81 lines
2.7 KiB
YAML
81 lines
2.7 KiB
YAML
default:
|
|
image: rust:1.97
|
|
cache:
|
|
key:
|
|
files:
|
|
- Cargo.lock
|
|
paths:
|
|
# no .cargo/bin here: the audit job runs what is in it, and this cache is
|
|
# shared by every branch and merge request, so a pipeline could otherwise
|
|
# leave behind the binary a later scheduled audit executes
|
|
- .cargo/registry
|
|
- target
|
|
|
|
variables:
|
|
# keep the registry inside the project so it lands in the cache
|
|
CARGO_HOME: $CI_PROJECT_DIR/.cargo
|
|
CARGO_TERM_COLOR: always
|
|
# pinned, rather than whatever version exists on the night this runs
|
|
CARGO_AUDIT_VERSION: "0.21.2"
|
|
|
|
# without this a push to a branch with an open merge request runs twice
|
|
workflow:
|
|
rules:
|
|
# first, because a scheduled pipeline sets CI_COMMIT_BRANCH as well and so
|
|
# would be matched by the branch rule below, or vetoed by the one above it
|
|
- if: $CI_PIPELINE_SOURCE == "schedule"
|
|
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
|
- if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
|
|
when: never
|
|
- if: $CI_COMMIT_BRANCH
|
|
|
|
check:
|
|
script:
|
|
- rustup component add rustfmt clippy
|
|
- cargo fmt --check
|
|
# --locked on the first cargo invocation too: without it clippy resolves the
|
|
# dependencies and rewrites a Cargo.lock that has drifted from Cargo.toml,
|
|
# and the --locked commands after it then pass against what it just wrote
|
|
- cargo clippy --locked --all-targets -- -D warnings
|
|
- cargo test --locked
|
|
- cargo build --release --locked
|
|
rules:
|
|
- if: $CI_PIPELINE_SOURCE == "schedule"
|
|
when: never
|
|
- when: always
|
|
|
|
# runs only from a pipeline schedule, so set one up in the project settings
|
|
audit:
|
|
script:
|
|
- cargo install cargo-audit --version $CARGO_AUDIT_VERSION --locked
|
|
- cargo audit
|
|
# reports dependencies that have drifted behind, without changing the lockfile
|
|
- cargo update --dry-run
|
|
# its own cache, so the audit tool is not rebuilt on every schedule while
|
|
# still being written only by this schedule-only job. the pinned version is
|
|
# part of the key, so a bump fetches rather than reusing the old binary
|
|
cache:
|
|
key: audit-tools-$CARGO_AUDIT_VERSION
|
|
paths:
|
|
- .cargo/bin
|
|
- .cargo/registry
|
|
rules:
|
|
- if: $CI_PIPELINE_SOURCE == "schedule"
|
|
|
|
# the msrv declared in Cargo.toml, so it fails when something needs a newer rustc
|
|
msrv:
|
|
image: rust:1.85
|
|
script:
|
|
- cargo build --locked
|
|
# its own key: artifacts built by another rustc are of no use to this job, and
|
|
# sharing one only has the two toolchains taking turns overwriting it
|
|
cache:
|
|
key: msrv-$CI_COMMIT_REF_SLUG
|
|
paths:
|
|
- .cargo/registry
|
|
- target
|
|
rules:
|
|
- if: $CI_PIPELINE_SOURCE == "schedule"
|
|
when: never
|
|
- when: always
|