fix(gl): pin secret-file modes at creation instead of chmod after (#354) #1478

Workflow file for this run

.github/workflows/pr-checks.yml at f0d93fd

	name: PR Checks

	on:
	pull_request:
	# Run in the merge queue so a PR is re-validated against the true merged
	# result before it lands. Guards against semantic merge races where two
	# individually-green PRs break main in combination (#113 + #145 → #229).
	merge_group:
	# Release-branch heads are created and pushed by GITHUB_TOKEN (release-please
	# and the lock-sync job), and GitHub's recursion guard means those pushes
	# trigger no workflow runs. workflow_dispatch is the documented carve-out that
	# GITHUB_TOKEN CAN trigger, so the release flow dispatches this workflow at
	# the release branch to attach check runs to its head. Read-only workflow
	# (contents: read), so the dispatch surface adds no privilege.
	workflow_dispatch:
	push:
	branches:
	- main

	permissions:
	contents: read

	# Cancel superseded runs on the same PR/branch; never cancel runs on main.
	concurrency:
	group: pr-checks-${{ github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	env:
	CARGO_TERM_COLOR: always
	RUST_BACKTRACE: 1

	jobs:
	fmt-clippy:
	name: fmt + clippy
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust toolchain
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
	with:
	toolchain: stable
	components: rustfmt, clippy

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0

	- name: cargo fmt --check
	run: cargo fmt --all -- --check

	- name: cargo clippy
	run: cargo clippy --locked --workspace --all-targets -- -D warnings

	release-tag-validation:
	name: release tag validation
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Test release tag resolver
	run: scripts/test-resolve-release-tag.sh

	test:
	name: test (${{ matrix.toolchain }})
	runs-on: ubuntu-latest
	timeout-minutes: 45
	strategy:
	fail-fast: false
	matrix:
	toolchain: [stable, beta]
	# Beta is informational: an upstream beta regression should warn, not block merges.
	continue-on-error: ${{ matrix.toolchain == 'beta' }}
	# Postgres for the DB-backed integration tests (#[sqlx::test] provisions an
	# isolated database per test off this connection). The health-check gate keeps
	# `cargo test` from racing a not-yet-ready server.
	services:
	postgres:
	image: postgres:16
	env:
	POSTGRES_USER: postgres
	POSTGRES_PASSWORD: postgres
	POSTGRES_DB: gitlawb_test
	ports:
	- 5432:5432
	options: >-
	--health-cmd pg_isready
	--health-interval 10s
	--health-timeout 5s
	--health-retries 5
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust toolchain
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
	with:
	toolchain: ${{ matrix.toolchain }}

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
	with:
	key: ${{ matrix.toolchain }}

	- name: cargo test
	env:
	DATABASE_URL: postgres://postgres:postgres@localhost:5432/gitlawb_test
	run: cargo test --locked --workspace

	build-release:
	name: build --release
	runs-on: ubuntu-latest
	timeout-minutes: 45
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust toolchain
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
	with:
	toolchain: stable

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
	with:
	key: release

	- name: cargo build --release
	run: cargo build --locked --release --workspace

	audit:
	name: cargo audit
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust toolchain
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
	with:
	toolchain: stable

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
	with:
	key: audit-0.22.2

	- name: Install cargo-audit (pinned)
	# Pin the scanner on this BLOCKING gate: an unpinned `cargo install`
	# floats to the latest release, so a regressed cargo-audit could red CI
	# repo-wide with no code change. Advisory-DB freshness is fetched at scan
	# time, independent of the binary, so this does not weaken what the gate
	# catches. The weekly Scheduled Audit (audit-schedule.yml) deliberately
	# floats to latest as the drift canary; when it shows a newer cargo-audit
	# behaving differently, bump this version (and the cache key above) as a
	# deliberate maintainer action. If 0.22.2 is ever yanked from crates.io
	# this step fails loud until the pin is bumped.
	run: \|
	set -euo pipefail
	cargo install --locked --version 0.22.2 cargo-audit
	# Assert the pin took effect so an accidental future unpin (or a drift
	# off 0.22.2) fails loudly here instead of silently running a different
	# scanner. `cargo audit --version` prints "cargo-audit-audit 0.22.2".
	installed="$(cargo audit --version)"
	echo "cargo-audit installed: $installed"
	echo "$installed" \| grep -qE '(^\| )0\.22\.2($\| )' \|\| {
	echo "::error::cargo-audit is not the pinned 0.22.2 (got: $installed)"
	exit 1
	}

	# Hard-fail gate. Suppressions live in .cargo/audit.toml (read automatically
	# from the repo root), each with no available upstream fix. A green check
	# here means "no NEW advisories", not "advisory-clean": surface the active
	# ignore list so a reviewer sees exactly what is being accepted.
	- name: Show active audit ignores
	run: \|
	{
	echo '### cargo audit: accepted advisories (.cargo/audit.toml)'
	echo '```toml'
	sed -n '/^\[advisories\]/,$p' .cargo/audit.toml
	echo '```'
	} >> "$GITHUB_STEP_SUMMARY"

	- name: cargo audit
	run: cargo audit

	msrv:
	name: MSRV (Rust 1.91)
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust 1.91
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # 1.91
	with:
	toolchain: "1.91"

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
	with:
	key: msrv

	- name: cargo check on MSRV
	run: cargo check --locked --workspace --all-targets

	docker-build:
	name: Docker build smoke test
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Build image
	run: docker build -t gitlawb-node:ci-test .

	- name: Smoke test --version
	run: docker run --rm gitlawb-node:ci-test --version

	test-windows:
	name: test (windows, non-blocking)
	runs-on: windows-latest
	timeout-minutes: 45
	# Non-blocking, mirroring the informational `beta` lane above. We ship `gl`
	# and `git-remote-gitlawb` to Windows users (release.yml) with zero Windows
	# test coverage, so run their suites here to make Windows-only regressions
	# VISIBLE on the PR without gating merge (#228). These two are the client
	# CLIs and depend on no database, so no Postgres service is needed (service
	# containers do not run on windows-latest regardless). `git` is preinstalled
	# on windows-latest, which the real_git_fetch harness relies on.
	continue-on-error: true
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust toolchain
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
	with:
	toolchain: stable

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
	with:
	key: windows

	- name: cargo test (shipped Windows crates)
	run: cargo test --locked -p gl -p git-remote-gitlawb

	# gitlawb-core is embedded by every consumer (gl, git-remote-gitlawb, the node
	# daemon), so it must stay lean. This gate fails if gitlawb-core's normal
	# (non-dev, non-build) dependency tree gains any crate not on the allowlist in
	# ci/gitlawb-core-allowed-deps.txt. Exhaustive-by-construction: a new heavy
	# dependency reds CI whether or not anyone thought to ban it, which a denylist
	# cannot do. Regen instructions live in the allowlist header.
	core-deps-purity:
	name: gitlawb-core dependency purity
	runs-on: ubuntu-latest
	timeout-minutes: 15
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust toolchain
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
	with:
	toolchain: stable

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
	with:
	key: core-deps-purity

	- name: Check gitlawb-core dependency allowlist
	run: bash scripts/check-gitlawb-core-deps.sh

	# release-please only rewrites a crate's version when the line carries the
	# `# x-release-please-version` annotation AND the manifest is listed under
	# extra-files in release-please-config.json. Miss either half and the crate
	# is skipped silently at release time, freezing at its creation version:
	# icaptcha-client was added as a workspace member after the config was last
	# written and sat at 0.4.0 through four releases before anyone noticed.
	# Exhaustive-by-construction, like the allowlist gate above: the required set
	# is derived from `cargo metadata`, so a newly added crate reds CI whether or
	# not its author knew this gate existed.
	release-versioning:
	name: release versioning coverage
	runs-on: ubuntu-latest
	timeout-minutes: 15
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust toolchain
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
	with:
	toolchain: stable

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
	with:
	key: release-versioning

	- name: Check every workspace crate is release-managed
	run: bash scripts/check-release-versioning.sh

Navigation Menu

fix(gl): pin secret-file modes at creation instead of chmod after (#354) #1478

Workflow file

fix(gl): pin secret-file modes at creation instead of chmod after (#354) #1478

Uh oh!

Workflow file for this run