ci: split out verify-ci (full gate minus the Carrier-network smoke)…
#125
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| # `main` is the live line. The feature branch is included so we can run the full | |
| # gate on our own work in isolation (this entry lives only on the branch; it does | |
| # NOT affect main or other branches until/unless it is merged). Drop or generalise | |
| # to `feat/**` at merge time. | |
| branches: [main, feat/ddrm-hardening-and-creator-parity] | |
| pull_request: | |
| branches: [main] | |
| # Manual trigger so a feature branch can be put through the full Linux gate | |
| # (incl. the Linux-only carrier smoke in `just verify`) before merge. | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: "-D warnings" | |
| jobs: | |
| check: | |
| name: Check + Clippy + Format | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy, rustfmt | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: elastos | |
| - name: cargo fmt | |
| working-directory: elastos | |
| run: cargo fmt --all -- --check | |
| - name: cargo clippy | |
| working-directory: elastos | |
| run: cargo clippy --workspace --all-targets -- -D warnings | |
| - name: cargo check | |
| working-directory: elastos | |
| run: cargo check --workspace | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: elastos | |
| - name: cargo test | |
| working-directory: elastos | |
| run: cargo test --workspace | |
| # Network-sensitive tests are #[ignore] and won't run. | |
| # Run them explicitly with: cargo test --workspace -- --ignored | |
| build-release: | |
| name: Build Release (x86_64) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: elastos | |
| - name: cargo build --release | |
| working-directory: elastos | |
| run: cargo build --workspace --release | |
| # The canonical gate on Linux, MINUS the Carrier-network setup smoke: alignment-check + | |
| # command smoke + candidate-command-audit + fmt/clippy/test (elastos workspace) + the dDRM | |
| # capsule build+test (verify-capsules). This turns "manually covered" into "green on a clean | |
| # runner". The `local-carrier-setup-smoke` step is excluded here because it fetches the | |
| # net-provider artifact over Elastos Carrier, which a stock GitHub runner cannot reach — run | |
| # the full `just verify` on a Carrier-capable Linux box / self-hosted runner before merge. | |
| # RUSTFLAGS=-D warnings is inherited from `env` above. | |
| verify: | |
| name: Verify (Linux CI gate) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy, rustfmt | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: | | |
| elastos | |
| capsules/decrypt-provider | |
| capsules/ddrm-envelope | |
| scripts/dev/ddrm-media-authority | |
| - uses: extractions/setup-just@v2 | |
| - name: Install ripgrep (required by alignment-check; not preinstalled on the runner) | |
| run: sudo apt-get update && sudo apt-get install -y ripgrep | |
| - name: just verify-ci | |
| run: just verify-ci | |
| # Isolated, fast signal for the protected-content capsule crates that live OUTSIDE | |
| # the elastos workspace (so the `check`/`test` jobs and `cargo --workspace` never | |
| # reach them): the watermark codec, the grant-digest envelope, the media-authority. | |
| # Independent of the carrier smoke, so a flaky/heavy smoke run never masks a capsule | |
| # regression. Build+test only (these crates still carry pre-existing clippy debt). | |
| capsules: | |
| name: dDRM Capsule Gate | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: | | |
| capsules/decrypt-provider | |
| capsules/ddrm-envelope | |
| scripts/dev/ddrm-media-authority | |
| - uses: extractions/setup-just@v2 | |
| - name: just verify-capsules | |
| run: just verify-capsules |