fabro/.github/workflows/rust.yml at main · apexcloudwise/fabro · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
name: Rust

on:
  push:
    branches: [main]
    paths:
      - "lib/apps/**"
      - "lib/components/**"
      - "lib/foundation/**"
      - "test/**"
      - "Cargo.toml"
      - "Cargo.lock"
      - ".cargo/**"
      - ".config/**"
      - "bin/dev/**"
      - "docs/public/reference/cli.mdx"
      - "docs/public/reference/user-configuration.mdx"
      - "openapi/**"
      - ".github/workflows/rust.yml"
  pull_request:
    branches: [main]
    paths:
      - "lib/apps/**"
      - "lib/components/**"
      - "lib/foundation/**"
      - "test/**"
      - "Cargo.toml"
      - "Cargo.lock"
      - ".cargo/**"
      - ".config/**"
      - "bin/dev/**"
      - "docs/public/reference/cli.mdx"
      - "docs/public/reference/user-configuration.mdx"
      - "openapi/**"
      - ".github/workflows/rust.yml"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

env:
  CARGO_TERM_COLOR: always
  CARGO_NET_RETRY: "10"

jobs:
  fmt:
    name: Format
    runs-on: ubuntu-24.04-x86-32-cores
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
        with:
          toolchain: nightly-2026-04-14
          components: rustfmt
      - run: cargo +nightly-2026-04-14 fmt --check --all

  clippy:
    name: Clippy
    runs-on: ubuntu-24.04-x86-32-cores
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
        with:
          toolchain: nightly-2026-04-14
          components: clippy
      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          cache-on-failure: true
      - name: Verify legacy auth identity removal
        run: |
          if git grep -nE 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*"disabled"' \
            -- lib/apps lib/components lib/foundation apps lib/packages docs/public/api-reference/fabro-api.yaml; then
            echo "::error::Legacy auth identities remain in the repository"
            exit 1
          else
            status=$?
            if [ "$status" -ne 1 ]; then
              exit "$status"
            fi
          fi
      - run: cargo +nightly-2026-04-14 clippy --locked --workspace --all-targets -- -D warnings

  generated-docs:
    name: Generated Docs
    runs-on: ubuntu-24.04-x86-32-cores
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          cache-on-failure: true
      - run: cargo --locked dev docs check

  test:
    name: Test (Linux)
    runs-on: ubuntu-24.04-x86-32-cores
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          cache-on-failure: true
      - uses: taiki-e/install-action@773334c0e05d7e699e4d78234494308223f3a2cf # nextest
      - run: cargo nextest run --locked --workspace --status-level slow --profile ci
      # Twin-mode e2e suites. These are hermetic (in-process twin provider, no
      # secrets): FABRO_TEST_MODE defaults to twin, so live-only tests
      # self-skip. Scoped to the packages whose ignored tests are fully green
      # in twin mode; widen as the remaining suites are fixed up for CI.
      # Must not use the e2e nextest profile here: NEXTEST_PROFILE=e2e implies
      # strict mode, which fails (rather than skips) live tests without keys.
      - run: cargo nextest run --locked --workspace --status-level slow --profile ci --run-ignored only -E 'package(fabro-agent) + package(fabro-llm) + package(twin-openai)'

  test-macos:
    name: Test (macOS)
    if: github.event_name == 'workflow_dispatch'
    runs-on: macos-15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          cache-on-failure: true
      - uses: taiki-e/install-action@773334c0e05d7e699e4d78234494308223f3a2cf # nextest
      - run: cargo nextest run --locked --workspace --status-level slow --profile ci