CSFX-Core/.github/workflows/lint.yml at main · CSFX-cloud/CSFX-Core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
name: Lint

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  push:
    branches:
      - main
  workflow_run:
    workflows: ["Format"]
    types: [completed]
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  checks: write
  actions: read

jobs:
  wait-for-format:
    name: Wait for auto-format
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Poll for in-flight format run
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          BRANCH="${{ github.event.pull_request.head.ref }}"
          REPO="${{ github.repository }}"
          for _ in $(seq 1 30); do
            STATUS=$(gh run list --repo "$REPO" --workflow Format --branch "$BRANCH" \
              --limit 1 --json status -q '.[0].status' 2>/dev/null || echo "")
            if [ "$STATUS" != "in_progress" ] && [ "$STATUS" != "queued" ]; then
              exit 0
            fi
            sleep 5
          done

  clippy-push:
    name: Clippy
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    steps:
      - uses: actions/checkout@v6

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y pkg-config libssl-dev libpq-dev protobuf-compiler

      - uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

      - name: Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

  clippy-pr:
    name: Clippy
    runs-on: ubuntu-latest
    needs: wait-for-format
    if: github.event_name == 'pull_request' && always() && (needs.wait-for-format.result == 'success' || needs.wait-for-format.result == 'skipped')
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.ref }}

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y pkg-config libssl-dev libpq-dev protobuf-compiler

      - uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

      - name: Clippy with PR annotations
        uses: giraffate/clippy-action@v1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          reporter: github-pr-review
          fail_on_error: true
          clippy_flags: --workspace --all-targets -- -D warnings

  rustfmt:
    name: rustfmt
    runs-on: ubuntu-latest
    needs: wait-for-format
    if: always() && (needs.wait-for-format.result == 'success' || needs.wait-for-format.result == 'skipped')
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.ref || github.ref }}

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: Format check
        run: cargo fmt --all -- --check

  audit:
    name: cargo audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Audit
        id: audit
        run: cargo audit --json > audit-report.json || echo "failed=true" >> "$GITHUB_OUTPUT"

      - name: Post audit findings to PR
        if: github.event_name == 'pull_request' && steps.audit.outputs.failed == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          SUMMARY=$(jq -r '.vulnerabilities.list[] | "- **\(.advisory.id)** \(.package.name)@\(.package.version): \(.advisory.title)"' audit-report.json)
          gh pr comment "${{ github.event.pull_request.number }}" \
            --repo "${{ github.repository }}" \
            --body "$(printf 'cargo audit found vulnerabilities:\n\n%s' "$SUMMARY")"
          exit 1