From 48d9b081c2195ff2b8a72f2d7738f478a2139df9 Mon Sep 17 00:00:00 2001 From: Aleksandr Slokov Date: Wed, 2 Sep 2026 01:07:44 +0700 Subject: [PATCH] fix(ci): correct the declared MSRV and the licence policy The workspace declared rust-version 1.85 but ratatui 0.30 requires 1.88, so the MSRV job could never pass. deny.toml's permissive allow-list also rejected the project's own GPL-3.0-or-later crates. Add a make msrv target that reads the value straight from the manifest, so the local gate can catch this instead of leaving it to CI. Closes OXD-005 --- .github/workflows/ci.yml | 2 +- BACKLOG.md | 45 ++++++++++++++++++++++++++++++++-- CHANGELOG.md | 29 +++++++++++++++++++--- Cargo.toml | 4 ++- Makefile | 23 +++++++++++++---- README.md | 2 +- deny.toml | 7 ++++++ docs/informations/proposals.md | 6 +++++ 8 files changed, 105 insertions(+), 13 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a761c0c..9bab476 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -65,7 +65,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: dtolnay/rust-toolchain@1.85.0 + - uses: dtolnay/rust-toolchain@1.88.0 - uses: Swatinem/rust-cache@v2 - run: cargo build --workspace diff --git a/BACKLOG.md b/BACKLOG.md index d76d593..2d248e0 100644 --- a/BACKLOG.md +++ b/BACKLOG.md @@ -95,6 +95,11 @@ Known gaps carried forward, all deliberate and tracked: unimplemented in the status bar rather than failing silently - `-` (stdin) falls back to `--dump`: the TUI cannot read keys while stdin is a pipe. Proper support needs OXD-047 +- **CI is red on `main`.** The MSRV and licence jobs have failed since before the v0.1.0 tag: + the declared MSRV of 1.85 is impossible (ratatui 0.30 needs 1.88) and `deny.toml` rejects the + project's own GPL crates. `make check` detects neither. Diagnosed in **OXD-005** / issue + [#4](https://github.com/AlexanderSlokov/oxidiris/issues/4), scheduled for v0.2.0 because + raising the MSRV is a compatibility change --- @@ -106,6 +111,7 @@ Known gaps carried forward, all deliberate and tracked: | OXD-002 | Metadata & MSRV | 0 | S | OXD-001 | ✅ Done | | OXD-003 | CI baseline | 0 | M | OXD-001 | ✅ Done | | OXD-004 | `testdata/` corpus | 0 | S | OXD-001 | ✅ Done | +| OXD-005 | Correct MSRV & licence policy ([#4](https://github.com/AlexanderSlokov/oxidiris/issues/4)) | 0 | S | OXD-002, OXD-003 | ⬜ Todo | | OXD-010 | Token & Document data types | 1 | M | OXD-001 | ✅ Done | | OXD-011 | Unicode Segmenter | 1 | M | OXD-010 | ✅ Done | | OXD-012 | ORP Algorithm | 1 | M | OXD-011 | ✅ Done | @@ -130,7 +136,7 @@ Known gaps carried forward, all deliberate and tracked: | OXD-034 | Review Mode | 3 | M | OXD-031 | ⬜ Todo | | OXD-035 | Ramp-up on resume | 3 | S | OXD-018 | ⬜ Todo | | OXD-036 | TUI Snapshot test | 3 | M | OXD-023 | ⬜ Todo | -| OXD-037 | Milestone v0.2 | 3 | S | OXD-030…036 | ⬜ Todo | +| OXD-037 | Milestone v0.2 | 3 | S | OXD-005, OXD-030…036 | ⬜ Todo | | OXD-040 | Theme system | 4 | M | OXD-022 | ⬜ Todo | | OXD-041 | TOML config file | 4 | M | OXD-020 | ⬜ Todo | | OXD-042 | Custom keybindings | 4 | M | OXD-030, OXD-041 | ⬜ Todo | @@ -194,7 +200,7 @@ Acceptance Phase 0 · Depends OXD-001 · Crate repo · Spec §1.2, §9.4 · Size S · Parallel-safe Scope -- Add to `[workspace.package]`: `license`, `repository`, `readme`, `keywords`, `categories`, `authors`, `rust-version = "1.85"`. +- Add to `[workspace.package]`: `license`, `repository`, `readme`, `keywords`, `categories`, `authors`, `rust-version`. Edition 2024 needs 1.85, but ratatui 0.30 pulls the real floor up to `1.88` — the declared value must match what CI's MSRV job builds with. - Create `rust-toolchain.toml` to pin the version. - Document MSRV in README. @@ -255,6 +261,41 @@ Acceptance --- +### OXD-005 · Correct the declared MSRV and the licence policy + +Phase 0 · Depends OXD-002, OXD-003 · Blocks OXD-037 · Crate repo · Spec §9.3, §9.4 · Size S +· Issue [#4](https://github.com/AlexanderSlokov/oxidiris/issues/4) + +Two CI jobs have failed on `main` since before the v0.1.0 tag. Full diagnosis is in issue #4; +the summary is that both are defects in project metadata, and `make check` cannot detect either. + +The MSRV bump changes the project's compatibility promise, so this ships in **v0.2.0**, not as a +patch to v0.1.0. v0.1.0 remains tagged as released, with the incorrect claim recorded under its +known limitations in `CHANGELOG.md`. + +Scope +- `rust-version = "1.88"` in `[workspace.package]`. Edition 2024 only needs 1.85, but `ratatui` + 0.30 and its tree (`darling`, `instability`, `time`) require 1.88, so the workspace has never + built on the declared value. +- Pin the CI MSRV job to the same version, and state 1.88 in README, CHANGELOG and spec §9.4. +- `deny.toml`: grant `GPL-3.0-or-later` to `oxidiris` and `oxidiris-core` through `exceptions`. + cargo-deny evaluates workspace members, so the permissive-only allow-list currently rejects the + project's own crates. The dependency allow-list itself must stay permissive-only. +- Add a `make msrv` target that builds on the declared MSRV, reading the value out of the manifest + so the two cannot drift. Add `msrv` and `audit` to `make ci`. +- Correct the Makefile header, which claims a green `make check` means a green pipeline. It does + not: `make check` runs on whatever toolchain is active and never invokes `cargo deny`. + +Acceptance +- [ ] `cargo +1.88 build --workspace` succeeds +- [ ] `make msrv` fails with a clear message when the MSRV toolchain is not installed +- [ ] `cargo deny check` reports `licenses ok` +- [ ] Adding a GPL dependency still fails the licence check (manually verified) +- [ ] No file declares or promises 1.85 any more (explaining why it was wrong is fine) +- [ ] All 6 CI jobs green on `main` + +--- + # B. Phase 1 — Core Engine (`oxidiris-core`) > This entire phase contains zero TUI lines. This part is reused for wasm in Phase 8. diff --git a/CHANGELOG.md b/CHANGELOG.md index c654621..10a7a6a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,8 +8,27 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). While the ## [Unreleased] -Nothing yet. Next up is Phase 3 (`OXD-030`…`OXD-037`): modal keymap, full-text panel, outline -sidebar and Review Mode. See [`BACKLOG.md`](BACKLOG.md). +Next up is Phase 3 (`OXD-030`…`OXD-037`): modal keymap, full-text panel, outline sidebar and +Review Mode. See [`BACKLOG.md`](BACKLOG.md). + +### Changed + +- **Minimum supported Rust version raised from 1.85 to 1.88.** Edition 2024 only needs 1.85, but + `ratatui` 0.30 and its dependency tree require 1.88, so the workspace never actually built on + the version v0.1.0 declared. Raising it changes the compatibility promise, which is why it + lands in a minor release rather than a patch. `OXD-005`, issue + [#4](https://github.com/AlexanderSlokov/oxidiris/issues/4). + +### Fixed + +- `cargo-deny` no longer rejects the project's own crates. The licence allow-list is meant to keep + *dependencies* permissive, but cargo-deny evaluates workspace members too, so `oxidiris` and + `oxidiris-core` failed their own GPL-3.0-or-later policy. They are now explicit exceptions. +- `make ci` gained the MSRV build and the licence audit, and a new `make msrv` target builds on + the declared minimum, reading the version out of the manifest so the two cannot drift. The + Makefile no longer claims that a green `make check` implies a green pipeline: it runs on + whatever toolchain is active and never invoked `cargo deny`, which is exactly how both defects + above reached a tagged release. ## [0.1.0] - 2026-09-01 @@ -64,11 +83,12 @@ Phases 0-2 of the backlog (`OXD-001`…`OXD-027`). **Repository** -- Cargo workspace, edition 2024, MSRV 1.85. +- Cargo workspace, edition 2024, MSRV declared as 1.85. - 175 tests: engine unit tests, terminal rendering tests against `TestBackend`, a fixture corpus, and property tests asserting the ORP invariants hold for arbitrary Unicode input. - CI with six jobs, including a Windows target and a `wasm32-unknown-unknown` build that enforces the architectural rule that `oxidiris-core` never depends on a terminal crate. +- `cargo-deny` policy requiring permissive licences on dependencies. - `Makefile` with a self-documenting target list; `make check` is the Definition of Done gate. - `BACKLOG.md`: 56 tasks across 9 phases, each with machine-verifiable acceptance criteria. - Design spec in `docs/informations/proposals.md` and decision records in `docs/decisions/`. @@ -82,6 +102,9 @@ Phases 0-2 of the backlog (`OXD-001`…`OXD-027`). a pipe. Proper support needs `OXD-047`. - RSVP removes the backward eye movements that repair a misparse, which costs comprehension on dense material. The tool is built for skim and triage, not for careful reading. +- **The declared MSRV of 1.85 is wrong.** The dependency tree requires 1.88, so this release does + not build on the version it advertises. Use 1.88 or newer. Corrected in the next release; see + issue [#4](https://github.com/AlexanderSlokov/oxidiris/issues/4). [Unreleased]: https://github.com/AlexanderSlokov/oxidiris/compare/v0.1.0...HEAD [0.1.0]: https://github.com/AlexanderSlokov/oxidiris/releases/tag/v0.1.0 \ No newline at end of file diff --git a/Cargo.toml b/Cargo.toml index 2f5d23a..d8672e0 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -5,7 +5,9 @@ resolver = "3" [workspace.package] version = "0.1.0" edition = "2024" -rust-version = "1.85" +# Edition 2024 itself only needs 1.85, but ratatui 0.30 and its dependency tree require 1.88. +# Keep this in sync with the MSRV job in .github/workflows/ci.yml. +rust-version = "1.88" authors = ["Aleksandr Slokov"] repository = "https://github.com/AlexanderSlokov/oxidiris" readme = "README.md" diff --git a/Makefile b/Makefile index bc70fe7..0a7b2d7 100644 --- a/Makefile +++ b/Makefile @@ -1,16 +1,21 @@ # Oxidiris developer commands. # -# Run `make` with no target for the list. Every target here is also what CI runs, so a green -# `make check` locally means a green pipeline. +# Run `make` with no target for the list. +# +# `make check` is the Definition of Done gate, but it runs on whatever toolchain you have active. +# It therefore cannot catch an MSRV or licence regression on its own — `make ci` adds those. See +# the note on `msrv` below. FILE ?= BACKLOG.md WPM ?= 300 CORE := oxidiris-core BIN := oxidiris +# Read from the manifest so the two can never drift apart. +MSRV := $(shell grep -m1 '^rust-version' Cargo.toml | cut -d'"' -f2) .DEFAULT_GOAL := help .PHONY: help build release run demo dump frame test test-core test-tui fmt fmt-check lint \ - check wasm doc doc-open bench audit clean install tree ci + check wasm msrv doc doc-open bench audit clean install tree ci ## help: list the available targets help: @@ -78,12 +83,20 @@ lint: wasm: cargo build -p $(CORE) --target wasm32-unknown-unknown +## msrv: build with the declared minimum Rust version, the way CI does +# v0.1.0 shipped claiming MSRV 1.85 while ratatui 0.30 needed 1.88: the default toolchain hid it +# and only CI caught it. Run this before touching dependencies. +msrv: + @rustup toolchain list | grep -q '^$(MSRV)' || \ + { echo "Rust $(MSRV) not installed. Run: rustup toolchain install $(MSRV)"; exit 1; } + cargo +$(MSRV) build --workspace + ## check: the Definition of Done gate — fmt, lint, test, wasm check: fmt-check lint test wasm @echo "OK — Definition of Done satisfied" -## ci: everything check does, plus docs -ci: check doc +## ci: everything check does, plus docs, MSRV and the licence audit +ci: check doc msrv audit @echo "OK — full pipeline" # --- inspection ------------------------------------------------------------- diff --git a/README.md b/README.md index a931c8d..3d55546 100644 --- a/README.md +++ b/README.md @@ -41,7 +41,7 @@ paper carefully, and it does not advertise a WPM number as an achievement. cargo install --path crates/oxidiris ``` -Requires Rust 1.85 or newer. +Requires Rust 1.88 or newer. ## Use diff --git a/deny.toml b/deny.toml index 938bf10..e8686c5 100644 --- a/deny.toml +++ b/deny.toml @@ -25,6 +25,13 @@ allow = [ ] confidence-threshold = 0.9 +# The allow list above governs *dependencies*, which must stay permissive. Oxidiris' own crates +# are copyleft and would otherwise be rejected by their own policy. +exceptions = [ + { name = "oxidiris", allow = ["GPL-3.0-or-later"] }, + { name = "oxidiris-core", allow = ["GPL-3.0-or-later"] }, +] + [bans] multiple-versions = "warn" wildcards = "deny" diff --git a/docs/informations/proposals.md b/docs/informations/proposals.md index 7ea97a8..f9682d9 100644 --- a/docs/informations/proposals.md +++ b/docs/informations/proposals.md @@ -742,6 +742,12 @@ GitHub Actions: `edition = "2024"` yêu cầu Rust **≥ 1.85**. Cần khai báo `rust-version` trong `Cargo.toml`, ghi rõ trong README, và pin một job CI ở đúng phiên bản MSRV để không vô tình phá vỡ. +> **Đính chính (v0.1.0).** MSRV thực tế là **1.88**, không phải 1.85. Edition 2024 chỉ cần 1.85, +> nhưng `ratatui` 0.30 cùng cây phụ thuộc của nó (`darling`, `instability`, `time`) yêu cầu 1.88. +> Con số 1.85 đã được khai báo và lọt qua vì `make check` chạy trên toolchain mặc định của máy +> dev; chỉ job MSRV trên CI mới phát hiện. Đây chính là lý do job đó tồn tại — giữ nó pin đúng +> giá trị khai báo trong `[workspace.package]`. + ### 9.5. Đóng gói & Phân phối crates.io · Homebrew tap · AUR · Nix · `cargo-binstall`.