librekeys/picoforge
0
0
Fork 0
mirror of https://github.com/librekeys/picoforge.git synced 2026-07-28 08:01:19 -07:00
Code Issues Packages Projects Releases Wiki Activity

ci: replace Nix with rust-toolchain, add audit-check and CodeQL jobs

Browse Source 
- Switch `checks` and docs jobs from Nix to dtolnay/rust-toolchain +
  Swatinem/rust-cache + apt system deps for faster setup
- Add dependency vulnerability scanning via rustsec/audit-check@v2.0.0
- Add CodeQL static analysis via github/codeql-action@v4 (manual build)
This commit is contained in:
Suyog Tandel
2026-07-09 20:22:32 +05:30
parent 5121bb011d
commit 8a769bc169
2 changed files with 64 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+59 -11
View File
@@ -22,32 +22,42 @@ jobs:
steps:
- uses: actions/checkout@v7
- name: Install Nix
uses: DeterminateSystems/nix-installer-action@v22
- name: install Rust stable
uses: dtolnay/rust-toolchain@stable
- name: Setup Nix cache
uses: DeterminateSystems/magic-nix-cache-action@v14
- name: Cache cargo
uses: Swatinem/rust-cache@v2
- name: install dependencies (linux)
run: |
sudo apt-get update
sudo apt install -y \
pkg-config libpcsclite-dev libudev-dev libvulkan-dev \
libwayland-dev wayland-protocols libxkbcommon-dev \
libxcb1-dev libxkbcommon-x11-dev libfontconfig1-dev \
libasound2-dev libdbus-1-dev libx11-dev \
libxcb-shape0-dev libxcb-xfixes0-dev libusb-1.0-0-dev
- name: Check formatting
run: nix develop --command cargo fmt --all -- --check
run: cargo fmt --all -- --check
- name: Run cargo check
run: nix develop --command cargo check --all-targets
run: cargo check --all-targets
- name: Run clippy
run: nix develop --command cargo clippy --all-targets -- -D warnings
run: cargo clippy --all-targets -- -D warnings
- name: Check for missing documentation
run: nix develop --command bash -c 'RUSTFLAGS="-D missing_docs" cargo check --all-targets'
run: RUSTFLAGS="-D missing_docs" cargo check --all-targets
- name: Check documentation builds cleanly
run: nix develop --command bash -c 'RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --document-private-items'
run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --document-private-items
- name: Build project
run: nix develop --command cargo build --verbose
run: cargo build --verbose
- name: Run tests
run: nix develop --command cargo test --verbose
run: cargo test --verbose
verify-build:
name: Build (${{ matrix.platform }} / ${{ matrix.target }})
@@ -95,3 +105,41 @@ jobs:
- name: Build
run: cargo build --verbose --target ${{ matrix.target }}
audit:
name: Security Audit
needs: checks
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: rustsec/audit-check@v2.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
codeql:
name: CodeQL Analysis
needs: checks
runs-on: ubuntu-latest
permissions:
security-events: write
contents: read
steps:
- uses: actions/checkout@v7
- name: Install Nix
uses: DeterminateSystems/nix-installer-action@v22
- name: Setup Nix cache
uses: DeterminateSystems/magic-nix-cache-action@v14
- name: Initialize CodeQL
uses: github/codeql-action/init@v4
with:
languages: rust
build-mode: manual
- name: Build with Nix
run: nix develop --command cargo build --verbose
- name: Perform CodeQL analysis
uses: github/codeql-action/analyze@v4
.github/workflows/docs.yml
+5 -5
View File
@@ -24,14 +24,14 @@ jobs:
- name: Checkout repository
uses: actions/checkout@v7
- name: Install Nix
uses: DeterminateSystems/nix-installer-action@v22
- name: install Rust stable
uses: dtolnay/rust-toolchain@stable
- name: Setup Nix cache
uses: DeterminateSystems/magic-nix-cache-action@v14
- name: Cache cargo
uses: Swatinem/rust-cache@v2
- name: Generate Documentation
run: nix develop --command cargo doc --document-private-items
run: cargo doc --document-private-items
- name: Create Redirect Index
run: |