Suggested fix:
Pin actions/checkout to a reviewed 40-character commit SHA and update the SHA deliberately when upgrading the action.

@autter-dev autter-dev Bot Aug 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 External artefact pulled in without integrity pinning — Risk: 60/100

The CI workflow runs actions/checkout from mutable tag v4 rather than a 40-character commit SHA. A retagged or compromised action could execute code in the PR and main compile-gate runners, exposing the repository contents and any runner credentials available to subsequent steps.

🛠 AI fix prompt (copy & paste into your coding agent) 
Pin actions/checkout to a reviewed 40-character commit SHA and update the SHA deliberately when upgrading the action.

Flagged by Autter security & observability checks.


- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable

Check warning on line 31 in .github/workflows/ci.yml

View check run for this annotation

Autter.dev / autter/review-gate

🟠 Medium · External artefact pulled in without integrity pinning 

The CI workflow runs dtolnay/rust-toolchain from mutable tag stable rather than a 40-character commit SHA. A changed action could execute arbitrary code while installing the Rust toolchain and compromise the cargo check gate or build runner.
Suggested fix:
Pin dtolnay/rust-toolchain to a reviewed 40-character commit SHA; explicitly configure the intended Rust toolchain separately if stable-channel behavior is required.

Check warning on line 31 in .github/workflows/ci.yml

View check run for this annotation

Autter.dev / autter/review-gate

🟠 Medium · Third-party action pinned by mutable tag 

The Rust toolchain action uses the mutable `stable` tag, allowing a compromised or retagged release to execute arbitrary code in the CI job and access the repository contents and read-only GITHUB_TOKEN.
Suggested fix:
Replace `dtolnay/rust-toolchain@stable` with the maintainer-verified 40-character commit SHA, updating it deliberately when upgrading the toolchain.

@autter-dev autter-dev Bot Aug 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 External artefact pulled in without integrity pinning — Risk: 60/100

The CI workflow runs dtolnay/rust-toolchain from mutable tag stable rather than a 40-character commit SHA. A changed action could execute arbitrary code while installing the Rust toolchain and compromise the cargo check gate or build runner.

🛠 AI fix prompt (copy & paste into your coding agent) 
Pin dtolnay/rust-toolchain to a reviewed 40-character commit SHA; explicitly configure the intended Rust toolchain separately if stable-channel behavior is required.

Flagged by Autter security & observability checks.

@autter-dev autter-dev Bot Aug 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Third-party action pinned by mutable tag — Risk: 55/100

The Rust toolchain action uses the mutable stable tag, allowing a compromised or retagged release to execute arbitrary code in the CI job and access the repository contents and read-only GITHUB_TOKEN.

🛠 AI fix prompt (copy & paste into your coding agent) 
Replace `dtolnay/rust-toolchain@stable` with the maintainer-verified 40-character commit SHA, updating it deliberately when upgrading the toolchain.

Flagged by Autter security & observability checks.


- name: Cache cargo
uses: Swatinem/rust-cache@v2

Check warning on line 34 in .github/workflows/ci.yml

View check run for this annotation

Autter.dev / autter/review-gate

🟠 Medium · External artefact pulled in without integrity pinning 

The CI workflow runs Swatinem/rust-cache from mutable tag v2 rather than a 40-character commit SHA. A compromised or retagged cache action could execute code in CI and poison or expose Cargo build caches used by the compile gate.
Suggested fix:
Pin Swatinem/rust-cache to a reviewed 40-character commit SHA and update it only through an intentional, reviewed dependency change.

Check warning on line 34 in .github/workflows/ci.yml

View check run for this annotation

Autter.dev / autter/review-gate

🟠 Medium · Third-party action pinned by mutable tag 

The Rust cache action uses the mutable `v2` tag, allowing a compromised or retagged action release to execute arbitrary code in the CI job and access the repository contents and read-only GITHUB_TOKEN.
Suggested fix:
Replace `Swatinem/rust-cache@v2` with the maintainer-verified 40-character commit SHA, updating it deliberately when upgrading the action.

@autter-dev autter-dev Bot Aug 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 External artefact pulled in without integrity pinning — Risk: 60/100

The CI workflow runs Swatinem/rust-cache from mutable tag v2 rather than a 40-character commit SHA. A compromised or retagged cache action could execute code in CI and poison or expose Cargo build caches used by the compile gate.

🛠 AI fix prompt (copy & paste into your coding agent) 
Pin Swatinem/rust-cache to a reviewed 40-character commit SHA and update it only through an intentional, reviewed dependency change.

Flagged by Autter security & observability checks.

@autter-dev autter-dev Bot Aug 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Third-party action pinned by mutable tag — Risk: 55/100

The Rust cache action uses the mutable v2 tag, allowing a compromised or retagged action release to execute arbitrary code in the CI job and access the repository contents and read-only GITHUB_TOKEN.

🛠 AI fix prompt (copy & paste into your coding agent) 
Replace `Swatinem/rust-cache@v2` with the maintainer-verified 40-character commit SHA, updating it deliberately when upgrading the action.

Flagged by Autter security & observability checks.


- name: Check (lib, bins, tests, benches)
run: cargo check --locked --all-targets
Loading