refactor(visibility): route is_owner through the shared did_matches matcher (#153) #415

Workflow file for this run

.github/workflows/pr-checks.yml at ca579c6

	name: PR Checks

	on:
	pull_request:
	push:
	branches:
	- main

	permissions:
	contents: read

	# Cancel superseded runs on the same PR/branch; never cancel runs on main.
	concurrency:
	group: pr-checks-${{ github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	env:
	CARGO_TERM_COLOR: always
	RUST_BACKTRACE: 1

	jobs:
	fmt-clippy:
	name: fmt + clippy
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust toolchain
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
	with:
	toolchain: stable
	components: rustfmt, clippy

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0

	- name: cargo fmt --check
	run: cargo fmt --all -- --check

	- name: cargo clippy
	run: cargo clippy --workspace --all-targets -- -D warnings

	test:
	name: test (${{ matrix.toolchain }})
	runs-on: ubuntu-latest
	timeout-minutes: 45
	strategy:
	fail-fast: false
	matrix:
	toolchain: [stable, beta]
	# Beta is informational: an upstream beta regression should warn, not block merges.
	continue-on-error: ${{ matrix.toolchain == 'beta' }}
	# Postgres for the DB-backed integration tests (#[sqlx::test] provisions an
	# isolated database per test off this connection). The health-check gate keeps
	# `cargo test` from racing a not-yet-ready server.
	services:
	postgres:
	image: postgres:16
	env:
	POSTGRES_USER: postgres
	POSTGRES_PASSWORD: postgres
	POSTGRES_DB: gitlawb_test
	ports:
	- 5432:5432
	options: >-
	--health-cmd pg_isready
	--health-interval 10s
	--health-timeout 5s
	--health-retries 5
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust toolchain
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
	with:
	toolchain: ${{ matrix.toolchain }}

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
	with:
	key: ${{ matrix.toolchain }}

	- name: cargo test
	env:
	DATABASE_URL: postgres://postgres:postgres@localhost:5432/gitlawb_test
	run: cargo test --workspace

	build-release:
	name: build --release
	runs-on: ubuntu-latest
	timeout-minutes: 45
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust toolchain
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
	with:
	toolchain: stable

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
	with:
	key: release

	- name: cargo build --release
	run: cargo build --release --workspace

	audit:
	name: cargo audit
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust toolchain
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
	with:
	toolchain: stable

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
	with:
	key: audit-0.22.2

	- name: Install cargo-audit (pinned)
	# Pin the scanner on this BLOCKING gate: an unpinned `cargo install`
	# floats to the latest release, so a regressed cargo-audit could red CI
	# repo-wide with no code change. Advisory-DB freshness is fetched at scan
	# time, independent of the binary, so this does not weaken what the gate
	# catches. The weekly Scheduled Audit (audit-schedule.yml) deliberately
	# floats to latest as the drift canary; when it shows a newer cargo-audit
	# behaving differently, bump this version (and the cache key above) as a
	# deliberate maintainer action. If 0.22.2 is ever yanked from crates.io
	# this step fails loud until the pin is bumped.
	run: \|
	set -euo pipefail
	cargo install --locked --version 0.22.2 cargo-audit
	# Assert the pin took effect so an accidental future unpin (or a drift
	# off 0.22.2) fails loudly here instead of silently running a different
	# scanner. `cargo audit --version` prints "cargo-audit-audit 0.22.2".
	installed="$(cargo audit --version)"
	echo "cargo-audit installed: $installed"
	echo "$installed" \| grep -qE '(^\| )0\.22\.2($\| )' \|\| {
	echo "::error::cargo-audit is not the pinned 0.22.2 (got: $installed)"
	exit 1
	}

	# Hard-fail gate. Suppressions live in .cargo/audit.toml (read automatically
	# from the repo root), each with no available upstream fix. A green check
	# here means "no NEW advisories", not "advisory-clean": surface the active
	# ignore list so a reviewer sees exactly what is being accepted.
	- name: Show active audit ignores
	run: \|
	{
	echo '### cargo audit: accepted advisories (.cargo/audit.toml)'
	echo '```toml'
	sed -n '/^\[advisories\]/,$p' .cargo/audit.toml
	echo '```'
	} >> "$GITHUB_STEP_SUMMARY"

	- name: cargo audit
	run: cargo audit

	msrv:
	name: MSRV (Rust 1.91)
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Set up Rust 1.91
	uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # 1.91
	with:
	toolchain: "1.91"

	- name: Cache cargo
	uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
	with:
	key: msrv

	- name: cargo check on MSRV
	run: cargo check --workspace --all-targets

	docker-build:
	name: Docker build smoke test
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- name: Check out repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Build image
	run: docker build -t gitlawb-node:ci-test .

	- name: Smoke test --version
	run: docker run --rm gitlawb-node:ci-test --version

Navigation Menu

Uh oh!

refactor(visibility): route is_owner through the shared did_matches matcher (#153) #415

Workflow file

refactor(visibility): route is_owner through the shared did_matches matcher (#153) #415

Uh oh!

Workflow file for this run