From 639a6a28a54e12a303d15a9aea9902ef4b56fa6d Mon Sep 17 00:00:00 2001 From: BeaCox Date: Sun, 30 Aug 2026 16:53:07 +0800 Subject: [PATCH] ci: harden and restore native validation --- .github/dependabot.yml | 10 +++ .github/workflows/ci.yml | 111 ++++++++++++++++++++++++++++------ .github/workflows/release.yml | 22 +++---- 3 files changed, 113 insertions(+), 30 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..8f2ceac --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,10 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + groups: + github-actions: + patterns: + - "*" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4e32aa9..7c92f59 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,51 +16,93 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} env: - CARGO_PROFILE_DEV_DEBUG: 0 - CARGO_PROFILE_TEST_DEBUG: 0 + CARGO_INCREMENTAL: "0" + CARGO_PROFILE_DEV_DEBUG: "0" + CARGO_PROFILE_TEST_DEBUG: "0" CARGO_TERM_COLOR: always + RUST_BACKTRACE: "1" jobs: quality: + # This name is a required status check on main. Keep it stable. name: Quality and Linux smoke test runs-on: ubuntu-22.04 timeout-minutes: 30 steps: - - uses: actions/checkout@v7 + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false + - name: Install Linux application dependencies run: | sudo apt-get update sudo apt-get install -y \ build-essential \ + dbus-x11 \ + gnome-keyring \ libayatana-appindicator3-dev \ librsvg2-dev \ libssl-dev \ libwebkit2gtk-4.1-dev \ libxdo-dev \ xvfb - - uses: pnpm/action-setup@v6 + + - name: Set up pnpm + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 with: version: 11.3.0 - - uses: actions/setup-node@v7 + + - name: Set up Node.js + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: pnpm - - uses: dtolnay/rust-toolchain@stable + + - name: Set up Rust + uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable with: components: rustfmt, clippy - - uses: Swatinem/rust-cache@v2 + + - name: Restore Rust cache + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: - shared-key: ci-linux - - run: make setup - - run: make check + shared-key: ci-linux-x64 + save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} + + - name: Fetch locked Rust dependencies + run: cargo fetch --locked + + - name: Install locked frontend dependencies + run: pnpm install --frozen-lockfile + + - name: Run the complete quality gate + run: make check + + - name: Verify Linux Secret Service backup and restore + run: | + mkdir -p \ + "$RUNNER_TEMP/cleanerx-keyring/data" \ + "$RUNNER_TEMP/cleanerx-keyring/config" \ + "$RUNNER_TEMP/cleanerx-keyring/runtime" + chmod 700 "$RUNNER_TEMP/cleanerx-keyring/runtime" + dbus-run-session -- bash -euo pipefail -c ' + export XDG_DATA_HOME="$1/data" + export XDG_CONFIG_HOME="$1/config" + export XDG_RUNTIME_DIR="$1/runtime" + eval "$(printf "\n" | gnome-keyring-daemon --unlock --components=secrets)" + CLEANERX_LINUX_SECRET_SERVICE_TEST=1 \ + cargo test --workspace --locked live_linux_secret_service_backup_round_trip -- --ignored + ' _ "$RUNNER_TEMP/cleanerx-keyring" + - name: Build Linux debug application - run: cargo build -p cleanerx-app + run: cargo build --locked -p cleanerx-app + - name: Smoke-test Linux application run: make smoke-linux LINUX_PROFILE=debug platform: + # The macOS and Windows x64 names are required status checks on main. name: ${{ matrix.name }} tests strategy: fail-fast: false @@ -69,21 +111,27 @@ jobs: - name: macOS runner: macos-15 platform: macos + credential_test: false - name: Linux ARM64 runner: ubuntu-22.04-arm platform: linux + credential_test: false - name: Windows runner: windows-2025 platform: windows + credential_test: true - name: Windows ARM64 runner: windows-11-vs2026-arm platform: windows + credential_test: false runs-on: ${{ matrix.runner }} timeout-minutes: 30 steps: - - uses: actions/checkout@v7 + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false + - name: Install Linux application dependencies if: matrix.platform == 'linux' run: | @@ -96,28 +144,53 @@ jobs: libwebkit2gtk-4.1-dev \ libxdo-dev \ xvfb - - uses: pnpm/action-setup@v6 + + - name: Set up pnpm + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 with: version: 11.3.0 - - uses: actions/setup-node@v7 + + - name: Set up Node.js + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: pnpm - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@v2 + + - name: Set up Rust + uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable + + - name: Restore Rust cache + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: shared-key: ci-${{ runner.os }}-${{ runner.arch }} - - run: pnpm install --frozen-lockfile + save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} + + - name: Fetch locked Rust dependencies + run: cargo fetch --locked + + - name: Install locked frontend dependencies + run: pnpm install --frozen-lockfile + - name: Build frontend assets run: pnpm build + - name: Test Rust workspace - run: cargo test --workspace + run: cargo test --workspace --locked + + - name: Verify Windows Credential Manager backup and restore + if: matrix.credential_test + env: + CLEANERX_WINDOWS_CREDENTIAL_MANAGER_TEST: "1" + run: cargo test --workspace --locked live_windows_credential_manager_backup_round_trip -- --ignored + - name: Build desktop application - run: cargo build -p cleanerx-app + run: cargo build --locked -p cleanerx-app + - name: Smoke-test Windows application if: matrix.platform == 'windows' shell: pwsh run: ./scripts/smoke-windows.ps1 -Profile debug + - name: Smoke-test Linux application if: matrix.platform == 'linux' run: make smoke-linux LINUX_PROFILE=debug diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 977b425..a96e7dd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,11 +21,11 @@ jobs: outputs: version: ${{ steps.version.outputs.version }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - name: Require a SemVer tag from main env: RELEASE_TAG: ${{ github.ref_name }} @@ -119,7 +119,7 @@ jobs: runs-on: ${{ matrix.os }} timeout-minutes: 40 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install Linux bundle dependencies @@ -140,20 +140,20 @@ jobs: if: matrix.platform == 'windows' && matrix.arch == 'arm64' shell: pwsh run: choco install make --no-progress -y - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 with: version: 11.3.0 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: pnpm - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable if: matrix.target == '' - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable if: matrix.target != '' with: targets: ${{ matrix.target }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: shared-key: release-${{ matrix.platform }}-${{ matrix.arch }} - run: pnpm install --frozen-lockfile @@ -313,7 +313,7 @@ jobs: echo "node=$(node --version)" echo "pnpm=$(pnpm --version)" } > "release-assets/CleanerX-${RELEASE_VERSION}-${RELEASE_PLATFORM}-${RELEASE_ARCH}.txt" - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: release-${{ matrix.platform }}-${{ matrix.arch }} path: release-assets/* @@ -327,10 +327,10 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/download-artifact@v7 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: release-* path: release-assets