rustmotion/.github/workflows/ci.yaml at main · LeadcodeDev/rustmotion · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
name: CI

on:
  push:
    branches: [main]
  pull_request:

env:
  CARGO_TERM_COLOR: always

jobs:
  fmt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22
        with:
          components: rustfmt
      - name: Check formatting
        run: cargo fmt --all --check

  clippy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - name: Install system dependencies
        # xkbcommon-x11/wayland/xcb-cursor: required to LINK the studio (gpui).
        # clippy passes without them — it never links — so the failure only shows in tests.
        # asound: required by cpal, which rodio pulls in for preview audio
        run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev libfreetype6-dev libxkbcommon-x11-dev libwayland-dev libxcb-cursor-dev libasound2-dev
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22
        with:
          components: clippy
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - name: Clippy
        # `--features rustmotion/studio` n'est pas décoratif : le studio est
        # derrière un feature non-défaut depuis qu'il est un module de
        # `rustmotion`, et `--workspace` seul ne compilerait plus une seule de
        # ses 11 600 lignes. Sans ce drapeau, clippy reste vert sur du code que
        # personne ne vérifie plus.
        run: cargo clippy --workspace --all-targets --features rustmotion/studio -- -D warnings

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - name: Install system dependencies
        # xkbcommon-x11/wayland/xcb-cursor: required to LINK the studio (gpui).
        # clippy passes without them — it never links — so the failure only shows in tests.
        # asound: required by cpal, which rodio pulls in for preview audio
        run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev libfreetype6-dev libxkbcommon-x11-dev libwayland-dev libxcb-cursor-dev libasound2-dev
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - name: Run tests
        # Même raison qu'au job clippy : sans le feature, les tests du studio
        # (`tests/studio_audit_ws_g.rs`) ne sont même pas compilés.
        run: cargo test --workspace --features rustmotion/studio

  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - name: Install cargo-audit
        run: cargo install cargo-audit --locked
      # Blocking on any advisory not listed below — a newly introduced
      # vulnerability fails this job. Every `--ignore` is a pre-existing
      # transitive-dependency advisory tolerated today because the fix is a
      # dependency version bump, and version bumps for the published
      # `rustmotion` crate are being handled separately from this workstream
      # (crates/rustmotion/Cargo.toml, orchestrator-owned). Unmaintained/
      # unsound/yanked advisories (17 as of 2026-09-22) print but do not fail
      # the job — that's `cargo audit`'s own default, left unchanged here.
      #
      # Review by 2026-12-22, or sooner once the dependency bumps land:
      #   RUSTSEC-2025-0008 — openh264-sys2 0.6.6, heap overflow in decoding.
      #     Direct dependency of the published `rustmotion` crate. Fix: openh264 >=0.8.0.
      #   RUSTSEC-2026-0204 — crossbeam-epoch 0.9.18, invalid pointer deref in `fmt::Pointer`.
      #     Via rayon-core <- exr <- image, reaches rustmotion-core/-components. Fix: >=0.9.20.
      #   RUSTSEC-2026-0195, RUSTSEC-2026-0194 — quick-xml 0.38.4 / 0.39.4, DoS + quadratic runtime.
      #     0.38.4 via syntect reaches the published crates; 0.39.4 via dioxus-desktop/rfd is
      #     studio-only (Linux/Wayland file dialogs). Fix: >=0.41.0.
      #   RUSTSEC-2026-0285 — rustls 0.23.37, TLS 1.3 handshake level-boundary bug.
      #     Via ureq, used by rustmotion/rustmotion-core for Google Fonts + Iconify fetches. Fix: >=0.23.45.
      #   RUSTSEC-2026-0104, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0049 — rustls-webpki
      #     0.103.9, four CRL/name-constraint parsing bugs. Same ureq path as rustls above.
      #     Fix: >=0.103.13,<0.104.0-alpha.1 (or the matching 0.104 alpha per advisory).
      #   RUSTSEC-2026-0257 — webbrowser 1.2.1, BROWSER env argument injection on Unix.
      #     Via dioxus-desktop, rustmotion-studio only (`publish = false`, never reaches a published
      #     crate). Fix: >=1.2.2.
      - name: Audit dependencies
        run: >
          cargo audit
          --ignore RUSTSEC-2025-0008
          --ignore RUSTSEC-2026-0204
          --ignore RUSTSEC-2026-0195
          --ignore RUSTSEC-2026-0194
          --ignore RUSTSEC-2026-0285
          --ignore RUSTSEC-2026-0104
          --ignore RUSTSEC-2026-0098
          --ignore RUSTSEC-2026-0099
          --ignore RUSTSEC-2026-0049
          --ignore RUSTSEC-2026-0257