mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 07:21:32 +02:00
jwinterm
143f00701b
- minimal Axum server exposing GET /health - OpenAPI contract generated from handlers (gen_openapi -> openapi.json), drift-gated in CI so the spec can never silently diverge from the code - CI: secret-scan + gitleaks, openapi drift gate, fmt/clippy/build/test/doc-test, cargo-deny - Cargo.lock tracked for reproducible builds; publish=false; pinned toolchain - README, SECURITY.md, deny.toml, .env.example
60 lines
1.6 KiB
YAML
60 lines
1.6 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
secret-scan:
|
|
name: secret scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: key / seed material
|
|
run: ./tools/secret-scan.sh
|
|
- name: gitleaks (full history)
|
|
run: |
|
|
curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz \
|
|
| tar -xz gitleaks
|
|
sudo mv gitleaks /usr/local/bin/
|
|
gitleaks detect --no-banner --redact --source .
|
|
|
|
openapi-drift:
|
|
name: openapi drift gate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: Regenerate the spec; fail if it drifts from committed openapi.json
|
|
run: |
|
|
cargo run --quiet --bin gen_openapi > /tmp/openapi.json
|
|
diff openapi.json /tmp/openapi.json
|
|
|
|
rust:
|
|
name: fmt / clippy / build / test / doc-test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: rustfmt, clippy
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: cargo fmt --all -- --check
|
|
- run: cargo clippy --all-targets -- -D warnings
|
|
- run: cargo build --all-targets --locked
|
|
- run: cargo test --locked
|
|
- run: cargo test --doc
|
|
|
|
supply-chain:
|
|
name: cargo-deny
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: EmbarkStudios/cargo-deny-action@v2
|