Skip to content

ci: bump actions/checkout from 6.0.3 to 7.0.0 #34

ci: bump actions/checkout from 6.0.3 to 7.0.0

ci: bump actions/checkout from 6.0.3 to 7.0.0 #34

Workflow file for this run

name: CI
# Deck is a cargo-generate TEMPLATE: its tracked source contains {{ }} Liquid tokens
# (see cargo-generate.toml `include`) and so does NOT build directly. Every job below
# therefore GENERATES a throwaway project from the template first, then builds / lints /
# tests THAT. Editing the template? Read the "cargo-generate template" note in CLAUDE.md.
#
# COST: free. Standard GitHub-hosted runners (macos-latest, ubuntu-latest) are free +
# unlimited on PUBLIC repos — the macOS 10x multiplier only burns quota on PRIVATE repos.
# If you ever make this repo private, gate the `macos` job to tags to avoid eating minutes:
# if: github.event_name == 'pull_request' || startsWith(github.ref, 'refs/tags/v')
# (Don't switch to "*-large" runners — those are billed even on public repos.)
on:
push:
branches: [main]
tags: ["v*"]
pull_request:
branches: [main]
workflow_dispatch:
env:
CARGO_TERM_COLOR: always
# Least-privilege GITHUB_TOKEN: this workflow only checks out, generates, builds, lints,
# tests, and runs cargo-deny — it needs read access to repo contents and nothing else.
permissions:
contents: read
# Cancel a still-running CI for a branch when a newer commit is pushed (faster feedback,
# fewer minutes — the generated project's first git-gpui build is slow).
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
cancel-in-progress: true
jobs:
macos:
runs-on: macos-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
# Prebuilt cargo-generate (fast, deterministic — no compile). SHA-pinned;
# Dependabot (github-actions) keeps it current.
- uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2.81.10
with:
tool: cargo-generate
# Render the template into a sibling dir (NOT inside the repo — a nested cargo
# project confuses cargo, see rust-lang/cargo#9922). --silent uses the placeholder
# defaults (bundle_qualifier=com, bundle_org=example).
- name: Generate a project from the template
run: |
mkdir -p "$RUNNER_TEMP/gen"
cargo generate --path . --name deck-ci --silent --vcs none --destination "$RUNNER_TEMP/gen"
# No toolchain pin here: rust-toolchain.toml (copied into the generated project) is
# the single source of truth; rustup auto-installs it on the first cargo call.
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
with:
workspaces: ${{ runner.temp }}/gen/deck-ci
# No --locked: the generated Cargo.lock's root entry is renamed at generate time, so
# cargo refreshes just that on first build (the git-gpui deps stay pinned).
- name: Build, lint, and test the generated project
working-directory: ${{ runner.temp }}/gen/deck-ci
run: |
cargo build
cargo build --features tray
cargo clippy --all-targets -- -D warnings
cargo clippy --all-targets --features tray -- -D warnings
cargo clippy --all-targets --features overlay -- -D warnings
cargo clippy --all-targets --features tray,overlay -- -D warnings
cargo test
cargo test --features overlay
linux:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
# System libraries GPUI needs on Linux (X11 + Wayland + Vulkan + fonts), plus
# GTK/appindicator for the optional tray feature.
- name: Install system dependencies
run: |
sudo apt-get update
sudo apt-get install -y --no-install-recommends \
build-essential pkg-config \
libxcb1-dev libxkbcommon-dev libxkbcommon-x11-dev \
libwayland-dev \
libvulkan-dev \
libfontconfig1-dev libfreetype6-dev \
libssl-dev \
libgtk-3-dev libayatana-appindicator3-dev libxdo-dev
- uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2.81.10
with:
tool: cargo-generate
- name: Generate a project from the template
run: |
mkdir -p "$RUNNER_TEMP/gen"
cargo generate --path . --name deck-ci --silent --vcs none --destination "$RUNNER_TEMP/gen"
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
with:
workspaces: ${{ runner.temp }}/gen/deck-ci
# Formatting is OS-independent, so gate `cargo fmt --check` once on the cheaper
# Linux runner. The overlay feature is a compile-only no-op on Linux (no LayerShell).
- name: Format-check, build, lint, and test the generated project
working-directory: ${{ runner.temp }}/gen/deck-ci
run: |
cargo fmt --all --check
cargo build
cargo build --features tray
cargo clippy --all-targets -- -D warnings
cargo clippy --all-targets --features tray -- -D warnings
cargo clippy --all-targets --features overlay -- -D warnings
cargo test
cargo test --features overlay
# Supply-chain gate (advisories / bans / sources / licenses) via cargo-deny, run against
# the GENERATED project (the raw template Cargo.toml has tokens and won't parse). REQUIRED:
# a deny.toml violation fails the build.
cargo-deny:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2.81.10
with:
tool: cargo-generate,cargo-deny
- name: Generate a project from the template
run: |
mkdir -p "$RUNNER_TEMP/gen"
cargo generate --path . --name deck-ci --silent --vcs none --destination "$RUNNER_TEMP/gen"
- name: cargo-deny check
working-directory: ${{ runner.temp }}/gen/deck-ci
run: cargo deny check advisories bans sources licenses