Next Release #524
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [develop, main] | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| # ─── Fast gates (fail early, save CI minutes) ─── | |
| fmt: | |
| name: fmt | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt | |
| - run: cargo fmt --all -- --check | |
| clippy: | |
| name: clippy | |
| needs: fmt | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo clippy --workspace --all-targets -- -D warnings | |
| # ─── Parallel gates (require code to compile) ─── | |
| test: | |
| name: test (${{ matrix.os }}) | |
| needs: clippy | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo test --workspace | |
| # Validates the fully-static musl binary shipped for old-glibc distros | |
| # (issue #330: the glibc binaries need symbols newer than Debian Bookworm's | |
| # glibc 2.36). Embeddings are dropped because `ort`/onnxruntime ships only | |
| # glibc prebuilt binaries and can't link statically against musl. | |
| musl: | |
| name: musl static build | |
| needs: clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: x86_64-unknown-linux-musl | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Install musl tools | |
| run: sudo apt-get update && sudo apt-get install -y musl-tools | |
| - name: Build static musl binary (no embeddings) | |
| # sqlite-vec.c uses BSD type names (u_int8_t/u_int16_t/u_int64_t) that | |
| # glibc provides but musl does not; map them to the standard names. | |
| env: | |
| CFLAGS_x86_64_unknown_linux_musl: "-Du_int8_t=uint8_t -Du_int16_t=uint16_t -Du_int32_t=uint32_t -Du_int64_t=uint64_t" | |
| run: >- | |
| cargo build --release --target x86_64-unknown-linux-musl -p icm-cli | |
| --no-default-features --features "backend-sqlite,tui,http-api" | |
| - name: Verify the binary is fully static | |
| run: | | |
| bin=target/x86_64-unknown-linux-musl/release/icm | |
| file "$bin" | |
| if ldd "$bin" 2>&1 | grep -Eq "statically linked|not a dynamic executable"; then | |
| echo "OK: statically linked — runs on any Linux regardless of glibc" | |
| else | |
| echo "FAIL: binary is dynamically linked"; ldd "$bin"; exit 1 | |
| fi | |
| security: | |
| name: security scan | |
| needs: clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit | |
| - name: Cargo Audit (CVE check) | |
| run: | | |
| echo "## Security Scan Results" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Dependency Vulnerabilities" >> $GITHUB_STEP_SUMMARY | |
| if cargo audit 2>&1 | tee audit.log; then | |
| echo "No known vulnerabilities detected" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "Vulnerabilities found:" >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| cat audit.log >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| echo "::warning::Dependency vulnerabilities detected — review required" | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| - name: New dependencies check | |
| run: | | |
| echo "### New Dependencies" >> $GITHUB_STEP_SUMMARY | |
| if git diff origin/${{ github.base_ref }}...HEAD -- '**/Cargo.toml' \ | |
| | grep -E "^\+.*=" | grep -v "^\+\+\+" > new_deps.txt; then | |
| echo "**New dependencies added:**" >> $GITHUB_STEP_SUMMARY | |
| echo '```toml' >> $GITHUB_STEP_SUMMARY | |
| cat new_deps.txt >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "**Required Actions:**" >> $GITHUB_STEP_SUMMARY | |
| echo "- [ ] Audit each new dependency on crates.io" >> $GITHUB_STEP_SUMMARY | |
| echo "- [ ] Verify maintainer reputation and download counts" >> $GITHUB_STEP_SUMMARY | |
| echo "- [ ] Check for typosquatting" >> $GITHUB_STEP_SUMMARY | |
| echo "::warning::New dependencies require supply-chain audit" | |
| else | |
| echo "No new dependencies added" >> $GITHUB_STEP_SUMMARY | |
| fi |