dailz
ed39d3d873
Oracle P2 plan step 1+2+missed-fields. Locks in the audit cleanup so
future PRs can't regress the 0-errors / deny-unsafe / 79-tests baseline.
- .github/workflows/ci.yml: two jobs on ubuntu-latest (Linux only —
project is Wayland/VAAPI-specific, no macOS/Windows story).
* build-test: installs ffmpeg + libavcodec/libavformat/libavutil/
libswscale/libva dev + libwayland + libdrm + libpipewire-0.3-dev
+ libclang-dev/llvm-14 (LIBCLANG_PATH pinned); caches cargo +
target; runs clippy -> build --release -> test --release.
Release build before tests is mandatory because
tests/integration_test.rs shells out to target/release/wl-webrtc.
* audit: installs cargo-audit and runs 'cargo audit --deny warnings'
as a separate job so a RUSTSEC advisory fails the build
independently of compile state.
No -D warnings on clippy yet — undocumented_unsafe_blocks is already
deny via Cargo.toml; remaining warnings are advisory and can be
tightened later.
- Cargo.toml: pin rust-version = '1.70' to match README's claim.
Without this, cargo builds silently on older toolchains and surfaces
errors as cryptic parse failures instead of a clean version-mismatch
message. Oracle flagged this as a missing field during P2 review.
License field intentionally omitted — repo has no LICENSE file and no
publication plan yet. Add when publication becomes a goal.
Verified locally: YAML parses, cargo build --release Finished in 9.82s,
cargo test --release 79 passed, cargo clippy 0 errors.
90 lines
2.7 KiB
YAML
90 lines
2.7 KiB
YAML
# Continuous integration for wl-webrtc.
|
|
#
|
|
# Triggered on push/PR to master. Runs the full quality gate that the recent
|
|
# audit baselined:
|
|
# - clippy: 0 errors (undocumented_unsafe_blocks is deny in Cargo.toml; other
|
|
# warnings are advisory for now).
|
|
# - build --release: integration tests in tests/integration_test.rs shell out
|
|
# to target/release/wl-webrtc, so the release binary must exist before tests
|
|
# run.
|
|
# - test --release: 79 unit + 3 integration; the 1 hardware-ignored test
|
|
# stays ignored in CI (needs Wayland session + VAAPI GPU).
|
|
# - cargo audit: separate job so a RUSTSEC advisory fails the build without
|
|
# conflating with compile errors.
|
|
#
|
|
# The job pins Linux only — the project is Wayland/VAAPI-specific and has no
|
|
# macOS/Windows story. Oracle audit 2026-06-28 P2 plan.
|
|
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
pull_request:
|
|
branches: [master]
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
# Build dependencies match shell.nix + README Prerequisites section.
|
|
LIBCLANG_PATH: /usr/lib/llvm-14/lib
|
|
|
|
jobs:
|
|
build-test:
|
|
name: Build + Clippy + Test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install Rust toolchain (stable)
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: clippy
|
|
|
|
- name: Install system dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends \
|
|
ffmpeg \
|
|
libavcodec-dev libavformat-dev libavutil-dev libswscale-dev libva-dev \
|
|
libwayland-dev wayland-protocols \
|
|
libdrm-dev \
|
|
libpipewire-0.3-dev \
|
|
libclang-dev llvm-14
|
|
|
|
- name: Cache cargo registry + build artifacts
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cargo/registry
|
|
~/.cargo/git
|
|
target
|
|
key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock', 'Cargo.toml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-cargo-
|
|
|
|
- name: Clippy (release, all targets)
|
|
run: cargo clippy --release --all-targets
|
|
|
|
- name: Build release (required before tests)
|
|
run: cargo build --release --all-targets
|
|
|
|
- name: Test (release)
|
|
run: cargo test --release
|
|
|
|
audit:
|
|
name: Security audit (RUSTSEC)
|
|
runs-on: ubuntu-latest
|
|
# Keep separate from build-test so a vulnerability advisory fails the
|
|
# check independently of compile state.
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install Rust toolchain (stable)
|
|
uses: dtolnay/rust-toolchain@stable
|
|
|
|
- name: Install cargo-audit
|
|
run: cargo install cargo-audit --locked
|
|
|
|
- name: Audit dependencies
|
|
run: cargo audit --deny warnings
|