onecipher/.github/workflows/ci.yml at master · longcipher/onecipher · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  RUSTC_WRAPPER: ""

jobs:
  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt
      - run: cargo +nightly fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: RUSTC_WRAPPER= cargo +nightly clippy --all --all-targets -- -D warnings

  sort:
    name: Cargo Sort
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: cargo install cargo-sort
      - run: cargo sort -w -g -c

  shear:
    name: Unused Deps
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo install cargo-shear
      - run: cargo shear

  hard-gates:
    name: Hard Gates (R12 / R56)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2

      # R56: the isolated crates must stay free of every async runtime and
      # network stack, not just tokio. The previous version only grepped for
      # `tokio`, so adding e.g. `reqwest` or `async-std` would have passed.
      - name: R56 — no async/network deps in isolated crates
        run: |
          forbidden='tokio|reqwest|tungstenite|hyper|async-std|smol'
          status=0
          for crate in oc-crypto oc-policy oc-keyagent oc-session-key; do
            # `--edges normal` still catches dev-deps? No -- so check both:
            # normal edges gate the shipped tree, all edges gate dev-deps too,
            # which R56 also forbids.
            if hit=$(cargo tree -p "$crate" 2>/dev/null | grep -Eo "^[^a-zA-Z]*($forbidden) v[0-9]" | sort -u); then
              if [ -n "$hit" ]; then
                echo "R56 VIOLATION in $crate:"
                echo "$hit"
                status=1
              fi
            fi
          done
          exit $status

      # R12a: source-level isolation. Mirrors `just r12-check`.
      - name: R12a — no TCP types in isolated crate sources
        run: |
          if grep -rnE 'TcpListener|TcpStream' \
               crates/oc-keyagent/src/ crates/oc-crypto/src/ \
               crates/oc-policy/src/ crates/oc-session-key/src/; then
            echo "R12a VIOLATION: TCP types found in isolated crate sources"
            exit 1
          fi
          echo "R12a PASS"

  duplicate-deps:
    name: Duplicate Dependencies
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: ./scripts/check-duplicate-deps.sh

  no-std:
    name: no-std (${{ matrix.target }})
    runs-on: ubuntu-latest
    strategy:
      matrix:
        # A13 pilot (oc-signer only): host must pass; thumbv7m is
        # experimental until each dependency's `std` gate is audited.
        target: [host, thumbv7m-none-eabi]
    continue-on-error: ${{ matrix.target == 'thumbv7m-none-eabi' }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target == 'thumbv7m-none-eabi' && 'thumbv7m-none-eabi' || '' }}
      - uses: Swatinem/rust-cache@v2
      - name: host no_std check
        if: matrix.target == 'host'
        run: cargo check -p oc-signer --no-default-features
      - name: thumbv7m no_std check (experimental)
        if: matrix.target == 'thumbv7m-none-eabi'
        run: cargo check -p oc-signer --no-default-features --target thumbv7m-none-eabi

  skill-consistency:
    name: SKILL <-> clap consistency
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: ./scripts/check-skill-consistency.sh

  makefile-mirror:
    name: Justfile <-> Makefile mirror
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: ./scripts/check-makefile-mirror.sh

  deny:
    name: cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo install cargo-deny
      - run: cargo deny check advisories licenses bans sources

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --workspace --all-features

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --workspace

  release:
    name: Release Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --release --bin onecipher

  audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - run: cargo install cargo-audit
      - run: cargo audit