dailz
ebff43d9d6
CI / Build + Clippy + Test (pull_request) Failing after 5m26s
CI / Security audit (RUSTSEC) (pull_request) Successful in 1m19s
packages.microsoft.com fails through proxy after 5 retries. --error-on=any causes the whole update to fail. Drop it so apt skips the microsoft repo and continues with Ubuntu archives (which work fine via proxy).
102 lines
3.8 KiB
YAML
102 lines
3.8 KiB
YAML
# Continuous integration for wl-webrtc.
|
|
#
|
|
# Triggered on push/PR to master. Runs the full quality gate that the recent
|
|
# audit baselined:
|
|
# - clippy: 0 errors (undocumented_unsafe_blocks is deny in Cargo.toml; other
|
|
# warnings are advisory for now).
|
|
# - build --release: integration tests in tests/integration_test.rs shell out
|
|
# to target/release/wl-webrtc, so the release binary must exist before tests
|
|
# run.
|
|
# - test --release: 79 unit + 3 integration; the 1 hardware-ignored test
|
|
# stays ignored in CI (needs Wayland session + VAAPI GPU).
|
|
# - cargo audit: separate job so a RUSTSEC advisory fails the build without
|
|
# conflating with compile errors.
|
|
#
|
|
# The job pins Linux only — the project is Wayland/VAAPI-specific and has no
|
|
# macOS/Windows story. Oracle audit 2026-06-28 P2 plan.
|
|
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
pull_request:
|
|
branches: [master]
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
build-test:
|
|
name: Build + Clippy + Test
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
HTTP_PROXY: http://172.17.0.1:7897
|
|
HTTPS_PROXY: http://172.17.0.1:7897
|
|
NO_PROXY: localhost,127.0.0.1,server,db,gitea.dailz.cn,gitea.com
|
|
steps:
|
|
- uses: https://gitea.com/actions/checkout@v4
|
|
|
|
- name: Install Rust toolchain (stable)
|
|
run: |
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal --component clippy
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Install system dependencies
|
|
run: |
|
|
echo 'Acquire::http::Proxy "http://172.17.0.1:7897";' | sudo tee /etc/apt/apt.conf.d/99proxy
|
|
echo 'Acquire::https::Proxy "http://172.17.0.1:7897";' | sudo tee -a /etc/apt/apt.conf.d/99proxy
|
|
APT_OPTS=(-o Acquire::Retries=5 -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30)
|
|
sudo apt-get "${APT_OPTS[@]}" update
|
|
# NOTE: do NOT use --no-install-recommends for libclang-dev — on
|
|
# Debian Bookworm (the node:20-bookworm image used by act_runner
|
|
# under ubuntu-latest) the recommended toolchain bits are needed
|
|
# by bindgen. The pkg-config based deps (pipewire/wayland/etc)
|
|
# are also more reliable without the flag.
|
|
sudo apt-get "${APT_OPTS[@]}" install -y \
|
|
ffmpeg \
|
|
libavcodec-dev libavfilter-dev libavformat-dev libavutil-dev libswscale-dev libva-dev \
|
|
libwayland-dev wayland-protocols \
|
|
libdrm-dev \
|
|
libpipewire-0.3-dev \
|
|
libclang-dev clang
|
|
|
|
- name: Resolve LIBCLANG_PATH
|
|
run: |
|
|
set -e
|
|
LIBCL=$(find /usr -name 'libclang*.so*' 2>/dev/null | head -1)
|
|
test -n "$LIBCL" || { echo "ERROR: no libclang shared lib found under /usr"; exit 1; }
|
|
LIBDIR=$(dirname "$LIBCL")
|
|
echo "Resolved LIBCLANG_PATH=$LIBDIR (found $LIBCL)"
|
|
echo "LIBCLANG_PATH=$LIBDIR" >> "$GITHUB_ENV"
|
|
|
|
- name: Clippy (release, all targets)
|
|
run: cargo clippy --release --all-targets
|
|
|
|
- name: Build release (required before tests)
|
|
run: cargo build --release --all-targets
|
|
|
|
- name: Test (release)
|
|
run: cargo test --release
|
|
|
|
audit:
|
|
name: Security audit (RUSTSEC)
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
HTTP_PROXY: http://172.17.0.1:7897
|
|
HTTPS_PROXY: http://172.17.0.1:7897
|
|
NO_PROXY: localhost,127.0.0.1,server,db,gitea.dailz.cn,gitea.com
|
|
steps:
|
|
- uses: https://gitea.com/actions/checkout@v4
|
|
|
|
- name: Install Rust toolchain (stable)
|
|
run: |
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Install cargo-audit
|
|
run: cargo install cargo-audit --locked
|
|
|
|
- name: Audit dependencies
|
|
run: cargo audit --deny warnings
|