fix: restore main build — revert incompatible rand 0.10 bump (#66) (#78) #154

Workflow file for this run

	# CI — runs on every push to main and on every pull request targeting main.
	#
	# Responsibilities:
	# - Validate code quality (fmt, clippy, tests, audit)
	# - Build release binaries to catch compile errors early
	# - Build Docker images to verify Dockerfiles are healthy
	#
	# What this workflow does NOT do:
	# - Push Docker images to any registry ← happens only in release.yml
	# - Publish binaries or create releases ← happens only in release.yml

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	env:
	CARGO_TERM_COLOR: always
	RUST_BACKTRACE: 1

	jobs:
	# ── Format ────────────────────────────────────────────────────────────────────
	# Ensures all Rust code is formatted with `cargo fmt`.
	# Fails fast so contributors get feedback before heavier jobs run.
	fmt:
	name: Format
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: dtolnay/rust-toolchain@stable
	with:
	components: rustfmt
	- run: cargo fmt --all --check

	# ── Lint ──────────────────────────────────────────────────────────────────────
	# Runs clippy with -D warnings so any lint becomes a hard failure.
	clippy:
	name: Clippy
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: dtolnay/rust-toolchain@stable
	with:
	components: clippy
	- uses: Swatinem/rust-cache@v2
	- name: Install protobuf compiler
	run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
	- run: cargo clippy --workspace -- -D warnings

	# ── Test ──────────────────────────────────────────────────────────────────────
	# Runs the full test suite including ferrox-cp integration tests which require
	# a live Postgres instance. sqlx::test spins up isolated temp databases per test.
	test:
	name: Test
	runs-on: ubuntu-latest
	services:
	postgres:
	image: postgres:16-alpine
	env:
	POSTGRES_USER: postgres
	POSTGRES_PASSWORD: testpass
	POSTGRES_DB: postgres
	ports:
	- 5432:5432
	options: >-
	--health-cmd "pg_isready -U postgres"
	--health-interval 5s
	--health-timeout 5s
	--health-retries 10
	env:
	DATABASE_URL: postgres://postgres:testpass@localhost:5432/postgres
	steps:
	- uses: actions/checkout@v6
	- uses: dtolnay/rust-toolchain@stable
	- uses: Swatinem/rust-cache@v2
	- name: Install protobuf compiler
	run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
	- run: cargo test --workspace -- --test-threads=1

	# ── Build ─────────────────────────────────────────────────────────────────────
	# Release build for the whole workspace. Catches compile errors that only
	# surface with optimisations or release-profile codegen (e.g. dead-code elim).
	build:
	name: Build (release)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: dtolnay/rust-toolchain@stable
	- uses: Swatinem/rust-cache@v2
	- name: Install protobuf compiler
	run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
	- run: cargo build --release --workspace

	# ── Security audit ────────────────────────────────────────────────────────────
	# Checks all dependencies against the RustSec advisory database.
	audit:
	name: Security audit
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: rustsec/audit-check@v1
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	# RUSTSEC-2023-0071: timing side-channel in `rsa` crate (Marvin Attack).
	# Pulled in transitively via sqlx → sqlx-mysql → rsa. We do not use MySQL
	# or any RSA operations through sqlx-mysql; no patch is available upstream.
	ignore: RUSTSEC-2023-0071

	# ── Admin UI ──────────────────────────────────────────────────────────────────
	# Type-checks and builds the React + TypeScript SPA that is embedded into the
	# ferrox-cp binary at compile time via include_dir!.
	ui:
	name: UI build & type-check
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: actions/setup-node@v4
	with:
	node-version: "22"
	cache: npm
	cache-dependency-path: ferrox-cp/ui/package-lock.json
	- run: cd ferrox-cp/ui && npm ci
	- run: cd ferrox-cp/ui && npm run build

	# ── Config schema validation ──────────────────────────────────────────────────
	# Validates all committed YAML configs against the JSON Schema to catch
	# configuration mistakes before they reach a running instance.
	validate-config:
	name: Validate config schema
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: actions/setup-python@v5
	with:
	python-version: "3.12"
	- run: pip install check-jsonschema
	- run: check-jsonschema --schemafile ferrox/config.schema.json ferrox/config/*.yaml

	# ── Docker build — ferrox (gateway) ──────────────────────────────────────────
	# Builds the ferrox gateway Docker image to verify the Dockerfile is healthy.
	# Image is NOT pushed here; pushing only happens in release.yml on a
	# published GitHub release.
	docker:
	name: Docker build (ferrox)
	runs-on: ubuntu-latest
	needs: [fmt, clippy, test, build]
	steps:
	- uses: actions/checkout@v6
	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3
	- name: Build image (verify only — no push)
	uses: docker/build-push-action@v6
	with:
	context: .
	file: Dockerfile
	push: false
	tags: ghcr.io/${{ github.repository_owner }}/ferrox:ci
	cache-from: type=gha
	cache-to: type=gha,mode=max

	# ── Docker build — ferrox-cp (control plane) ─────────────────────────────────
	# Builds the ferrox-cp Docker image (including the Node.js UI build stage) to
	# verify the multi-stage Dockerfile is healthy.
	# Image is NOT pushed here; pushing only happens in release.yml on a
	# published GitHub release.
	docker-cp:
	name: Docker build (ferrox-cp)
	runs-on: ubuntu-latest
	needs: [fmt, clippy, test, build, ui]
	steps:
	- uses: actions/checkout@v6
	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3
	- name: Build image (verify only — no push)
	uses: docker/build-push-action@v6
	with:
	context: .
	file: ferrox-cp/Dockerfile
	push: false
	tags: ghcr.io/${{ github.repository_owner }}/ferrox-cp:ci
	cache-from: type=gha
	cache-to: type=gha,mode=max

Navigation Menu

Uh oh!

fix: restore main build — revert incompatible rand 0.10 bump (#66) (#78) #154

Workflow file

fix: restore main build — revert incompatible rand 0.10 bump (#66) (#78) #154

Uh oh!

Workflow file for this run