fix: remove safe mount options from blocked list #95
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ "**" ] | |
| pull_request: | |
| branches: [ "**" ] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| jobs: | |
| # Stage 1: Quick checks (fail fast) - run in parallel | |
| format: | |
| name: Code Format | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt | |
| - run: cargo fmt --all -- --check | |
| # Stage 2: Build once, use everywhere | |
| build: | |
| name: Build & Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: "ci-build" | |
| cache-on-failure: true | |
| # Build once for all jobs | |
| - name: Build all targets | |
| run: cargo build --all-targets --all-features | |
| # Run clippy on already-built artifacts | |
| - name: Clippy | |
| run: cargo clippy --all-targets --all-features -- -A warnings | |
| # Run tests on already-built artifacts | |
| - name: Install nextest | |
| uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-nextest | |
| - name: Run unit and integration tests | |
| run: cargo nextest run --all-features --no-fail-fast -E "not (binary(cli_commands_test) or binary(complete_workflow_test) or binary(daemon_health_test) or binary(failure_recovery_test) or binary(systemd_service_test) or binary(multi_protocol_stress_test) or binary(real_world_mounting_test) or binary(mount_driver_integration_test))" | |
| - name: Run doc tests | |
| run: cargo test --doc --all-features | |
| # Stage 3: Security audit (runs in parallel with build) | |
| security: | |
| name: Security Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install security tools | |
| uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-audit,cargo-deny | |
| - name: Run security audit | |
| run: | | |
| cargo audit \ | |
| --ignore RUSTSEC-2025-0134 \ | |
| --ignore RUSTSEC-2025-0012 \ | |
| --ignore RUSTSEC-2024-0388 \ | |
| --ignore RUSTSEC-2024-0421 \ | |
| --ignore RUSTSEC-2024-0384 \ | |
| --ignore RUSTSEC-2024-0370 | |
| - name: Run cargo-deny checks | |
| run: cargo deny check | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: "security" | |
| - name: Run security tests | |
| run: make test-security | |
| # Stage 4: Coverage (only after build succeeds, only on main branch) | |
| coverage: | |
| name: Code Coverage | |
| runs-on: ubuntu-latest | |
| needs: [build] | |
| if: github.ref == 'refs/heads/master' || github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: "ci-build" # Reuse build cache | |
| - name: Install cargo-tarpaulin | |
| uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-tarpaulin | |
| - name: Generate coverage | |
| run: | | |
| cargo tarpaulin --lib --skip-clean --fail-under 32 \ | |
| --workspace --exclude-files="scripts/*" \ | |
| --timeout 600 \ | |
| --output-dir target/coverage --out Xml | |
| - name: Upload coverage | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| file: target/coverage/tarpaulin-report.xml | |
| continue-on-error: true | |
| # Stage 5: Verify release build (only on main/PRs) | |
| verify-release-build: | |
| name: Verify Release Build | |
| runs-on: ubuntu-latest | |
| needs: [build] | |
| if: github.ref == 'refs/heads/master' || github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: "release" | |
| - run: cargo build --release --all-features |