chore: remove obsolete intake TODO block #306
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Least privilege: CI only needs to read the repo. | |
| permissions: | |
| contents: read | |
| # Cancel superseded runs on the same ref to save CI minutes. | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| fmt: | |
| name: rustfmt | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt | |
| - run: cargo fmt --all --check | |
| version-snapshots: | |
| name: version-snapshots | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Guards against a workspace version bump that forgets to re-accept the | |
| # `version_*` insta snapshots (they bake in the literal crate version). | |
| # A stale snapshot otherwise only fails the full test job — and, as in the | |
| # v0.1.8 release, can slip onto `main` after a tag is cut. This is a | |
| # dependency-free grep check, so it flags the mismatch in seconds. | |
| - run: ./scripts/check-version-snapshots.sh | |
| # Exercises the changed-snapshot success path and every hook file guard | |
| # against a real temporary git fixture with a deterministic cargo stub. | |
| - run: ./scripts/test-shipshape-bump-hook.sh | |
| # Uses strict git/gh/shipshape stubs and stops before release state or refs can | |
| # be mutated. Its minimal PATH catches undeclared preflight dependencies. | |
| - run: ./scripts/test-shipshape-release.sh | |
| # Exercises absent, duplicate, partial-resume, and every fail-closed | |
| # crates.io reconciliation mismatch with cargo/curl fully stubbed and no token. | |
| - run: ./scripts/test-publish-crates.sh | |
| clippy: | |
| name: clippy | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| # Cache the cargo registry + git db only. We deliberately do NOT cache | |
| # target/ via actions/cache: its key has no rustc-version component, so a | |
| # toolchain bump would restore a stale incremental tree. | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-cargo- | |
| - run: cargo clippy --locked --workspace --all-targets -- -D warnings | |
| test: | |
| name: test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 25 | |
| strategy: | |
| # Don't cancel the macOS run when ubuntu fails (and vice-versa) — | |
| # platform-specific regressions are exactly what this matrix is for. | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: taiki-e/install-action@nextest | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-cargo- | |
| # nextest gives every test its own process. That isolation is load-bearing: | |
| # this workspace has executable-stub fixtures in several unit-test modules, | |
| # and a process-wide cargo-test binary can fork while another test still has | |
| # a stub open for writing. The inherited fd can make Linux exec fail with | |
| # ETXTBSY even after the writer closes its copy. | |
| # | |
| # --release matches the project's quality bar (the release profile is the | |
| # shipped one). The msrv job below separately checks the default-profile | |
| # build at the supported Rust floor. nextest does not run doctests, so keep | |
| # those as an explicit, isolated cargo-test step. | |
| # | |
| # macOS picks up platform-sensitive paths (supervisor pid liveness, | |
| # tmux/unix-fd, kqueue-driven watchers) that Linux CI misses | |
| # (issue: macos-ci-matrix). | |
| - run: cargo nextest run --locked --release --workspace | |
| - run: cargo test --locked --release --workspace --doc | |
| # Same-repository PRs and exact-main pushes prove the repository-scoped | |
| # cargo-dist runner. Fork pull requests never allocate this persistent machine. | |
| r9-self-hosted-macos: | |
| name: test (self-hosted-macos-arm64) | |
| if: >- | |
| (github.event_name == 'pull_request' && | |
| github.event.pull_request.head.repo.full_name == github.repository) || | |
| (github.event_name == 'push' && github.ref == 'refs/heads/main') | |
| runs-on: [self-hosted, macOS, ARM64] | |
| timeout-minutes: 25 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: taiki-e/install-action@nextest | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-cargo- | |
| - run: cargo nextest run --locked --release --workspace | |
| - run: cargo test --locked --release --workspace --doc | |
| release-topology: | |
| name: release topology (cargo-dist 0.28.2) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Fetch checksum-pinned cargo-dist | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| url=https://github.com/axodotdev/cargo-dist/releases/download/v0.28.2/cargo-dist-x86_64-unknown-linux-gnu.tar.xz | |
| archive="$RUNNER_TEMP/cargo-dist-0.28.2.tar.xz" | |
| extract_dir="$RUNNER_TEMP/cargo-dist-0.28.2" | |
| mkdir -m 700 "$extract_dir" | |
| curl --proto '=https' --tlsv1.2 -LsSf "$url" -o "$archive" | |
| echo 'c1ba58b5458646ab86f5e0c6f8641c7162eb04d92251fcd949db2c018b9e90e8 '"$archive" | sha256sum --check | |
| tar -xJf "$archive" -C "$extract_dir" | |
| mapfile -t candidates < <(find "$extract_dir" -type f -name dist -perm -u+x -print) | |
| test "${#candidates[@]}" -eq 1 | |
| dist_bin="${candidates[0]}" | |
| test "$($dist_bin --version)" = 'cargo-dist 0.28.2' | |
| echo "DIST_BIN=$dist_bin" >> "$GITHUB_ENV" | |
| - run: '"$DIST_BIN" generate --check' | |
| - name: Exercise release policy parser with pinned jq 1.6 | |
| shell: bash | |
| run: | | |
| jq_bin="$RUNNER_TEMP/jq-1.6" | |
| curl --proto '=https' --tlsv1.2 -LsSf \ | |
| https://github.com/jqlang/jq/releases/download/jq-1.6/jq-linux64 \ | |
| -o "$jq_bin" | |
| echo 'af986793a515d500ab2d35f8d2aecd656e764504b789b66d7e1a0b727a124c44 '"$jq_bin" | sha256sum --check | |
| chmod +x "$jq_bin" | |
| test "$($jq_bin --version)" = jq-1.6 | |
| REAL_JQ="$jq_bin" ./scripts/test-release-github-policy.sh | |
| - run: ./scripts/test-release-authorization.sh | |
| - name: Validate exact generated release plan and coherent activation state | |
| shell: bash | |
| run: | | |
| "$DIST_BIN" plan --output-format=json > "$RUNNER_TEMP/taskfleet-dist-plan.json" | |
| release_state="$(jq -er .activation release/taskfleet-release.json)" | |
| distribution_state="$(jq -er .activation release/taskfleet-distribution.json)" | |
| secret_state="$(jq -er .cargo_dist.tap_secret_state release/taskfleet-distribution.json)" | |
| case "$release_state:$distribution_state:$secret_state" in | |
| blocked-r8-r9-r10:prepared-blocked-r10:pending-r10-proof) state=prepared ;; | |
| ready:ready:active-proven-r10) state=active ;; | |
| *) echo "incoherent release activation state" >&2; exit 2 ;; | |
| esac | |
| ./scripts/validate-distribution-topology.sh "$RUNNER_TEMP/taskfleet-dist-plan.json" "$state" | |
| msrv: | |
| name: msrv (1.85) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@1.85 | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| key: ${{ runner.os }}-cargo-msrv-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-cargo-msrv- | |
| # Verify the declared rust-version actually builds (dev profile → keeps | |
| # debug-assertions / overflow checks in the type/borrow check). | |
| - run: cargo check --locked --workspace --all-targets | |
| doc: | |
| name: docs | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| env: | |
| RUSTDOCFLAGS: -D warnings | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| # Guards the taskfleet-core #![warn(missing_docs)] investment: fails on missing | |
| # docs or broken intra-doc links. | |
| - run: cargo doc --locked --workspace --no-deps | |
| deny: | |
| name: cargo-deny | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check | |
| arguments: --locked |