Refactor T.Flight input runtime: split poll loop into discovery, reports, diagnostics #1331

Workflow file for this run

.github/workflows/security.yml at 5dd339e

	name: Security & MSRV

	on:
	push:
	branches: [ main, develop ]
	pull_request:
	branches: [ main ]
	schedule:
	# Run security audit daily at 2 AM UTC
	- cron: '0 2 * * *'

	concurrency:
	group: ${{ github.workflow }}-${{ github.event_name == 'schedule' && github.run_id \|\| github.ref }}
	cancel-in-progress: ${{ github.event_name != 'schedule' }}

	env:
	CARGO_TERM_COLOR: always

	jobs:
	msrv-check:
	name: Minimum Supported Rust Version
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- uses: actions/checkout@v4

	- name: Install MSRV Rust
	uses: dtolnay/rust-toolchain@master
	with:
	toolchain: 1.92.0 # Flight Hub MSRV

	- name: Cache cargo registry
	uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/registry
	~/.cargo/git
	target
	key: msrv-${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

	- name: Install Linux HID build deps
	run: \|
	sudo apt-get update
	sudo apt-get install -y libudev-dev

	- name: Check MSRV compilation
	run: \|
	echo "🦀 Testing compilation with Rust 1.92.0 (MSRV)"
	cargo check --workspace --all-targets
	echo "✅ MSRV check passed"

	security-audit:
	name: Security Audit
	runs-on: ubuntu-latest
	timeout-minutes: 20
	steps:
	- uses: actions/checkout@v4

	- name: Install Rust
	uses: dtolnay/rust-toolchain@stable

	- name: Install cargo-audit
	run: cargo +stable install --locked cargo-audit

	- name: Install cargo-deny
	run: cargo +stable install --locked cargo-deny

	- name: Run security audit
	run: \|
	echo "🔒 Running security audit"
	if [ "${{ github.event_name }}" = "pull_request" ]; then
	cargo audit --deny warnings \|\| echo "::warning::Security audit reported issues (report-only on pull_request)."
	else
	cargo audit --deny warnings
	fi
	echo "✅ Security audit passed"

	- name: Run cargo-deny
	run: \|
	echo "🚫 Running cargo-deny checks"
	if [ "${{ github.event_name }}" = "pull_request" ]; then
	cargo deny check --hide-inclusion-graph \|\| echo "::warning::cargo-deny reported issues (report-only on pull_request)."
	else
	cargo deny check --hide-inclusion-graph
	fi
	echo "✅ Cargo-deny checks passed"

	license-check:
	name: License Compliance
	runs-on: ubuntu-latest
	timeout-minutes: 20
	steps:
	- uses: actions/checkout@v4

	- name: Install Rust
	uses: dtolnay/rust-toolchain@stable

	- name: Install cargo-deny
	run: cargo +stable install --locked cargo-deny

	- name: Check licenses
	run: \|
	echo "📄 Checking license compliance"
	if [ "${{ github.event_name }}" = "pull_request" ]; then
	cargo deny check licenses \|\| echo "::warning::License check reported issues (report-only on pull_request)."
	else
	cargo deny check licenses
	fi
	echo "✅ License check passed"

	- name: Generate license report
	run: \|
	echo "📋 Generating license report"
	cargo deny list --format json > licenses.json

	echo "## 📄 License Report" >> $GITHUB_STEP_SUMMARY
	echo "\| Crate \| License \| Version \|" >> $GITHUB_STEP_SUMMARY
	echo "\|-------\|---------\|---------\|" >> $GITHUB_STEP_SUMMARY

	# Parse JSON and create markdown table (simplified)
	echo "License report generated in licenses.json"

	supply-chain:
	name: Supply Chain Security
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- uses: actions/checkout@v4

	- name: Install Rust
	uses: dtolnay/rust-toolchain@stable

	- name: Install nightly for scripts (no default switch)
	run: rustup toolchain install nightly --profile minimal --no-self-update

	- name: Install audit tools
	run: \|
	echo "🛠️ Installing supply chain audit tools"
	cargo +stable install --locked cargo-audit cargo-deny cargo-license
	echo "✅ Audit tools installed"

	- name: Run comprehensive supply chain audit
	run: \|
	echo "🔍 Running comprehensive supply chain audit"
	if [ "${{ github.event_name }}" = "pull_request" ]; then
	cargo +nightly -Zscript scripts/supply_chain_audit.rs \|\| echo "::warning::Supply-chain audit script reported issues (report-only on pull_request)."
	else
	cargo +nightly -Zscript scripts/supply_chain_audit.rs
	fi
	echo "✅ Supply chain audit completed"

	- name: Upload audit artifacts
	uses: actions/upload-artifact@v4
	if: always()
	with:
	name: supply-chain-audit-${{ github.sha }}
	path: \|
	SUPPLY_CHAIN_AUDIT.md
	THIRD_PARTY_LICENSES.md
	spdx/
	retention-days: 30

	- name: Check for banned crates
	run: \|
	echo "🔍 Checking for banned/vulnerable crates"
	if [ "${{ github.event_name }}" = "pull_request" ]; then
	cargo deny check bans \|\| echo "::warning::Banned crate check reported issues (report-only on pull_request)."
	else
	cargo deny check bans
	fi
	echo "✅ Supply chain check passed"

	- name: Check for duplicate dependencies
	run: \|
	echo "🔍 Checking for duplicate dependencies"
	cargo tree --duplicates
	echo "ℹ️ Duplicate dependency check completed"

	- name: Validate SPDX documents
	run: \|
	echo "📋 Validating SPDX documents"
	if [ -d "spdx" ]; then
	for spdx_file in spdx/*.spdx; do
	if [ -f "$spdx_file" ]; then
	echo " Validating $(basename "$spdx_file")"
	# Basic SPDX validation - check required fields
	if grep -q "SPDXVersion:" "$spdx_file" && \
	grep -q "DataLicense:" "$spdx_file" && \
	grep -q "PackageName:" "$spdx_file"; then
	echo " ✅ $(basename "$spdx_file") is valid"
	else
	echo " ❌ $(basename "$spdx_file") is invalid"
	exit 1
	fi
	fi
	done
	fi
	echo "✅ SPDX validation completed"

	semver-check:
	name: Semantic Versioning
	runs-on: ubuntu-latest
	timeout-minutes: 20
	if: github.event_name == 'pull_request'
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0 # Need full history for semver check

	- name: Install Rust
	uses: dtolnay/rust-toolchain@stable

	- name: Install cargo-semver-checks
	run: cargo +stable install --locked cargo-semver-checks

	- name: Check semantic versioning
	run: \|
	echo "📦 Checking semantic versioning compliance"
	# Check each public crate for breaking changes
	for crate in flight-core flight-scheduler flight-virtual; do
	echo "Checking $crate..."
	cargo semver-checks check-release --package $crate \|\| echo "⚠️ Breaking changes detected in $crate"
	done
	echo "✅ Semver check completed"

	dependency-review:
	name: Dependency Review
	runs-on: ubuntu-latest
	timeout-minutes: 10
	if: github.event_name == 'pull_request'
	steps:
	- name: Dependency Review
	id: dependency_review
	continue-on-error: true
	uses: actions/dependency-review-action@v4
	with:
	fail-on-severity: moderate
	allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC

	- name: Note unavailable dependency review
	if: steps.dependency_review.outcome != 'success'
	run: echo "::warning::Dependency review is unavailable for this repository configuration."

	supply-chain-gate:
	name: Supply Chain Security Gate
	runs-on: ubuntu-latest
	timeout-minutes: 30
	needs: [security-audit, license-check, supply-chain]
	steps:
	- uses: actions/checkout@v4

	- name: Install Rust
	uses: dtolnay/rust-toolchain@stable
	with:
	components: clippy

	- name: Install nightly for scripts (no default switch)
	run: rustup toolchain install nightly --profile minimal --no-self-update

	- name: Install audit tools
	run: \|
	cargo +stable install --locked cargo-audit cargo-deny cargo-license

	- name: Run CI Supply Chain Security Gate
	run: \|
	echo "🚪 Running CI Supply Chain Security Gate"
	if [ "${{ github.event_name }}" = "pull_request" ]; then
	cargo +nightly -Zscript scripts/ci_supply_chain_gate.rs \|\| echo "::warning::Supply-chain security gate reported issues (report-only on pull_request)."
	else
	cargo +nightly -Zscript scripts/ci_supply_chain_gate.rs
	fi
	echo "✅ All supply chain security gates passed"

	- name: Upload gate results
	uses: actions/upload-artifact@v4
	if: always()
	with:
	name: supply-chain-gate-results-${{ github.sha }}
	path: \|
	SUPPLY_CHAIN_AUDIT.md
	THIRD_PARTY_LICENSES.md
	spdx/
	retention-days: 90

Navigation Menu

Uh oh!

Refactor T.Flight input runtime: split poll loop into discovery, reports, diagnostics #1331

Workflow file

Refactor T.Flight input runtime: split poll loop into discovery, reports, diagnostics #1331

Uh oh!

Workflow file for this run