chore: bump sha2 from 0.10.9 to 0.11.0 #92
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| jobs: | |
| # Gate the Rust jobs on Rust changes, so docs-only changes skip lint and test. | |
| # `main` is protected (PR-only), so validation is the PR's job; on push to main | |
| # only `test` re-runs (for the Codecov base, below). Skip the whole workflow on | |
| # knope's own release-bump commit - it re-pushes to main and would otherwise | |
| # duplicate everything. `head_commit` is null on pull_request events, so this | |
| # guard only ever suppresses that one push. | |
| changes: | |
| name: Detect changes | |
| if: "${{ !startsWith(github.event.head_commit.message, 'chore: prepare release') }}" | |
| runs-on: ubuntu-latest | |
| outputs: | |
| rust: ${{ steps.filter.outputs.rust }} | |
| helm: ${{ steps.filter.outputs.helm }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dorny/paths-filter@v4 | |
| id: filter | |
| with: | |
| filters: | | |
| rust: | |
| - '**/*.rs' | |
| - '**/Cargo.toml' | |
| - 'Cargo.lock' | |
| - 'deny.toml' | |
| - '.github/workflows/ci.yml' | |
| helm: | |
| - 'chart/**' | |
| - '.github/workflows/ci.yml' | |
| lint: | |
| name: Lint | |
| needs: changes | |
| # PR-only: a merge lands the exact tree already linted on the PR. | |
| if: github.event_name == 'pull_request' && needs.changes.outputs.rust == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy, rustfmt | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Check formatting | |
| run: cargo fmt --all --check | |
| - name: Run clippy | |
| run: cargo clippy --all-targets --all-features --locked -- -D warnings | |
| test: | |
| name: Test and coverage | |
| needs: changes | |
| # The one job that also runs on push to main: it re-uploads coverage so | |
| # Codecov's project base (codecov.yml `project: auto`, 0% drop) tracks the | |
| # merged main, not a stale ancestor. The knope commit is already excluded via | |
| # `changes` above (a version bump does not change coverage anyway). | |
| if: needs.changes.outputs.rust == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: llvm-tools-preview | |
| - uses: Swatinem/rust-cache@v2 | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-llvm-cov | |
| - name: Test and collect coverage | |
| # Exclude the thin binary shim (src/main.rs: arg parsing, wiring, serve) from | |
| # the coverage number - it is not unit-testable and the logic it wires up is | |
| # covered via the library by the integration tests. Fail if under 80%. | |
| run: | | |
| cargo llvm-cov --all-features --locked --ignore-filename-regex 'src/main\.rs' --lcov --output-path lcov.info | |
| cargo llvm-cov report --ignore-filename-regex 'src/main\.rs' --summary-only --fail-under-lines 80 | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v7 | |
| with: | |
| files: lcov.info | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| # Scan the dependency tree for security advisories, disallowed licenses, and | |
| # non-crates.io sources (config in deny.toml). | |
| deny: | |
| name: Dependencies | |
| needs: changes | |
| # PR-only: the dependency tree that merges is the one already scanned. | |
| if: github.event_name == 'pull_request' && needs.changes.outputs.rust == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-deny | |
| - name: Check dependencies | |
| run: cargo deny check | |
| helm: | |
| name: Lint and validate Helm chart | |
| needs: changes | |
| # PR-only: a merge lands the exact chart already validated on the PR. | |
| if: github.event_name == 'pull_request' && needs.changes.outputs.helm == 'true' | |
| runs-on: ubuntu-latest | |
| env: | |
| # kubeconform release used to validate rendered manifests against the | |
| # Kubernetes schemas. | |
| KUBECONFORM_VERSION: v0.6.7 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: azure/setup-helm@v5 | |
| - name: Install kubeconform | |
| run: | | |
| curl -sSL "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/kubeconform-linux-amd64.tar.gz" \ | |
| | tar -xz -C /usr/local/bin kubeconform | |
| - name: Lint, render, and validate the chart | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| helm lint chart | |
| # Render under a few value combinations so the conditional templates | |
| # (Ingress, emptyDir, ServiceMonitor, CA trust, auth secrets) are all | |
| # exercised, then validate each render against the Kubernetes schemas. | |
| # -strict rejects unknown fields; -ignore-missing-schemas skips CRDs | |
| # (the ServiceMonitor). | |
| for args in \ | |
| "" \ | |
| "--set ingress.enabled=true" \ | |
| "--set persistence.enabled=false" \ | |
| "--set serviceMonitor.enabled=true" \ | |
| "--set caTrust.enabled=true,caTrust.configMapName=ca" \ | |
| "--set upstreamAuth.existingSecret=up,serveToken.existingSecret=srv"; do | |
| echo "-- helm template chart $args" | |
| helm template release chart $args \ | |
| | kubeconform -strict -summary -ignore-missing-schemas | |
| done | |
| # Spelling runs on every PR, including docs. PR-only: a merge lands the same tree. | |
| typos: | |
| name: Typos | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: crate-ci/typos@v1 | |
| # Conventional Commits check for pull requests (advisory; direct pushes to main are | |
| # covered by a local commit-msg hook - see CONTRIBUTING.md). | |
| commits: | |
| name: Commit messages | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| # Dependabot commit messages are auto-generated: long changelog and URL | |
| # lines in the body exceed line_length and long dep names exceed | |
| # subject_length, neither of which is configurable. Exempt them (keyed on | |
| # PR author so maintainer re-runs stay stable); the job still runs green. | |
| - if: github.event.pull_request.user.login != 'dependabot[bot]' | |
| uses: crate-ci/committed@v1.1.11 |