Revision control
Copy as Markdown
Other Tools
name: CI
on:
pull_request:
merge_group:
workflow_dispatch:
env:
CARGO_TERM_COLOR: always
RUST_BACKTRACE: 1
RUST_TEST_TIME_UNIT: 10,30
RUST_TEST_TIME_INTEGRATION: 10,30
RUST_TEST_TIME_DOCTEST: 10,30
CARGO_PROFILE_RELEASE_LTO: true
CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 1
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
permissions:
contents: read
defaults:
run:
shell: bash
jobs:
toolchains:
name: Determine toolchains
runs-on: ubuntu-24.04
outputs:
toolchains: ${{ steps.toolchains.outputs.toolchains }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- id: toolchains
uses: mozilla/actions/toolchains@2e46408d5c495e59a21e5e125e82008fad0d9408 # v1.1.7
check:
name: Run checks
needs: toolchains
# TODO: Restore `environment: codecov` once GitHub supports filtering deployment messages.
# environment: codecov
strategy:
fail-fast: false
matrix:
os: [ubuntu-24.04, ubuntu-24.04-arm, macos-15, windows-2025]
rust-toolchain: ${{ fromJSON(needs.toolchains.outputs.toolchains) }}
type: [debug]
# Include some dynamically-linked release builds, to check that that works on all platforms.
include:
- os: ubuntu-24.04
rust-toolchain: stable
type: release
- os: macos-15
rust-toolchain: stable
type: release
- os: windows-2025
rust-toolchain: stable
type: release
# Also do some debug builds on the oldest OS versions.
- os: ubuntu-22.04
rust-toolchain: stable
type: debug
- os: macos-14
rust-toolchain: stable
type: debug
- os: windows-2022
rust-toolchain: stable
type: debug
env:
BUILD_TYPE: ${{ matrix.type == 'release' && '--release' || '' }}
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: mozilla/actions/rust@2e46408d5c495e59a21e5e125e82008fad0d9408 # v1.1.7
with:
version: ${{ matrix.rust-toolchain }}
components: ${{ matrix.rust-toolchain == 'stable' && 'llvm-tools' || '' }} ${{ matrix.rust-toolchain == 'nightly' && startsWith(matrix.os, 'ubuntu') && !endsWith(matrix.os, 'arm') && 'rust-src ' || '' }}
tools: ${{ matrix.rust-toolchain == 'stable' && 'cargo-llvm-cov' || '' }} ${{ matrix.rust-toolchain == 'nightly' && startsWith(matrix.os, 'ubuntu') && !endsWith(matrix.os, 'arm') && 'cargo-careful ' || '' }} cargo-hack
token: ${{ secrets.GITHUB_TOKEN }}
- uses: mozilla/actions/nss@2e46408d5c495e59a21e5e125e82008fad0d9408 # v1.1.7
with:
version-file: min_version.txt
token: ${{ secrets.GITHUB_TOKEN }}
- name: Check
run: |
# shellcheck disable=SC2086
cargo check $BUILD_TYPE --locked --all-targets
- name: Check feature powerset
run: |
# shellcheck disable=SC2086
# --locked is omitted: --no-dev-deps modifies the manifest, which can
# require lockfile re-resolution in a workspace.
cargo hack check $BUILD_TYPE --feature-powerset --no-dev-deps --exclude-features gecko --mutually-exclusive-features blapi,disable-encryption
- name: Run tests and determine coverage
env:
RUST_LOG: trace
RUST_BACKTRACE: 1
RUST_TEST_TIME_UNIT: 10,30
RUST_TEST_TIME_INTEGRATION: 10,30
RUST_TEST_TIME_DOCTEST: 10,30
TOOLCHAIN: ${{ matrix.rust-toolchain }}
# FIXME: cargo-careful at the moment only works on amd64 Ubuntu
CAREFUL: ${{ matrix.rust-toolchain == 'nightly' && startsWith(matrix.os, 'ubuntu') && !endsWith(matrix.os, 'arm') && 'careful' || '' }}
run: |
DUMP_SIMULATION_SEEDS="$(pwd)/simulation-seeds"
export DUMP_SIMULATION_SEEDS
# shellcheck disable=SC2086
if [ "$TOOLCHAIN" == "stable" ]; then
cargo llvm-cov test $BUILD_TYPE --locked --include-ffi --codecov --output-path codecov.json
else
if [ -n "$CAREFUL" ]; then
TRIPLE="--target $(rustc --print host-tuple)"
fi
cargo $CAREFUL test $BUILD_TYPE --locked $TRIPLE
fi
- name: Test feature powerset
run: |
# shellcheck disable=SC2086
cargo hack test $BUILD_TYPE --locked --feature-powerset --exclude-features gecko --mutually-exclusive-features blapi,disable-encryption
- name: Test blapi in FIPS mode
if: runner.os == 'Linux'
env:
TEST_FIXTURE_DB: ${{ github.workspace }}/test-fixture/db-fips
run: |
# shellcheck disable=SC2086
cargo test $BUILD_TYPE --locked --features blapi --test aead_fips
- name: CodeCov Windows workaround
if: ${{ startsWith(matrix.os, 'windows') && matrix.type == 'debug' && matrix.rust-toolchain == 'stable' }}
run: |
# FIXME: Without this, the codecov/codecov-action fails. No idea why it's looking under C:/msys64 now, it shouldn't.
mkdir -p C:/msys64/home/runneradmin/
touch C:/msys64/home/runneradmin/.gitconfig
- uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
with:
files: codecov.json
fail_ci_if_error: false
token: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]
verbose: true
flags: ${{ startsWith(matrix.os, 'ubuntu') && 'linux' || startsWith(matrix.os, 'macos') && 'macos' || 'windows' }}
env:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]
if: matrix.type == 'debug' && matrix.rust-toolchain == 'stable'
- name: Save simulation seeds artifact
if: ${{ always() }}
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: simulation-seeds-${{ matrix.os }}-${{ matrix.rust-toolchain }}-${{ matrix.type }}
path: simulation-seeds
compression-level: 9
check-cargo-lock:
name: Ensure `Cargo.lock` contains all required dependencies
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: mozilla/actions/rust@2e46408d5c495e59a21e5e125e82008fad0d9408 # v1.1.7
with:
version: stable
tools: cargo-hack
token: ${{ secrets.GITHUB_TOKEN }}
- run: |
cargo update -w --locked
cargo hack update -w --locked
check-android:
name: Check Android
runs-on: ubuntu-24.04
strategy:
matrix:
target: ["x86_64-linux-android", "aarch64-linux-android"]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- id: nss-version
run: echo "minimum=$(cat min_version.txt)" >> "$GITHUB_OUTPUT"
- uses: ./.github/actions/check-android
with:
target: ${{ matrix.target }}
minimum-nss-version: ${{ steps.nss-version.outputs.minimum }}
github-token: ${{ secrets.GITHUB_TOKEN }}
check-distro:
name: Check with system NSS on ${{ matrix.name }}
runs-on: ubuntu-24.04
# Tests the pkg-config codepath against distro-packaged NSS. Some distros
# omit -L for default library search paths (e.g., /usr/lib64 on Fedora/RHEL),
# which the Ubuntu CI runners don't exercise.
# Allow failures in merge queue in case distro NSS lags our minimum version.
continue-on-error: ${{ github.event_name == 'merge_group' }}
strategy:
fail-fast: false
matrix:
include:
- name: Fedora
container: fedora@sha256:498c452f32a739b61f0ef215bce9924ebc4866cbe44710f58157d77723b7a6d2
install: dnf install -y git nss-devel clang-devel pkgconf-pkg-config gcc curl
- name: openSUSE Tumbleweed
container: opensuse/tumbleweed@sha256:003da6756e3daced6f62ece3d6dc436d21572fb05e558172fc552b6aa1b044ab
install: zypper install -y --no-recommends git mozilla-nss-devel clang-devel pkg-config gcc curl
- name: Arch Linux
container: archlinux@sha256:1047e6e7878d58e4ee47e1cd6459a32fab41246b0efc4109e11b7ef16f50b14d
install: pacman -Syu --noconfirm git nss clang pkgconf gcc curl
defaults:
run:
shell: sh
container:
image: ${{ matrix.container }}
steps:
- name: Install system dependencies (${{ matrix.name }})
env:
INSTALL: ${{ matrix.install }}
run: $INSTALL
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Install Rust
run: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- --default-toolchain stable --profile minimal -y
- name: Check
run: |
. "$HOME/.cargo/env"
cargo check --locked --all-targets
- name: Check feature powerset
run: |
. "$HOME/.cargo/env"
cargo install cargo-hack --locked
# --locked is omitted: --no-dev-deps modifies the manifest, which can
# require lockfile re-resolution.
cargo hack check --feature-powerset --no-dev-deps --exclude-features gecko --mutually-exclusive-features blapi,disable-encryption
check-vm:
name: Run checks for VM-only platforms
runs-on: ubuntu-24.04
# TODO: Restore `environment: codecov` once GitHub supports filtering deployment messages.
# environment: codecov
# OpenBSD, NetBSD and Solaris often have NSS packages that are too old.
# Allow them to fail without aborting the merge queue.
continue-on-error: ${{ github.event_name == 'merge_group' && matrix.os != 'freebsd' }}
strategy:
fail-fast: false
matrix:
os: [freebsd, netbsd, openbsd] # NSS package on 'solaris' is too old.
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: ./.github/actions/check-vm
with:
platform: ${{ matrix.os }}
codecov-token: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]