diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index aff6065..f697508 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -13,42 +13,62 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: persist-credentials: false - - name: Setup Rust + - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable - - name: Download dependencies - run: cargo fetch + - name: Cache cargo + uses: actions/cache@v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} - name: Run tests - run: cargo test + run: cargo test --locked - name: Build - run: cargo build --release + run: cargo build --release --locked lint: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: persist-credentials: false - - name: Setup Rust + - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable with: - components: clippy + components: rustfmt, clippy + + - name: Cache cargo + uses: actions/cache@v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} - - name: Download dependencies - run: cargo fetch + - name: Check formatting + run: cargo fmt --all --check - - name: Install qlty - run: | - curl -fsSL https://qlty.sh | QLTY_VERSION=0.618.0 bash - echo "$HOME/.qlty/bin" >> $GITHUB_PATH + - name: Lint with clippy + run: cargo clippy --all-targets --locked -- -D warnings - - name: Lint and security scan - run: qlty check --all --no-progress + osv-scan: + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.5 + permissions: + actions: read + contents: read + security-events: write + with: + scan-args: |- + --lockfile=Cargo.lock diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 7f5ac53..a3d19fe 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -13,31 +13,43 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: persist-credentials: false - - name: Setup Rust + - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable with: - components: clippy + components: rustfmt, clippy - - name: Download dependencies - run: cargo fetch - - - name: Install qlty - run: | - curl -fsSL https://qlty.sh | QLTY_VERSION=0.618.0 bash - echo "$HOME/.qlty/bin" >> $GITHUB_PATH + - name: Cache cargo + uses: actions/cache@v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} - - name: Lint and security scan - run: qlty check --all --no-progress + - name: Check formatting + run: cargo fmt --all --check - - name: Clippy - run: cargo clippy --all-targets -- -D warnings + - name: Lint with clippy + run: cargo clippy --all-targets --locked -- -D warnings - name: Test - run: cargo test + run: cargo test --locked - name: Build - run: cargo build --release + run: cargo build --release --locked + + osv-scan: + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.5 + permissions: + actions: read + contents: read + security-events: write + pull-requests: write + with: + scan-args: |- + --lockfile=Cargo.lock diff --git a/.qlty/.gitignore b/.qlty/.gitignore deleted file mode 100644 index 3036618..0000000 --- a/.qlty/.gitignore +++ /dev/null @@ -1,7 +0,0 @@ -* -!configs -!configs/** -!hooks -!hooks/** -!qlty.toml -!.gitignore diff --git a/.qlty/configs/.hadolint.yaml b/.qlty/configs/.hadolint.yaml deleted file mode 100644 index 8f7e23e..0000000 --- a/.qlty/configs/.hadolint.yaml +++ /dev/null @@ -1,2 +0,0 @@ -ignored: - - DL3008 diff --git a/.qlty/qlty.toml b/.qlty/qlty.toml deleted file mode 100644 index ff4a4a1..0000000 --- a/.qlty/qlty.toml +++ /dev/null @@ -1,36 +0,0 @@ -# Code quality config — mirrors ttal-cli setup -# https://qlty.sh/d/config -config_version = "0" - -exclude_patterns = [ - "**/target/**", - "**/vendor/**", -] - -test_patterns = [ - "**/tests/**", - "**/*_test.rs", -] - -[smells] -mode = "comment" - -[[source]] -name = "default" -default = true - -# Rust linter (clippy) -[[plugin]] -name = "clippy" - -# Dockerfile linter -[[plugin]] -name = "hadolint" - -# Dependency vulnerability scanning (Cargo.lock) -[[plugin]] -name = "osv-scanner" - -# Secret scanning -[[plugin]] -name = "trufflehog" diff --git a/CLAUDE.md b/CLAUDE.md index 58c77da..9503cf7 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -10,7 +10,7 @@ make test # cargo test make clippy # cargo clippy --all-targets -- -D warnings make fmt # cargo fmt make ci # clippy + test + build (full pre-merge check) -make qlty # qlty check --all (clippy + security scan) +make lint # lefthook checks ``` Run a single test: diff --git a/Cargo.lock b/Cargo.lock index 945b90b..bf7cd3e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -547,7 +547,7 @@ dependencies = [ "bytes", "jsonwebtoken", "postgres-protocol", - "rand 0.8.5", + "rand", "serde", "serde_json", "thiserror", @@ -596,7 +596,7 @@ dependencies = [ "hmac", "md-5", "memchr", - "rand 0.10.0", + "rand", "sha2", "stringprep", ] @@ -612,15 +612,6 @@ dependencies = [ "postgres-protocol", ] -[[package]] -name = "ppv-lite86" -version = "0.2.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9" -dependencies = [ - "zerocopy", -] - [[package]] name = "prettyplease" version = "0.2.37" @@ -663,36 +654,15 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" [[package]] name = "rand" -version = "0.8.5" +version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404" -dependencies = [ - "libc", - "rand_chacha", - "rand_core 0.6.4", -] - -[[package]] -name = "rand" -version = "0.10.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8" +checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207" dependencies = [ "chacha20", "getrandom 0.4.2", "rand_core 0.10.0", ] -[[package]] -name = "rand_chacha" -version = "0.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88" -dependencies = [ - "ppv-lite86", - "rand_core 0.6.4", -] - [[package]] name = "rand_core" version = "0.6.4" @@ -974,7 +944,7 @@ dependencies = [ "pin-project-lite", "postgres-protocol", "postgres-types", - "rand 0.10.0", + "rand", "socket2", "tokio", "tokio-util", @@ -1375,26 +1345,6 @@ dependencies = [ "wasmparser", ] -[[package]] -name = "zerocopy" -version = "0.8.48" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9" -dependencies = [ - "zerocopy-derive", -] - -[[package]] -name = "zerocopy-derive" -version = "0.8.48" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - [[package]] name = "zeroize" version = "1.8.2" diff --git a/Cargo.toml b/Cargo.toml index ea85287..f9b5dbd 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -34,7 +34,7 @@ tracing = "0.1" tracing-subscriber = { version = "0.3", features = ["env-filter"] } # Random -rand = "0.8" +rand = "0.10.1" # TLS (optional — enable with features = ["tls"]; currently disabled for no-TLS MVP) # tokio-rustls = "0.26" diff --git a/Makefile b/Makefile index 54ef6bb..1113366 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -.PHONY: help build clean test fmt clippy qlty ci check-clean install-hooks +.PHONY: help build clean test fmt clippy lint ci check-clean install-hooks # Default target help: @@ -8,10 +8,10 @@ help: @echo " make test - Run tests" @echo " make fmt - Format code with rustfmt" @echo " make clippy - Run clippy linter" - @echo " make qlty - Run qlty check (clippy + security scan)" - @echo " make ci - Run all CI checks (qlty, test, build)" + @echo " make lint - Run lefthook checks" + @echo " make ci - Run all CI checks (clippy, test, build)" @echo " make check-clean - Check if working directory is clean" - @echo " make install-hooks - Install qlty git hooks" + @echo " make install-hooks - Install lefthook git hooks" # Build the release binary build: @@ -35,11 +35,9 @@ fmt: clippy: @cargo clippy --all-targets -- -D warnings -# Run qlty check (clippy + trufflehog + hadolint + osv-scanner) -qlty: - @echo "Running qlty check..." - @qlty check --all --no-progress - @echo "✓ Qlty check complete" +# Run lefthook checks +lint: + @lefthook run pre-commit --all-files # Run all checks and build ci: clippy test build @@ -55,7 +53,7 @@ check-clean: echo "✓ Working directory is clean"; \ fi -# Install qlty git hooks (pre-commit: fmt, pre-push: lint + security) +# Install lefthook git hooks install-hooks: - @qlty githooks install - @echo "✓ Qlty hooks installed" + @lefthook install + @echo "✓ Lefthook hooks installed" diff --git a/lefthook.yml b/lefthook.yml new file mode 100644 index 0000000..7e997e4 --- /dev/null +++ b/lefthook.yml @@ -0,0 +1,16 @@ +pre-commit: + parallel: true + jobs: + - name: fmt + glob: "*.rs" + run: cargo fmt --all --check + + - name: clippy + glob: "*.rs" + run: cargo clippy --all-targets -- -D warnings + + - name: osv + glob: + - "Cargo.lock" + - "Cargo.toml" + run: osv-scanner --lockfile Cargo.lock diff --git a/tanka/environments/prod/main.jsonnet b/tanka/environments/prod/main.jsonnet index abfe556..3cf7a3f 100644 --- a/tanka/environments/prod/main.jsonnet +++ b/tanka/environments/prod/main.jsonnet @@ -3,7 +3,7 @@ local pgwire = import '../../lib/pgwire.libsonnet'; local params = { env: 'prod', namespace: 'supa-prod', - imageTag: 'v0.1.1', + imageTag: '1.0.0', imagePullPolicy: 'IfNotPresent', // CNPG pooler connection (flicknote-rw is in infra-prod, serves supabase db)