-
+[](https://github.com/sponsors/lissy93)
### Dependencies
@@ -637,4 +407,3 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
| / | / ~-. ~- _
|_____| |_____| ~ - . _ _~_-_
-->
-
diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
deleted file mode 100644
index cf6f8c0..0000000
--- a/.github/workflows/build-docker.yml
+++ /dev/null
@@ -1,74 +0,0 @@
-name: Build + Publish Docker Image π³
-
-on:
- workflow_dispatch:
- push:
- branches:
- - main
- tags:
- - '*'
- paths:
- - src/**
- - Cargo.toml
- - Dockerfile
-
-env:
- IMAGE_NAME: adguardian
- DOCKER_USER: lissy93
- GHCR_REGISTRY: ghcr.io
- DOCKERHUB_REGISTRY: docker.io
-
-jobs:
- docker:
- runs-on: ubuntu-latest
-
- steps:
- - name: Checkout
- uses: actions/checkout@v2
-
- - name: Extract tag name
- shell: bash
- run: echo "GIT_TAG=$(echo ${GITHUB_REF#refs/tags/} | sed 's/\//_/g')" >> $GITHUB_ENV
-
- - name: Compute tags
- id: compute-tags
- run: |
- if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
- echo "GHCR_TAG=${GHCR_REGISTRY}/${DOCKER_USER}/${IMAGE_NAME}:latest" >> $GITHUB_ENV
- echo "DOCKERHUB_TAG=${DOCKERHUB_REGISTRY}/${DOCKER_USER}/${IMAGE_NAME}:latest" >> $GITHUB_ENV
- else
- echo "GHCR_TAG=${GHCR_REGISTRY}/${DOCKER_USER}/${IMAGE_NAME}:${GIT_TAG}" >> $GITHUB_ENV
- echo "DOCKERHUB_TAG=${DOCKERHUB_REGISTRY}/${DOCKER_USER}/${IMAGE_NAME}:${GIT_TAG}" >> $GITHUB_ENV
- fi
-
- - name: Set up QEMU
- uses: docker/setup-qemu-action@v1
-
- - name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v1
-
- - name: Login to GitHub Container Registry
- uses: docker/login-action@v1
- with:
- registry: ${{ env.GHCR_REGISTRY }}
- username: ${{ github.actor }}
- password: ${{ secrets.GITHUB_TOKEN }}
-
- - name: Login to DockerHub
- uses: docker/login-action@v1
- with:
- registry: ${{ env.DOCKERHUB_REGISTRY }}
- username: ${{ env.DOCKER_USER }}
- password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
- - name: Build and push Docker images
- uses: docker/build-push-action@v2
- with:
- context: .
- file: ./Dockerfile
- push: true
- platforms: linux/amd64,linux/arm64,linux/arm/v7
- tags: |
- ${{ env.GHCR_TAG }}
- ${{ env.DOCKERHUB_TAG }}
-
diff --git a/.github/workflows/cargo.yml b/.github/workflows/cargo.yml
new file mode 100644
index 0000000..2729701
--- /dev/null
+++ b/.github/workflows/cargo.yml
@@ -0,0 +1,49 @@
+# Publishes the crate to Crates.io for each new tag
+name: π¦ Publish crates
+
+on:
+ workflow_dispatch:
+ push:
+ tags:
+ - '*'
+
+permissions:
+ contents: read
+
+env:
+ CARGO_TERM_COLOR: always
+
+jobs:
+ publish:
+ name: π¦ Publish
+ runs-on: ubuntu-latest
+ timeout-minutes: 20
+ steps:
+ - name: ποΈ Checkout tag
+ uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+
+ - name: π¦ Setup Rust toolchain
+ uses: dtolnay/rust-toolchain@stable
+
+ - name: π Verify Cargo.toml version matches tag
+ if: github.ref_type == 'tag'
+ env:
+ TAG: ${{ github.ref_name }}
+ run: |
+ set -euo pipefail
+ VERSION=$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"(.*)".*/\1/')
+ if [ "$VERSION" != "$TAG" ]; then
+ echo "::error::Cargo.toml version ($VERSION) does not match tag ($TAG)"
+ exit 1
+ fi
+ echo "Publishing adguardian v$VERSION"
+
+ - name: β
Run tests
+ run: cargo test --locked
+
+ - name: π¦ Publish to Crates.io
+ env:
+ CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
+ run: cargo publish --locked
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..1418aee
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,250 @@
+# CI checks for PRs
+name: π¦ CI
+
+on:
+ pull_request:
+ workflow_dispatch:
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+env:
+ CARGO_TERM_COLOR: always
+ RUST_BACKTRACE: 1
+
+jobs:
+ # Detect which files changed, to determine which checks to run
+ changes:
+ name: π Detect changes
+ runs-on: ubuntu-latest
+ timeout-minutes: 5
+ outputs:
+ docker: ${{ steps.filter.outputs.docker }}
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+
+ - name: Filter changed paths
+ id: filter
+ uses: dorny/paths-filter@v4
+ with:
+ filters: |
+ docker:
+ - 'Dockerfile*'
+ - 'Cargo.toml'
+ - 'Cargo.lock'
+
+ # Run format check, to ensure code nice and pretty
+ fmt:
+ name: π¨ Format
+ runs-on: ubuntu-latest
+ timeout-minutes: 10
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+
+ - name: Setup Rust toolchain
+ uses: dtolnay/rust-toolchain@stable
+ with:
+ components: rustfmt
+
+ - name: Check formatting
+ run: cargo fmt --all --check
+
+ # Run clippy, to ensure no rust warnings
+ clippy:
+ name: π Clippy
+ runs-on: ubuntu-latest
+ timeout-minutes: 20
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+
+ - name: Setup Rust toolchain
+ uses: dtolnay/rust-toolchain@stable
+ with:
+ components: clippy
+
+ - name: Cache cargo build
+ uses: Swatinem/rust-cache@v2
+
+ - name: Run clippy
+ run: cargo clippy --all-targets --all-features --locked -- -D warnings
+
+ # Execute the tests
+ test:
+ name: π§ͺ Test
+ runs-on: ubuntu-latest
+ timeout-minutes: 20
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+
+ - name: Setup Rust toolchain
+ uses: dtolnay/rust-toolchain@stable
+
+ - name: Cache cargo build
+ uses: Swatinem/rust-cache@v2
+
+ - name: Run tests
+ run: cargo test --all-features --locked
+
+ # Do build check, ensure everything builds
+ build:
+ name: π¨ Build
+ runs-on: ubuntu-latest
+ timeout-minutes: 20
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+
+ - name: Setup Rust toolchain
+ uses: dtolnay/rust-toolchain@stable
+
+ - name: Cache cargo build
+ uses: Swatinem/rust-cache@v2
+
+ - name: Build release
+ run: cargo build --release --locked
+
+ # Check the docs build with no warnings or broken intra-doc links
+ docs:
+ name: π Docs
+ runs-on: ubuntu-latest
+ timeout-minutes: 15
+ env:
+ RUSTDOCFLAGS: -D warnings
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+
+ - name: Setup Rust toolchain
+ uses: dtolnay/rust-toolchain@stable
+
+ - name: Cache cargo build
+ uses: Swatinem/rust-cache@v2
+
+ - name: Build docs
+ run: cargo doc --no-deps --all-features --locked
+
+ # Dependencies audit for known vulnerabilities
+ # audit:
+ # name: π‘οΈ Audit
+ # runs-on: ubuntu-latest
+ # timeout-minutes: 15
+ # steps:
+ # - name: Checkout
+ # uses: actions/checkout@v6
+ # with:
+ # persist-credentials: false
+
+ # - name: Install cargo-audit
+ # uses: taiki-e/install-action@v2
+ # with:
+ # tool: cargo-audit
+
+ # - name: Run cargo audit
+ # run: cargo audit
+
+ # Run the Docker image build and smoke test
+ docker:
+ name: π³ Docker build
+ needs: changes
+ if: needs.changes.outputs.docker == 'true' || github.event_name == 'workflow_dispatch'
+ runs-on: ubuntu-latest
+ timeout-minutes: 30
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v4
+
+ - name: Build image (no push)
+ uses: docker/build-push-action@v7
+ with:
+ context: .
+ file: ./Dockerfile
+ platforms: linux/amd64
+ push: false
+ load: false
+ cache-from: type=gha,scope=ci-docker
+ cache-to: type=gha,mode=max,scope=ci-docker
+
+ # Review the workflow files are valid and free of security issues
+ workflow-lint:
+ name: βοΈ Workflow lint
+ runs-on: ubuntu-latest
+ timeout-minutes: 10
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+
+ - name: Run actionlint
+ uses: raven-actions/actionlint@v2
+
+ - name: Setup Python
+ uses: actions/setup-python@v6
+ with:
+ python-version: '3.x'
+
+ - name: Run zizmor
+ run: |
+ python -m pip install --quiet zizmor
+ zizmor --offline .github/workflows/
+
+ # Check no super secret things committed
+ secrets:
+ name: π Secret scan
+ if: github.event_name == 'pull_request'
+ runs-on: ubuntu-latest
+ timeout-minutes: 10
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6
+ with:
+ fetch-depth: 0
+ persist-credentials: false
+
+ - name: Scan for secrets with TruffleHog
+ uses: trufflesecurity/trufflehog@main
+ with:
+ extra_args: --only-verified
+
+ # Dependency changes have no known vulnerabilities
+ dependency-review:
+ name: βοΈβπ₯ Dependency review
+ if: github.event_name == 'pull_request'
+ runs-on: ubuntu-latest
+ timeout-minutes: 10
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+
+ - name: Review dependencies
+ uses: actions/dependency-review-action@v5
+ with:
+ fail-on-severity: moderate
+ show-openssf-scorecard: false
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000..b899bdf
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,184 @@
+name: π³ Docker
+
+on:
+ workflow_dispatch:
+ inputs:
+ tag:
+ description: 'Docker tag to publish. Leave empty to update latest'
+ required: false
+ type: string
+ push:
+ branches:
+ - main
+ tags:
+ - '*'
+
+permissions:
+ contents: read
+ packages: write
+ id-token: write
+ attestations: write
+
+concurrency:
+ group: docker-${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
+env:
+ IMAGE_NAME: adguardian
+ DOCKER_USER: lissy93
+ GHCR_REGISTRY: ghcr.io
+ DOCKERHUB_REGISTRY: docker.io
+
+jobs:
+ docker:
+ runs-on: ubuntu-latest
+
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+
+ - name: Compute image metadata
+ id: meta
+ shell: bash
+ env:
+ MANUAL_TAG: ${{ inputs.tag }}
+ DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
+ run: |
+ if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+ if [[ -n "${MANUAL_TAG}" ]]; then
+ TAG="${MANUAL_TAG}"
+ else
+ TAG="latest"
+ fi
+ elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+ TAG="${GITHUB_REF#refs/tags/}"
+ else
+ TAG="latest"
+ fi
+
+ TAG="$(echo "${TAG}" | sed -E 's/[^A-Za-z0-9_.-]+/-/g; s/^[.-]+//' | cut -c1-128)"
+ if [[ -z "${TAG}" ]]; then
+ echo "Computed Docker tag is empty" >&2
+ exit 1
+ fi
+
+ GHCR_IMAGE="${GHCR_REGISTRY}/${DOCKER_USER}/${IMAGE_NAME}"
+ PUBLISH_IMAGES="${GHCR_IMAGE}"
+ if [[ -n "${DOCKERHUB_PASSWORD}" ]]; then
+ DOCKERHUB_IMAGE="${DOCKERHUB_REGISTRY}/${DOCKER_USER}/${IMAGE_NAME}"
+ PUBLISH_IMAGES="${PUBLISH_IMAGES},${DOCKERHUB_IMAGE}"
+ echo "dockerhub_enabled=true" >> "$GITHUB_OUTPUT"
+ else
+ echo "dockerhub_enabled=false" >> "$GITHUB_OUTPUT"
+ fi
+
+ echo "TAG=${TAG}" >> "$GITHUB_ENV"
+ echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+ echo "GHCR_IMAGE=${GHCR_IMAGE}" >> "$GITHUB_ENV"
+ echo "ghcr_image=${GHCR_IMAGE}" >> "$GITHUB_OUTPUT"
+ echo "PUBLISH_IMAGES=${PUBLISH_IMAGES}" >> "$GITHUB_ENV"
+ echo "publish_images=${PUBLISH_IMAGES}" >> "$GITHUB_OUTPUT"
+
+ - name: Set up QEMU
+ uses: docker/setup-qemu-action@v4
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v4
+
+ - name: Login to GitHub Container Registry
+ uses: docker/login-action@v4
+ with:
+ registry: ${{ env.GHCR_REGISTRY }}
+ username: ${{ github.actor }}
+ password: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Login to DockerHub
+ if: steps.meta.outputs.dockerhub_enabled == 'true'
+ uses: docker/login-action@v4
+ with:
+ registry: ${{ env.DOCKERHUB_REGISTRY }}
+ username: ${{ env.DOCKER_USER }}
+ password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+ # Build the ultra-lightweight from scratch version for 64-bit targets
+ - name: Build lightweight image (amd64, arm64)
+ id: light
+ uses: docker/build-push-action@v7
+ with:
+ context: .
+ file: ./Dockerfile
+ platforms: linux/amd64,linux/arm64
+ provenance: false
+ sbom: false
+ cache-from: type=gha,scope=light
+ cache-to: type=gha,mode=max,scope=light
+ outputs: type=image,"name=${{ steps.meta.outputs.publish_images }}",push-by-digest=true,name-canonical=true,push=true
+
+ # Build the fat (Debian glibc) image for everything else
+ - name: Build full image (armv7, 386)
+ id: full
+ uses: docker/build-push-action@v7
+ with:
+ context: .
+ file: ./Dockerfile.full
+ platforms: linux/arm/v7,linux/386
+ provenance: false
+ sbom: false
+ cache-from: type=gha,scope=full
+ cache-to: type=gha,mode=max,scope=full
+ outputs: type=image,"name=${{ steps.meta.outputs.publish_images }}",push-by-digest=true,name-canonical=true,push=true
+
+ # Merge the variants into single manifest
+ - name: Create combined manifest list
+ id: manifest
+ shell: bash
+ env:
+ LIGHT_DIGEST: ${{ steps.light.outputs.digest }}
+ FULL_DIGEST: ${{ steps.full.outputs.digest }}
+ run: |
+ IFS=',' read -ra IMAGES <<< "${PUBLISH_IMAGES}"
+ for IMG in "${IMAGES[@]}"; do
+ docker buildx imagetools create -t "${IMG}:${TAG}" \
+ "${IMG}@${LIGHT_DIGEST}" \
+ "${IMG}@${FULL_DIGEST}"
+ done
+ GHCR_DIGEST=$(docker buildx imagetools inspect "${GHCR_IMAGE}:${TAG}" --format '{{.Manifest.Digest}}')
+ echo "ghcr_digest=${GHCR_DIGEST}" >> "$GITHUB_OUTPUT"
+
+ - name: Inspect published manifests
+ shell: bash
+ run: |
+ IFS=',' read -ra IMAGES <<< "${PUBLISH_IMAGES}"
+ for IMG in "${IMAGES[@]}"; do
+ echo "::group::${IMG}:${TAG}"
+ docker buildx imagetools inspect "${IMG}:${TAG}"
+ echo "::endgroup::"
+ done
+
+ - name: Attest build provenance
+ uses: actions/attest-build-provenance@v4
+ continue-on-error: true
+ with:
+ subject-name: ${{ steps.meta.outputs.ghcr_image }}
+ subject-digest: ${{ steps.manifest.outputs.ghcr_digest }}
+ push-to-registry: true
+
+ - name: Generate SBOM
+ uses: anchore/sbom-action@v0.24.0
+ continue-on-error: true
+ with:
+ image: ${{ steps.meta.outputs.ghcr_image }}@${{ steps.manifest.outputs.ghcr_digest }}
+ format: spdx-json
+ output-file: sbom.spdx.json
+
+ - name: Attest SBOM
+ uses: actions/attest@v4
+ continue-on-error: true
+ with:
+ subject-name: ${{ steps.meta.outputs.ghcr_image }}
+ subject-digest: ${{ steps.manifest.outputs.ghcr_digest }}
+ predicate-type: https://spdx.dev/Document
+ predicate-path: sbom.spdx.json
+ push-to-registry: true
diff --git a/.github/workflows/insert-contributors.yml b/.github/workflows/insert-contributors.yml
deleted file mode 100644
index bcc0308..0000000
--- a/.github/workflows/insert-contributors.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: π₯ Insert Credits
-on:
- workflow_dispatch:
- schedule:
- - cron: '0 1 * * 0'
-jobs:
-
- insert-sponsors:
- runs-on: ubuntu-latest
- steps:
- - name: Checkout
- uses: actions/checkout@v2
- - name: Contributors
- uses: akhilmhdh/contributors-readme-action@v2.3.6
- env:
- GITHUB_TOKEN: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
- with:
- image_size: 80
- collaborators: all
- readme_path: .github/README.md
- columns_per_row: 6
- commit_message: 'Updates contributor list'
- committer_username: liss-bot
- committer_email: liss-bot@d0h.co
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 59c4bac..25cb29f 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -1,16 +1,22 @@
-# Pushes the contents of the repo to the Codeberg mirror
-name: πͺ Mirror to Codeberg
+# Syncs the full source of the adguardian repo over to our Codeberg mirror
+# This is then accessible over at https://codeberg.org/alicia/adguardian
+name: πͺ Mirror
on:
workflow_dispatch:
schedule:
- - cron: '30 0 * * 0' # At 03:00 on Sunday
+ - cron: '30 3 * * 0' # At 03:30 on Sunday
+
+permissions:
+ contents: read
+
jobs:
codeberg:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v2
- with: { fetch-depth: 0 }
- - uses: pixta-dev/repository-mirroring-action@v1
+ - uses: lissy93/repo-mirror-action@v1.5.0
with:
- target_repo_url: git@codeberg.org:alicia/adguardian.git
- ssh_private_key: ${{ secrets.CODEBERG_SSH }}
+ ssh_key: ${{ secrets.CODEBERG_SSH }}
+ host: git@codeberg.org
+ user: alicia
+ repo: adguardian
+ force_push: false
diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml
index a8cc966..4babf15 100644
--- a/.github/workflows/publish-docs.yml
+++ b/.github/workflows/publish-docs.yml
@@ -1,4 +1,7 @@
-name: Build Docs π
+# Generates Rustdoc API documentation and publishes it to the docs-src branch
+# (served via GitHub Pages). Runs on pushes to main that touch the source.
+
+name: π Docs
on:
workflow_dispatch:
@@ -9,24 +12,34 @@ on:
- src/**
- Cargo.toml
+permissions:
+ contents: write
+
+env:
+ CARGO_TERM_COLOR: always
+
jobs:
build:
+ name: π Build & publish docs
runs-on: ubuntu-latest
+ timeout-minutes: 15
steps:
- - name: Checkout repository
- uses: actions/checkout@v2
-
- - name: Generate docs
- uses: actions-rs/cargo@v1
+ - name: ποΈ Checkout repository
+ uses: actions/checkout@v6
with:
- command: doc
- args: --no-deps
+ persist-credentials: false
+
+ - name: π¦ Setup Rust toolchain
+ uses: dtolnay/rust-toolchain@stable
+
+ - name: π Generate docs
+ run: cargo doc --no-deps --locked
- - name: Create index.html
- run: echo "
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
-