Lint

chore: release v6.3.0 #12223

Workflow file for this run

	name: Lint

	on:
	pull_request:
	branches: [main]
	push:
	branches: [main]
	merge_group:

	# Ensures that only one workflow task will run at a time. Previous builds, if
	# already in process, will get cancelled. Only the latest commit will be allowed
	# to run, cancelling any workflows in between
	concurrency:
	group: ${{ github.workflow }}-${{ github.head_ref \|\| github.run_id }}
	cancel-in-progress: true

	permissions:
	contents: read
	pull-requests: read

	env:
	CLICOLOR: 1

	jobs:
	changes:
	runs-on: ubuntu-latest
	timeout-minutes: 5
	outputs:
	lint: ${{ steps.filter.outputs.lint \|\| 'true' }}
	hadolint: ${{ steps.filter.outputs.hadolint \|\| 'true' }}
	shellcheck: ${{ steps.filter.outputs.shellcheck \|\| 'true' }}
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	if: github.event_name == 'pull_request'
	with:
	persist-credentials: false
	- uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
	id: filter
	if: github.event_name == 'pull_request'
	with:
	filters: .github/path-filters.yml

	clippy:
	name: clippy stable 1.97.0 / ${{ matrix.type }}
	needs: changes
	if: needs.changes.outputs.lint == 'true'
	permissions:
	contents: read
	id-token: write
	statuses: write
	runs-on: ubuntu-latest
	timeout-minutes: 30
	strategy:
	fail-fast: false
	matrix:
	type: [release, tests]
	include:
	- type: release
	args: --workspace --all-targets
	features: default-release-binaries
	- type: tests
	args: --workspace --all-targets
	features: default-release-binaries proptest-impl lightwalletd-grpc-tests zebra-checkpoints

	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
	with:
	persist-credentials: false
	- uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 #v1.16.1
	with:
	components: clippy
	toolchain: 1.97.0
	# Both matrix legs build the same workspace, so they share one cache.
	cache-shared-key: clippy
	cache-on-failure: true
	# Restore on every ref, but only write from main. Actions caches are
	# branch-scoped, so a cache written by a PR can never be read by any
	# other branch, yet it still consumes the repo-wide cache allowance
	# and can evict main's caches - the only ones PRs can restore from.
	# The `tests` leg seeds it, because its feature set is a superset.
	# See "Rust build caching" in .github/workflows/README.md.
	cache-save-if: ${{ github.ref == 'refs/heads/main' && matrix.type == 'tests' }}
	- uses: ./.github/actions/setup-zebra-build
	- name: Run clippy
	run: cargo clippy ${{ matrix.args }} --features "${{ matrix.features }}"

	crate-checks:
	needs: changes
	if: needs.changes.outputs.lint == 'true'
	permissions:
	contents: read
	statuses: write
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
	with:
	persist-credentials: false
	- uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 #v1.16.1
	with:
	cache-on-failure: true
	# Only main writes caches, see the clippy job above.
	cache-save-if: ${{ github.ref == 'refs/heads/main' }}
	- uses: taiki-e/install-action@65851e10cd6c377f11a60e600abc07cb08643468 #v2.79.3
	with:
	tool: cargo-hack
	- uses: ./.github/actions/setup-zebra-build
	- run: cargo hack check --workspace

	msrv:
	name: MSRV
	needs: changes
	if: needs.changes.outputs.lint == 'true'
	permissions:
	contents: read
	id-token: write
	statuses: write
	runs-on: ubuntu-latest
	timeout-minutes: 30
	strategy:
	matrix:
	include:
	- binary: zebrad
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
	with:
	persist-credentials: false
	- uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 #v1.16.1
	with:
	toolchain: 1.91.0 # MSRV
	cache-on-failure: true
	# Only main writes caches, see the clippy job above.
	cache-save-if: ${{ github.ref == 'refs/heads/main' }}
	- uses: ./.github/actions/setup-zebra-build
	- run: cargo build --bin "${{ matrix.binary }}" --workspace

	fmt:
	name: fmt
	needs: changes
	if: needs.changes.outputs.lint == 'true'
	permissions:
	contents: read
	statuses: write
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
	with:
	persist-credentials: false
	- uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 #v1.16.1
	with:
	toolchain: 1.91.0
	components: rustfmt
	# `cargo fmt` builds nothing, so a cache here only consumes quota.
	cache: false
	- name: Run fmt
	run: cargo fmt --all -- --check

	no-test-deps:
	needs: changes
	if: needs.changes.outputs.lint == 'true'
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
	with:
	persist-credentials: false

	- uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 #v1.16.1
	with:
	toolchain: 1.97.0
	# `cargo tree` builds nothing, so a cache here only consumes quota.
	cache: false
	- name: Ensure no arbitrary or proptest dependency on default build
	run: cargo tree --package zebrad -e=features,no-dev \| grep -Eq "arbitrary\|proptest" && exit 1 \|\| exit 0

	check-cargo-lock:
	name: check-cargo-lock
	needs: changes
	if: needs.changes.outputs.lint == 'true'
	permissions:
	contents: read
	id-token: write
	statuses: write
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
	with:
	persist-credentials: false
	- uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 #v1.16.1
	with:
	toolchain: 1.97.0
	cache-on-failure: true
	# Only main writes caches, see the clippy job above.
	cache-save-if: ${{ github.ref == 'refs/heads/main' }}
	- uses: ./.github/actions/setup-zebra-build
	- run: cargo check --locked --all-features --all-targets

	deny:
	name: Check deny ${{ matrix.checks }} ${{ matrix.features }}
	needs: changes
	if: needs.changes.outputs.lint == 'true'
	permissions:
	contents: read
	statuses: write
	runs-on: ubuntu-latest
	strategy:
	matrix:
	checks:
	- bans
	- sources
	- advisories
	- licenses
	# We don't need to check `--no-default-features` here, because (except in very rare cases):
	# - disabling features isn't going to add duplicate dependencies
	# - disabling features isn't going to add more crate sources
	# For advisories and licenses, feature flags don't change the dependency tree materially,
	# so we only need the default and --all-features variants.
	features: ["", --features default-release-binaries, --all-features]
	# Always run the --all-features job, to get accurate "skip tree root was not found" warnings
	fail-fast: false

	# Prevent sudden announcement of a new advisory from failing ci:
	continue-on-error: ${{ matrix.checks == 'advisories' }}

	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
	with:
	persist-credentials: false
	- uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 #v1.16.1
	with:
	# cargo-deny reads the dependency graph without building it, and this
	# matrix is 12 jobs wide, so caching here is pure quota consumption.
	cache: false
	- name: Check ${{ matrix.checks }} with features ${{ matrix.features }}
	uses: EmbarkStudios/cargo-deny-action@6c8f9facfa5047ec02d8485b6bf52b587b7777d1 #v2.0.18
	with:
	# --all-features spuriously activates openssl, but we want to ban that dependency in
	# all of zebrad's production features for security reasons. But the --all-features job is
	# the only job that gives accurate "skip tree root was not found" warnings.
	# In other jobs, we expect some of these warnings, due to disabled features.
	command: check ${{ matrix.checks }} ${{ matrix.features == '--all-features' && '--allow banned' \|\| '--allow unmatched-skip-root' }}
	arguments: --workspace ${{ matrix.features }}

	hadolint:
	name: hadolint
	needs: changes
	if: needs.changes.outputs.hadolint == 'true'
	permissions:
	contents: read
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Run hadolint
	uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
	with:
	dockerfile: docker/Dockerfile
	failure-threshold: warning

	shellcheck:
	name: shellcheck
	needs: changes
	if: needs.changes.outputs.shellcheck == 'true'
	permissions:
	contents: read
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	# shellcheck is preinstalled on the ubuntu-latest runner image.
	- name: Run shellcheck
	run: \|
	find . -type f -name '*.sh' \
	-not -path './target/*' \
	-print0 \| xargs -0 -r shellcheck --color=always
	- name: Test release changelog validator
	run: .github/scripts/test-validate-release-changelogs.sh

	lint:
	runs-on: ubuntu-latest
	if: always()
	needs:
	- changes
	- clippy
	- crate-checks
	- msrv
	- fmt
	- check-cargo-lock
	- no-test-deps
	- deny
	- hadolint
	- shellcheck
	timeout-minutes: 30
	steps:
	- name: Decide whether the needed jobs succeeded or failed
	uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe #v1.2.2
	with:
	jobs: ${{ toJSON(needs) }}
	allowed-skips: clippy, crate-checks, msrv, fmt, check-cargo-lock, no-test-deps, deny, hadolint, shellcheck

Navigation Menu

Uh oh!

chore: release v6.3.0 #12223

Workflow file

chore: release v6.3.0 #12223

Uh oh!

Workflow file for this run