ci: pinned ci-workflows reusables — ci, supply-chain, codeql, releases - #16
Merged
7 commits merged intoSep 22, 2026
Merged
7 commits merged into
7 commits merged into
Conversation
…deny policy cargo-machete flagged 13 declared dependencies that nothing imports: serde (agent/desktop/relay), bytes (cli/relay), rand (relay), tracing (discovery, bench), proptest (sync dev-dep), rds-core (bench), async-trait (desktop), thiserror and tracing-subscriber (net). All removed; the workspace still builds and tests green under --locked. deny.toml gains the two licenses the iroh transitive tree actually ships (Unlicense, CDLA-Permissive-2.0) and ignores the two unmaintained advisories that have no upgrade path (atomic-polyfill via rustls, paste via iroh-quinn) — with a comment explaining the bounds so the ignore can't silently absorb future advisories. `cargo deny check bans licenses advisories sources` and `cargo audit` now pass locally; `cargo machete` is clean. Generated with Devin Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…ning
Replaces the hand-rolled workflow with callers of
NDDev-OpenNetwork/ci-workflows @ a7b90bd (release 0.1.26):
- ci.yml → rust-ci: locked build, fmt --check, clippy across five
feature lanes (default, noq/owned-relay, metrics, x11, desktop),
and a ubuntu+macos test matrix running the workspace suite plus
feature tests.
- supply-chain.yml → rust-supply-chain: cargo-deny, cargo-audit and
cargo-machete on every PR/push and weekly, closing the gap where
deny.toml documented a check no workflow ran.
- codeql.yml → public-codeql: rust (build-mode none) + actions
analysis; enables code scanning, which default setup reports as
not-configured.
Top-level permissions remain {}; caller jobs declare only the
scopes their callee needs; ubuntu-latest everywhere (public repo).
actionlint clean; zizmor 1.26.1 pedantic clean.
Generated with Devin
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Tagging X.Y.Z runs resolve → authorize (release environment) → release-supply-chain, which validates the release contract (VERSION file == tag, CHANGELOG heading) and publishes the source archive, SPDX SBOM, SHA256SUMS and SLSA/SBOM attestations. Adds VERSION (0.1.0, matching Cargo.toml) and a tag ruleset (refs/tags/X.Y.Z: creation open, deletion + rewrite denied), applied to the repo as ruleset 23828256. Generated with Devin Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Mirrors the estate convention: grouped minor/patch cargo updates and action pinning updates with a 7-day cooldown so fresh releases get a bake-in window. Generated with Devin Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Generated with Devin Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
YAML `>-` folding only joins lines at the scalar's own indentation; the extra-indented `--features`/`-- -D warnings` continuations kept their line breaks, so bash executed `--features` as a command and the clippy job exited 127. Flatten every continuation to one line. Generated with Devin Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
… test Path pinning caps concurrent multipath paths at one, but it does not suppress iroh's direct-path probes at candidates learned through in-band address exchange. Whether probes land inside the test window is platform timing — macOS runners observed 4 direct datagrams, Linux none. The counter is correct to count them; asserting zero tested a transport-timing property, not counter accuracy. The C7 gate stands on the relay side: payload datagrams, sent and received bytes and seen paths must all register via=relay. Generated with Devin Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the hand-rolled workflow with the estate's pinned reusable library (
NDDev-OpenNetwork/ci-workflows@a7b90bd, release 0.1.26) and closes the supply-chain gaps it documented:rust-ci: locked workspace build,fmt --check, clippy across five feature lanes (default, noq/owned-relay, metrics, x11, desktop), ubuntu+macos test matrixrust-supply-chain: cargo-deny, cargo-audit, cargo-machete perdeny.tomlon PR/push + weekly — closes the gap wheredeny.tomldocumented a check no workflow ranpublic-codeql: rust (build-modenone) + actions; code scanning wasnot-configuredrelease-supply-chain: tagX.Y.Z→ resolve →release-environment authorize → immutable release (source archive, SPDX SBOM, SHA256SUMS, SLSA/SBOM attestations)X.Y.Ztags are create-only, delete/rewrite deniedUnlicense+CDLA-Permissive-2.0(iroh transitive deps); scoped ignores forRUSTSEC-2023-0089/RUSTSEC-2024-0436(unmaintained, no upgrade path — bounds documented)Test plan
Local evidence on this tree:
cargo fmt --all -- --check— cleancargo build --locked --workspace --all-targets— cleancargo test --locked --workspace— 34 targets, all greencargo test --locked -p rds-net -p rds-agent -p rds-relay --features rds-net/transport-noq,rds-agent/transport-noq,rds-relay/owned-relay— greencargo deny check bans licenses advisories sources— okcargo audit— only the two documented unmaintained warningscargo machete— cleanactionlint— clean;zizmor 1.26.1 --persona pedantic(online, GH_TOKEN) — no findingsNotes: macOS clippy lane was dropped in favor of the reusable's single ubuntu clippy (macOS still compiles+tests in the matrix). The
releaseenvironment is unprotected until a required reviewer is configured in repo settings — additive seam, no behavior change for non-tag events.Generated with Devin