From 62f2dc3dca29c67b8e01804cb82c0f4ec1322d36 Mon Sep 17 00:00:00 2001 From: samialabri Date: Sat, 17 Oct 2026 00:53:36 +0900 Subject: [PATCH] CI: valid YAML, pinned actions, fmt, cargo deny and npm audit The old workflow was invalid YAML (unquoted ${{ }} in a flow mapping) and never ran. deny.toml: allows BSL-1.0 (arboard's Windows deps) and CDLA-Permissive-2.0 (webpki-roots); ignores three unmaintained-crate notices for build-time proc-macros (uniffi 0.28, glib-macros 0.18) that need upstream upgrades. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 82 ++++++++++++++++++++++++++++++++-------- src-tauri/deny.toml | 31 +++++++++++++++ 2 files changed, 98 insertions(+), 15 deletions(-) create mode 100644 src-tauri/deny.toml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3542eb5..ea988b7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,23 +1,75 @@ name: ci -on: [push, pull_request] +on: + push: + pull_request: + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +env: + CARGO_TERM_COLOR: always + +# Sibling repos are checked out side by side under $GITHUB_WORKSPACE, as the relative path +# dependencies expect (../kestrove-core). If the repos are private, add a fine-grained token with +# read access to them as the CORE_READ_TOKEN secret; github.token can only read this repository. + jobs: build: strategy: - matrix: { os: [ubuntu-22.04, windows-latest] } + fail-fast: false + matrix: + os: [ubuntu-22.04, windows-2025] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v4 - with: { path: kestrove-desktop } - - uses: actions/checkout@v4 - with: { repository: ${{ github.repository_owner }}/kestrove-core, path: kestrove-core, token: ${{ secrets.CORE_READ_TOKEN }} } + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: { path: kestrove-desktop, persist-credentials: false } + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: ${{ github.repository_owner }}/kestrove-core + path: kestrove-core + token: ${{ secrets.CORE_READ_TOKEN || github.token }} + persist-credentials: false - if: runner.os == 'Linux' run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libxdo-dev - - uses: dtolnay/rust-toolchain@stable - - uses: actions/setup-node@v4 - with: { node-version: 22 } - - run: npm ci && npm run build - working-directory: kestrove-desktop - - run: cargo clippy --all-targets -- -D warnings - working-directory: kestrove-desktop/src-tauri - - run: cargo test - working-directory: kestrove-desktop/src-tauri + - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10 + with: { toolchain: stable, components: "clippy, rustfmt" } + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + with: { workspaces: kestrove-desktop/src-tauri } + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + with: + node-version: 24 + cache: npm + cache-dependency-path: kestrove-desktop/package-lock.json + # `npm run build` type-checks (tsc --noEmit) and writes dist/, which tauri::generate_context! embeds. + - working-directory: kestrove-desktop + run: | + npm ci + npm run build + - working-directory: kestrove-desktop/src-tauri + run: | + cargo fmt --all --check + cargo clippy --all-targets -- -D warnings + cargo test + + deny: + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: { path: kestrove-desktop, persist-credentials: false } + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: ${{ github.repository_owner }}/kestrove-core + path: kestrove-core + token: ${{ secrets.CORE_READ_TOKEN || github.token }} + persist-credentials: false + - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 + with: { command: check, manifest-path: kestrove-desktop/src-tauri/Cargo.toml } + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + with: { node-version: 24 } + - working-directory: kestrove-desktop + run: npm audit --omit=dev diff --git a/src-tauri/deny.toml b/src-tauri/deny.toml new file mode 100644 index 0000000..9fc2f25 --- /dev/null +++ b/src-tauri/deny.toml @@ -0,0 +1,31 @@ +# cargo deny check — enforces docs/06 §5 (no GPL in shipped apps) and advisories. Mirrors kestrove-core/deny.toml. +# Not run by `npm audit`: covers only the Rust side (src-tauri). +[advisories] +version = 2 +yanked = "deny" +ignore = [ + # Unmaintained notices (no known vulnerability) for build-time proc-macro crates we can't replace + # without upgrading upstream: uniffi 0.28 (through kv-ffi) and gtk-rs glib-macros 0.18 (Tauri on Linux). + { id = "RUSTSEC-2025-0141", reason = "bincode 1.x via uniffi_macros 0.28 (build-time)" }, + { id = "RUSTSEC-2024-0436", reason = "paste via uniffi 0.28 (proc-macro)" }, + { id = "RUSTSEC-2024-0370", reason = "proc-macro-error via glib-macros 0.18 / Tauri gtk stack (proc-macro)" }, +] + +[licenses] +version = 2 +allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "Unicode-DFS-2016", "Zlib", "CC0-1.0", "MPL-2.0", + # clipboard-win / error-code (arboard on Windows): Boost Software License, permissive. + "BSL-1.0", + # webpki-roots (Mozilla's CA bundle, via kv-ffi's TLS): permissive data license. + "CDLA-Permissive-2.0"] +confidence-threshold = 0.9 + +[bans] +multiple-versions = "warn" +wildcards = "deny" +# kv-ffi is a path dependency on ../../kestrove-core without a version; this crate is never published. +allow-wildcard-paths = true + +[sources] +unknown-registry = "deny" +unknown-git = "deny"