From 6352703449ec5dc51bc673b0869443e79d5dfd8a Mon Sep 17 00:00:00 2001 From: Christopher Addison Date: Fri, 13 Nov 2026 09:31:29 -0500 Subject: [PATCH 1/3] ci(HUB-0000): drop unused workflows and harden CI Remove the release, prerelease and vouch workflows: the fork publishes no crates, makes no releases and has none of their secrets or app credentials. CI now installs just with taiki-e/install-action, since setup-just v4 calls extractions/setup-crate, which the action allowlist blocks. It runs on pushes to the Unity branches so PRs restore a base-branch Rust cache, saves caches from those pushes only, sets a timeout on every job, cancels superseded PR runs, runs every Rust job when CI itself changes, and adds a `CI Required` rollup for branch protection. Co-Authored-By: Claude Opus 5.5 --- .github/renovate.json5 | 8 + .github/workflows/audit.yml | 23 +- .github/workflows/ci.yml | 215 ++++++++++++------ .github/workflows/prerelease.yml | 87 ------- .github/workflows/release-pr-check.yml | 30 --- .github/workflows/release-pr.yml | 30 --- .github/workflows/release-tag.yml | 45 ---- .github/workflows/release.yml | 135 ----------- .github/workflows/vouch-check-issue.yml | 31 --- .github/workflows/vouch-check-pr.yml | 30 --- .../workflows/vouch-manage-by-discussion.yml | 35 --- .github/workflows/vouch-manage-by-issue.yml | 36 --- 12 files changed, 175 insertions(+), 530 deletions(-) delete mode 100644 .github/workflows/prerelease.yml delete mode 100644 .github/workflows/release-pr-check.yml delete mode 100644 .github/workflows/release-pr.yml delete mode 100644 .github/workflows/release-tag.yml delete mode 100644 .github/workflows/release.yml delete mode 100644 .github/workflows/vouch-check-issue.yml delete mode 100644 .github/workflows/vouch-check-pr.yml delete mode 100644 .github/workflows/vouch-manage-by-discussion.yml delete mode 100644 .github/workflows/vouch-manage-by-issue.yml diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 1dfc7d56238..7eac1072096 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -56,6 +56,14 @@ groupName: 'github-actions', matchManagers: ['github-actions'], }, + // The msrv job's `toolchain:` is the minimum Rust version gpui supports + // (`rust-version` in crates/gpui/Cargo.toml). Raising it would stop + // checking that minimum, so it moves only with rust-version, by hand. + { + matchManagers: ['github-actions'], + matchDepNames: ['rust'], + enabled: false, + }, // Patch-only catch-all. Not minor: most crates here are 0.x, where a // "minor" is a breaking change and deserves its own PR. diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index fad7abddc17..85fbafbefe6 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -1,28 +1,40 @@ -# Security audit workflow +# Security audit workflow: RustSec advisories and cargo-deny policy, on any +# change to the dependency graph or the audit config. name: Security Audit on: push: - branches: [main] + branches: [unity/hub-consolidated, unity/hub-4.0] paths: - '**/Cargo.toml' - '**/Cargo.lock' + - audit.toml + - deny.toml + - .github/workflows/audit.yml pull_request: paths: - '**/Cargo.toml' - '**/Cargo.lock' - schedule: - - cron: '0 0 * * 1' + - audit.toml + - deny.toml + - .github/workflows/audit.yml workflow_dispatch: permissions: contents: read - checks: write + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: # cargo-audit: vulnerability scanning (advisory DB) cargo-audit: runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + checks: write steps: - uses: actions/checkout@v7 - uses: rustsec/audit-check@v2 @@ -33,6 +45,7 @@ jobs: # cargo-deny: license compliance + advisory + duplicate detection cargo-deny: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@v7 - uses: EmbarkStudios/cargo-deny-action@v2 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cc8d822e993..878a6a2243b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,96 +1,111 @@ -# Main CI workflow +# Main CI workflow for Unity's fork. Branch protection requires one check, +# `CI Required`, which fails if any job below failed or was skipped when it +# should have run. name: CI -permissions: - contents: read - on: + # Pushes to the protected Unity branches seed the Rust caches that pull + # requests restore. `main` only mirrors upstream, so it runs nothing. push: - branches: [main, "v[0-9]+.[0-9]+.x"] + branches: [unity/hub-consolidated, unity/hub-4.0] pull_request: - branches: ["**"] + workflow_dispatch: +permissions: + contents: read + +# A new push to a pull request cancels its older run. Branch pushes each keep +# their own run. concurrency: - group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.ref_name == 'main' && github.sha || 'anysha' }} - cancel-in-progress: true + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} env: CARGO_TERM_COLOR: always RUST_BACKTRACE: 1 CARGO_INCREMENTAL: 0 + # Only branch pushes save Rust caches. Each PR saving its own ~1 GB entry + # filled the 10 GB repo budget, and no other PR could read them anyway. + SAVE_RUST_CACHE: ${{ github.event_name == 'push' }} jobs: - # Change detection + # Decides whether the Rust jobs run. A pull request skips them only when + # every file it changes is documentation or repo metadata. A change to CI + # itself (this file, the justfile, toolchain config) runs everything. orchestrate: runs-on: ubuntu-latest + timeout-minutes: 5 outputs: - run_tests: ${{ steps.filter.outputs.run_tests }} - run_style: ${{ steps.filter.outputs.run_style }} + rust: ${{ steps.filter.outputs.rust }} steps: - uses: actions/checkout@v7 with: - fetch-depth: ${{ github.ref == 'refs/heads/main' && 2 || 350 }} + # The PR merge commit's first parent is the base branch tip. + fetch-depth: 2 - id: filter + env: + EVENT: ${{ github.event_name }} run: | - if [ -z "$GITHUB_BASE_REF" ]; then - COMPARE_REV="$(git rev-parse HEAD~1)" + if [ "$EVENT" != "pull_request" ]; then + echo "rust=true" >> "$GITHUB_OUTPUT" + exit 0 + fi + CHANGED="$(git diff --name-only HEAD^1 HEAD)" + echo "$CHANGED" + DOCS_ONLY='^(docs/|[^/]+\.md$|\.github/(CODEOWNERS|PULL_REQUEST_TEMPLATE\.md|DISCUSSION_TEMPLATE/|renovate\.json5$|VOUCHED\.td$|issue-unvouched-message$|llmgenerated-response-message$|workflows/audit\.yml$)|renovate\.json$)' + if echo "$CHANGED" | grep -qvE "$DOCS_ONLY"; then + echo "rust=true" >> "$GITHUB_OUTPUT" else - git fetch --update-head-ok origin "$GITHUB_BASE_REF" --depth=350 || true - COMPARE_REV="$(git merge-base "origin/${GITHUB_BASE_REF}" HEAD)" + echo "rust=false" >> "$GITHUB_OUTPUT" fi - CHANGED_FILES="$(git diff --name-only "$COMPARE_REV" "$GITHUB_SHA")" - - check_pattern() { - local name="$1" pattern="$2" invert="${3:-false}" - if [ "$invert" = "true" ]; then - echo "$CHANGED_FILES" | grep -qvE "$pattern" && echo "${name}=true" >> "$GITHUB_OUTPUT" || echo "${name}=false" >> "$GITHUB_OUTPUT" - else - echo "$CHANGED_FILES" | grep -qE "$pattern" && echo "${name}=true" >> "$GITHUB_OUTPUT" || echo "${name}=false" >> "$GITHUB_OUTPUT" - fi - } - - check_pattern "run_tests" '^(docs/|\.github/(ISSUE_TEMPLATE|workflows/)|README\.md|CHANGELOG\.md)' true - check_pattern "run_style" '\.(rs|toml)$|rust-toolchain\.toml|\.cargo/|clippy\.toml|typos\.toml' # Formatting fmt: runs-on: ubuntu-latest + timeout-minutes: 10 needs: [orchestrate] - if: needs.orchestrate.outputs.run_style == 'true' + if: needs.orchestrate.outputs.rust == 'true' steps: - uses: actions/checkout@v7 - uses: actions-rust-lang/setup-rust-toolchain@v2 with: components: rustfmt + cache: false - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 + - uses: taiki-e/install-action@v2 + with: + tool: just - run: just fmt-check - # Clippy + # Clippy. `just clippy` passes `-D warnings` itself. clippy: runs-on: ubuntu-latest + timeout-minutes: 30 needs: [orchestrate] - if: needs.orchestrate.outputs.run_style == 'true' + if: needs.orchestrate.outputs.rust == 'true' steps: - uses: actions/checkout@v7 - uses: actions-rust-lang/setup-rust-toolchain@v2 with: components: clippy - - uses: Swatinem/rust-cache@v2 + cache-save-if: ${{ env.SAVE_RUST_CACHE }} - name: Install system deps run: | sudo apt-get update sudo apt-get install -y libxkbcommon-dev libxkbcommon-x11-dev libwayland-dev libx11-dev libxcb-shape0-dev libxcb-xfixes0-dev libfontconfig-dev - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 + - uses: taiki-e/install-action@v2 + with: + tool: just - run: just clippy # Spell check typos: runs-on: ubuntu-latest + timeout-minutes: 5 steps: - uses: actions/checkout@v7 - - uses: crate-ci/typos@v1.47.2 + - uses: crate-ci/typos@v1.52.1 with: config: typos.toml @@ -98,9 +113,12 @@ jobs: # from upstream releases and should be reviewed, not block unrelated work. lockfile: runs-on: ubuntu-latest + timeout-minutes: 10 steps: - uses: actions/checkout@v7 - uses: actions-rust-lang/setup-rust-toolchain@v2 + with: + cache: false - name: Check root lockfile freshness (warning only) shell: bash run: | @@ -115,61 +133,77 @@ jobs: warn "Cargo.lock changed after cargo update; refresh it in a dedicated dependency update." fi - # Unused dependencies + # Unused dependencies. cargo-machete reads sources and builds nothing. machete: runs-on: ubuntu-latest + timeout-minutes: 10 needs: [orchestrate] - if: needs.orchestrate.outputs.run_style == 'true' + if: needs.orchestrate.outputs.rust == 'true' steps: - uses: actions/checkout@v7 - - uses: Swatinem/rust-cache@v2 - - uses: taiki-e/install-action@cargo-machete - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 + - uses: taiki-e/install-action@v2 + with: + tool: just,cargo-machete - run: just machete - # MSRV + # MSRV. Keep `toolchain:` equal to `rust-version` in crates/gpui/Cargo.toml + # and `msrv` in the justfile. .github/renovate.json5 stops Renovate moving it. msrv: - if: github.event_name == 'pull_request' && needs.orchestrate.outputs.run_style == 'true' - needs: [orchestrate] runs-on: ubuntu-latest + timeout-minutes: 30 + needs: [orchestrate] + if: needs.orchestrate.outputs.rust == 'true' steps: - uses: actions/checkout@v7 - uses: actions-rust-lang/setup-rust-toolchain@v2 with: toolchain: 1.95.0 - - uses: Swatinem/rust-cache@v2 + cache-save-if: ${{ env.SAVE_RUST_CACHE }} - name: Install system deps run: | sudo apt-get update sudo apt-get install -y libxkbcommon-dev libxkbcommon-x11-dev libwayland-dev libx11-dev libxcb-shape0-dev libxcb-xfixes0-dev libfontconfig-dev - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 + - uses: taiki-e/install-action@v2 + with: + tool: just - run: just msrv-check # WASM target (nightly + atomics) check-wasm: - if: github.event_name == 'pull_request' && needs.orchestrate.outputs.run_style == 'true' - needs: [orchestrate] runs-on: ubuntu-latest + timeout-minutes: 30 + needs: [orchestrate] + if: needs.orchestrate.outputs.rust == 'true' steps: - uses: actions/checkout@v7 - - name: Install nightly toolchain with rust-src and WASM target - run: rustup toolchain install nightly --component rust-src --target wasm32-unknown-unknown - - uses: Swatinem/rust-cache@v2 + - uses: actions-rust-lang/setup-rust-toolchain@v2 + with: + toolchain: nightly + components: rust-src + target: wasm32-unknown-unknown + # Nightly warnings come and go with the toolchain; clippy is the + # warnings gate. + build-warnings: warn + cache-save-if: ${{ env.SAVE_RUST_CACHE }} - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 + - uses: taiki-e/install-action@v2 + with: + tool: just - run: just check-wasm-atomics # Linux build + test test-linux: runs-on: ubuntu-latest + timeout-minutes: 45 needs: [orchestrate] - if: needs.orchestrate.outputs.run_tests == 'true' + if: needs.orchestrate.outputs.rust == 'true' steps: - uses: actions/checkout@v7 - uses: actions-rust-lang/setup-rust-toolchain@v2 - - uses: Swatinem/rust-cache@v2 + with: + cache-save-if: ${{ env.SAVE_RUST_CACHE }} - name: Install system deps run: | sudo apt-get update @@ -180,7 +214,9 @@ jobs: libxkbcommon-x11-dev libegl1-mesa-dev \ libgles2-mesa-dev libglib2.0-dev libfontconfig-dev - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 + - uses: taiki-e/install-action@v2 + with: + tool: just - run: just build - run: just test - run: just test-doc @@ -192,14 +228,18 @@ jobs: # macOS build + test test-mac: runs-on: macos-latest + timeout-minutes: 45 needs: [orchestrate] - if: needs.orchestrate.outputs.run_tests == 'true' + if: needs.orchestrate.outputs.rust == 'true' steps: - uses: actions/checkout@v7 - uses: actions-rust-lang/setup-rust-toolchain@v2 - - uses: Swatinem/rust-cache@v2 + with: + cache-save-if: ${{ env.SAVE_RUST_CACHE }} - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 + - uses: taiki-e/install-action@v2 + with: + tool: just - run: just build - run: just test --features gpui_ce_wgpu/test-support - run: just test-doc @@ -211,14 +251,18 @@ jobs: # Windows build + test test-windows: runs-on: windows-latest + timeout-minutes: 60 needs: [orchestrate] - if: needs.orchestrate.outputs.run_tests == 'true' + if: needs.orchestrate.outputs.rust == 'true' steps: - uses: actions/checkout@v7 - uses: actions-rust-lang/setup-rust-toolchain@v2 - - uses: Swatinem/rust-cache@v2 + with: + cache-save-if: ${{ env.SAVE_RUST_CACHE }} - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 + - uses: taiki-e/install-action@v2 + with: + tool: just - run: just build - run: just test - run: just test-doc @@ -230,18 +274,57 @@ jobs: # Examples check-examples: runs-on: ubuntu-latest + timeout-minutes: 30 needs: [orchestrate] - if: github.event_name == 'pull_request' && needs.orchestrate.outputs.run_tests == 'true' + if: needs.orchestrate.outputs.rust == 'true' steps: - uses: actions/checkout@v7 - uses: actions-rust-lang/setup-rust-toolchain@v2 - - uses: Swatinem/rust-cache@v2 + with: + target: wasm32-unknown-unknown + cache-save-if: ${{ env.SAVE_RUST_CACHE }} - name: Install system deps run: | sudo apt-get update sudo apt-get install -y libxkbcommon-dev libxkbcommon-x11-dev libwayland-dev libx11-dev libxcb-shape0-dev libxcb-xfixes0-dev libfontconfig-dev - - name: Add WASM target - run: rustup target add wasm32-unknown-unknown - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 + - uses: taiki-e/install-action@v2 + with: + tool: just - run: just check-examples + + # The one check branch protection requires. Job names can change without + # touching the ruleset. A skipped job passes only when `orchestrate` chose to + # skip the Rust jobs; a Rust job that should have run and didn't fails it. + ci-required: + name: CI Required + if: always() + needs: + - orchestrate + - fmt + - clippy + - typos + - lockfile + - machete + - msrv + - check-wasm + - test-linux + - test-mac + - test-windows + - check-examples + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + - env: + NEEDS: ${{ toJSON(needs) }} + RUST: ${{ needs.orchestrate.outputs.rust }} + run: | + echo "$NEEDS" | jq -r 'to_entries[] | "\(.key): \(.value.result)"' + allowed='["success"]' + if [ "$RUST" = "false" ]; then allowed='["success","skipped"]'; fi + bad="$(echo "$NEEDS" | jq -r --argjson ok "$allowed" \ + '[to_entries[] | select(.value.result as $r | $ok | index($r) | not) | .key] | join(", ")')" + if [ -n "$bad" ]; then + echo "::error title=CI Required::Not successful: $bad" + exit 1 + fi diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml deleted file mode 100644 index 7e27e1fe053..00000000000 --- a/.github/workflows/prerelease.yml +++ /dev/null @@ -1,87 +0,0 @@ -# Publish the development snapshots for the next committed gpui-ce release. -# Every publishable workspace crate is published at the same crates.io-only -# version, in dependency order. No alpha tag or alpha-version commit is created -# in this repository. -name: Publish prerelease - -on: - workflow_run: - workflows: [CI] - types: [completed] - -concurrency: - # crates.io versions are IMMUTABLE, so alpha numbers must be allocated in - # order even when main receives several commits in quick succession! - group: gpui-ce-registry-publish - cancel-in-progress: false - -permissions: - contents: read - -env: - CARGO_TERM_COLOR: always - RUST_BACKTRACE: 1 - -jobs: - version: - if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main' - runs-on: ubuntu-latest - outputs: - publish: ${{ steps.version.outputs.publish }} - version: ${{ steps.version.outputs.version }} - steps: - - uses: actions/checkout@v7 - with: - ref: ${{ github.event.workflow_run.head_sha }} - fetch-depth: 0 - - uses: actions-rust-lang/setup-rust-toolchain@v2 - - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 - - id: version - name: Allocate the next crates.io alpha version - run: just alpha-version "$HEAD_SHA" - env: - HEAD_SHA: ${{ github.event.workflow_run.head_sha }} - - publish: - needs: version - if: needs.version.outputs.publish == 'true' - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - with: - ref: ${{ github.event.workflow_run.head_sha }} - fetch-depth: 0 - - uses: actions-rust-lang/setup-rust-toolchain@v2 - - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 - - name: Publish every crate in dependency order - run: just alpha-publish "$VERSION" "$HEAD_SHA" - env: - VERSION: ${{ needs.version.outputs.version }} - HEAD_SHA: ${{ github.event.workflow_run.head_sha }} - CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} - - smoke: - # Prove the published set resolves and compiles for a consumer. - needs: [version, publish] - if: needs.version.outputs.publish == 'true' && needs.publish.result == 'success' - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - with: - ref: ${{ github.event.workflow_run.head_sha }} - - uses: actions-rust-lang/setup-rust-toolchain@v2 - - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 - - name: Install package build dependencies - run: | - sudo apt-get update - sudo apt-get install -y \ - libxkbcommon-dev libwayland-dev libx11-dev \ - libxcb-shape0-dev libxcb-xfixes0-dev libxcb-randr0-dev \ - libxcb-xinput-dev libxkbcommon-x11-dev libfontconfig-dev - - name: Compile a fresh consumer crate against the snapshot - run: just alpha-smoke "$VERSION" - env: - VERSION: ${{ needs.version.outputs.version }} diff --git a/.github/workflows/release-pr-check.yml b/.github/workflows/release-pr-check.yml deleted file mode 100644 index 2123e35b18d..00000000000 --- a/.github/workflows/release-pr-check.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: Release check - -on: - pull_request: - branches: [main] - types: [opened, synchronize, reopened, labeled, unlabeled] - -permissions: - contents: read - -jobs: - check: - # Release PRs are identified by their branch, matching `just release-pr-open` - if: startsWith(github.head_ref, 'release/v') && github.event.pull_request.head.repo.full_name == github.repository - runs-on: ubuntu-latest - env: - HEAD_REF: ${{ github.head_ref }} - LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }} - steps: - - uses: actions/checkout@v7 - - uses: actions-rust-lang/setup-rust-toolchain@v2 - - uses: Swatinem/rust-cache@v2 - - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 - - name: Branch, label and version agree - run: just release-pr-check "$HEAD_REF" "$LABELS" - - name: Changelog, lockstep versions and crates.io availability - run: just release-check true - - name: Dry-run publish of the whole crate graph - run: just publish true diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml deleted file mode 100644 index d36f2af289a..00000000000 --- a/.github/workflows/release-pr.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: Prepare release PR - -on: - workflow_dispatch: - inputs: - version: - description: 'Version to release, stable MAJOR.MINOR.PATCH (e.g. 0.4.0)' - required: true - -permissions: - contents: write - pull-requests: write - -jobs: - prepare: - runs-on: ubuntu-latest - env: - VERSION: ${{ inputs.version }} - # Pull requests opened with the default GITHUB_TOKEN do not trigger CI. - # Provide a PAT or GitHub App token as RELEASE_PR_TOKEN so the required - # checks run on the release PR (see MAINTENANCE.md). - GH_TOKEN: ${{ secrets.RELEASE_PR_TOKEN || secrets.GITHUB_TOKEN }} - steps: - - uses: actions/checkout@v7 - with: - token: ${{ secrets.RELEASE_PR_TOKEN || secrets.GITHUB_TOKEN }} - - uses: actions-rust-lang/setup-rust-toolchain@v2 - - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 - - run: just release-pr-open "$VERSION" diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml deleted file mode 100644 index 60f91f174ac..00000000000 --- a/.github/workflows/release-tag.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: Tag release - -on: - push: - branches: [main] - # A release PR always rolls the CHANGELOG - paths: [CHANGELOG.md, crates/gpui/Cargo.toml] - -permissions: - contents: read - -concurrency: - group: gpui-ce-release-tag - cancel-in-progress: false - -jobs: - tag: - runs-on: ubuntu-latest - permissions: - contents: write - pull-requests: read - outputs: - tag: ${{ steps.detect.outputs.tag }} - steps: - - uses: actions/checkout@v7 - with: - fetch-depth: 0 - - uses: actions-rust-lang/setup-rust-toolchain@v2 - - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 - - id: detect - name: Tag if this push is a merged release PR - run: just release-tag - env: - GH_TOKEN: ${{ github.token }} - - release: - needs: tag - if: needs.tag.outputs.tag != '' - uses: ./.github/workflows/release.yml - with: - tag: ${{ needs.tag.outputs.tag }} - secrets: inherit - permissions: - contents: write diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index 27aae06147d..00000000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,135 +0,0 @@ -# Publish to crates on a version tag push, or when release-tag.yml calls it -# after a release PR merges (tags pushed with GITHUB_TOKEN trigger no workflows, -# so that path calls this one directly instead of relying on the tag push). -name: Release - -on: - push: - tags: - - 'v*' - workflow_call: - inputs: - tag: - description: 'Tag to release, e.g. v0.4.0' - required: true - type: string - workflow_dispatch: - inputs: - dry_run: - description: 'Dry run (no actual publish)' - required: false - default: 'false' - -env: - CARGO_TERM_COLOR: always - RUST_BACKTRACE: 1 - RELEASE_TAG: ${{ inputs.tag || github.ref_name }} - -# Stable and alpha uploads share a registry namespace. Do not let a stable tag -# overtake an alpha allocation (or vice versa). -concurrency: - group: gpui-ce-registry-publish - cancel-in-progress: false - -jobs: - # Determine pre-release status - prerelease: - runs-on: ubuntu-latest - outputs: - value: ${{ steps.check.outputs.value }} - version: ${{ steps.check.outputs.version }} - steps: - - uses: actions/checkout@v7 - with: - ref: ${{ env.RELEASE_TAG }} - - id: check - run: | - VERSION="${RELEASE_TAG#v}" - echo "version=$VERSION" >> "$GITHUB_OUTPUT" - if [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then - echo "value=false" >> "$GITHUB_OUTPUT" - else - echo "value=true" >> "$GITHUB_OUTPUT" - fi - - # Run full CI on the tag via justfile - verify: - needs: [prerelease] - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - with: - ref: ${{ env.RELEASE_TAG }} - - uses: actions-rust-lang/setup-rust-toolchain@v2 - with: - components: clippy, rustfmt - - uses: Swatinem/rust-cache@v2 - - name: Install system deps - run: | - sudo apt-get update - sudo apt-get install -y \ - libxkbcommon-dev libwayland-dev libx11-dev \ - libxcb-shape0-dev libxcb-xfixes0-dev \ - libxcb-randr0-dev libxcb-xinput-dev \ - libxkbcommon-x11-dev libegl1-mesa-dev \ - libgles2-mesa-dev libglib2.0-dev libfontconfig-dev \ - libgtk-3-dev \ - libjavascriptcoregtk-4.1-dev libwebkit2gtk-4.1-dev \ - libsoup-3.0-dev - - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 - - run: just fmt-check - - run: just clippy - - run: just build - - run: just test - - run: just test-doc - - # Verify packages are publishable - verify-publish: - needs: [prerelease, verify] - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - with: - ref: ${{ env.RELEASE_TAG }} - - uses: actions-rust-lang/setup-rust-toolchain@v2 - - uses: Swatinem/rust-cache@v2 - - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 - - name: Dry-run publish check - run: just publish true - - # Publish to crates.io - publish: - needs: [prerelease, verify-publish] - runs-on: ubuntu-latest - if: github.event_name != 'workflow_dispatch' || github.event.inputs.dry_run != 'true' - steps: - - uses: actions/checkout@v7 - with: - ref: ${{ env.RELEASE_TAG }} - - uses: actions-rust-lang/setup-rust-toolchain@v2 - - uses: Swatinem/rust-cache@v2 - - uses: hustcer/setup-nu@v3 - - uses: extractions/setup-just@v4 - - run: just publish - env: - CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} - - # Create GitHub Release - github-release: - needs: [prerelease, publish] - runs-on: ubuntu-latest - permissions: - contents: write - steps: - - uses: actions/checkout@v7 - with: - ref: ${{ env.RELEASE_TAG }} - - uses: softprops/action-gh-release@v3 - with: - tag_name: ${{ env.RELEASE_TAG }} - draft: true - prerelease: ${{ needs.prerelease.outputs.value }} - generate_release_notes: true - name: ${{ needs.prerelease.outputs.version }} diff --git a/.github/workflows/vouch-check-issue.yml b/.github/workflows/vouch-check-issue.yml deleted file mode 100644 index cccad6d4a0f..00000000000 --- a/.github/workflows/vouch-check-issue.yml +++ /dev/null @@ -1,31 +0,0 @@ -on: - issues: - types: [opened, reopened] - -name: "Vouch - Check Issue" - -jobs: - check: - runs-on: ubuntu-latest - steps: - # acquire a token that allows vouch actions to mutate repository - - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 - id: app-token - with: - client-id: ${{ vars.VOUCH_CLIENT_ID }} - private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }} - - # grab the unvounched message file from the repository, so it can be used by the bot - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - sparse-checkout: .github/issue-unvouched-message - - # bot checks the issue; if unvounched then add a comment and close+lock the issue - - uses: gpui-ce/vouch/action/check-issue@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0 - with: - issue-number: ${{ github.event.issue.number }} - auto-close: true - auto-lock: true - template-file: .github/issue-unvouched-message - env: - GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/vouch-check-pr.yml b/.github/workflows/vouch-check-pr.yml deleted file mode 100644 index 48d710795c2..00000000000 --- a/.github/workflows/vouch-check-pr.yml +++ /dev/null @@ -1,30 +0,0 @@ -on: - pull_request_target: - types: [opened, reopened] - -name: "Vouch - Check PR" - -jobs: - check: - runs-on: ubuntu-latest - steps: - # acquire a token that allows vouch actions to mutate repository - - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 - id: app-token - with: - client-id: ${{ vars.VOUCH_CLIENT_ID }} - private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }} - - # grab the unvounched message file from the repository, so it can be used by the bot - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - sparse-checkout: .github/issue-unvouched-message - - # bot checks the PR; if unvounched then close the PR - - uses: gpui-ce/vouch/action/check-pr@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0 - with: - pr-number: ${{ github.event.pull_request.number }} - auto-close: true - template-file: .github/issue-unvouched-message - env: - GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/vouch-manage-by-discussion.yml b/.github/workflows/vouch-manage-by-discussion.yml deleted file mode 100644 index 278f5355e33..00000000000 --- a/.github/workflows/vouch-manage-by-discussion.yml +++ /dev/null @@ -1,35 +0,0 @@ -on: - discussion_comment: - types: [created] - -name: "Vouch - Manage by Discussion" - -concurrency: - group: vouch-manage - cancel-in-progress: false - -jobs: - manage: - runs-on: ubuntu-latest - steps: - - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 - id: app-token - with: - client-id: ${{ vars.VOUCH_CLIENT_ID }} - private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }} - - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - token: ${{ steps.app-token.outputs.token }} - - - uses: gpui-ce/vouch/action/manage-by-discussion@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0 - with: - discussion-number: ${{ github.event.discussion.number }} - comment-node-id: ${{ github.event.comment.node_id }} - vouch-keyword: "!vouch" - denounce-keyword: "!denounce" - unvouch-keyword: "!unvouch" - pull-request: "true" - merge-immediately: "true" - env: - GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/vouch-manage-by-issue.yml b/.github/workflows/vouch-manage-by-issue.yml deleted file mode 100644 index 6c985426c03..00000000000 --- a/.github/workflows/vouch-manage-by-issue.yml +++ /dev/null @@ -1,36 +0,0 @@ -on: - issue_comment: - types: [created] - -name: "Vouch - Manage by Issue" - -concurrency: - group: vouch-manage - cancel-in-progress: false - -jobs: - manage: - runs-on: ubuntu-latest - steps: - - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 - id: app-token - with: - client-id: ${{ vars.VOUCH_CLIENT_ID }} - private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }} - - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - token: ${{ steps.app-token.outputs.token }} - - - uses: gpui-ce/vouch/action/manage-by-issue@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0 - with: - repo: ${{ github.repository }} - issue-id: ${{ github.event.issue.number }} - comment-id: ${{ github.event.comment.id }} - vouch-keyword: "!vouch" - denounce-keyword: "!denounce" - unvouch-keyword: "!unvouch" - pull-request: "true" - merge-immediately: "true" - env: - GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} From c6b9c5bad8e47df013d002be43338ffabda25a3e Mon Sep 17 00:00:00 2001 From: Christopher Addison Date: Fri, 13 Nov 2026 09:37:21 -0500 Subject: [PATCH 2/3] ci(HUB-0000): keep cargo build warnings as warnings setup-rust-toolchain v2 sets CARGO_BUILD_WARNINGS=deny, which fails every build on cargo 1.100's manifest lints in upstream crates. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 878a6a2243b..eb462b2dd05 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,6 +24,10 @@ env: CARGO_TERM_COLOR: always RUST_BACKTRACE: 1 CARGO_INCREMENTAL: 0 + # setup-rust-toolchain v2 defaults this to `deny`, which also fails the build + # on cargo 1.100's manifest lints (unused dependencies, missing `[lints]`) in + # upstream crates. Clippy's `-D warnings` stays the warnings gate. + CARGO_BUILD_WARNINGS: warn # Only branch pushes save Rust caches. Each PR saving its own ~1 GB entry # filled the 10 GB repo budget, and no other PR could read them anyway. SAVE_RUST_CACHE: ${{ github.event_name == 'push' }} @@ -183,9 +187,6 @@ jobs: toolchain: nightly components: rust-src target: wasm32-unknown-unknown - # Nightly warnings come and go with the toolchain; clippy is the - # warnings gate. - build-warnings: warn cache-save-if: ${{ env.SAVE_RUST_CACHE }} - uses: hustcer/setup-nu@v3 - uses: taiki-e/install-action@v2 From 4981bf1d7b4c2cf1cdfacadcc75328b6e55cc21e Mon Sep 17 00:00:00 2001 From: Christopher Addison Date: Fri, 13 Nov 2026 09:37:51 -0500 Subject: [PATCH 3/3] ci(HUB-0000): keep rustc warnings fatal as setup-rust-toolchain v1 did Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index eb462b2dd05..d931c0de654 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,7 +26,8 @@ env: CARGO_INCREMENTAL: 0 # setup-rust-toolchain v2 defaults this to `deny`, which also fails the build # on cargo 1.100's manifest lints (unused dependencies, missing `[lints]`) in - # upstream crates. Clippy's `-D warnings` stays the warnings gate. + # upstream crates. Jobs that compile pass `rustflags: -D warnings` instead, + # as v1 did, so rustc warnings still fail on every platform. CARGO_BUILD_WARNINGS: warn # Only branch pushes save Rust caches. Each PR saving its own ~1 GB entry # filled the 10 GB repo budget, and no other PR could read them anyway. @@ -93,6 +94,7 @@ jobs: with: components: clippy cache-save-if: ${{ env.SAVE_RUST_CACHE }} + rustflags: -D warnings - name: Install system deps run: | sudo apt-get update @@ -164,6 +166,7 @@ jobs: with: toolchain: 1.95.0 cache-save-if: ${{ env.SAVE_RUST_CACHE }} + rustflags: -D warnings - name: Install system deps run: | sudo apt-get update @@ -205,6 +208,7 @@ jobs: - uses: actions-rust-lang/setup-rust-toolchain@v2 with: cache-save-if: ${{ env.SAVE_RUST_CACHE }} + rustflags: -D warnings - name: Install system deps run: | sudo apt-get update @@ -237,6 +241,7 @@ jobs: - uses: actions-rust-lang/setup-rust-toolchain@v2 with: cache-save-if: ${{ env.SAVE_RUST_CACHE }} + rustflags: -D warnings - uses: hustcer/setup-nu@v3 - uses: taiki-e/install-action@v2 with: @@ -260,6 +265,7 @@ jobs: - uses: actions-rust-lang/setup-rust-toolchain@v2 with: cache-save-if: ${{ env.SAVE_RUST_CACHE }} + rustflags: -D warnings - uses: hustcer/setup-nu@v3 - uses: taiki-e/install-action@v2 with: @@ -284,6 +290,7 @@ jobs: with: target: wasm32-unknown-unknown cache-save-if: ${{ env.SAVE_RUST_CACHE }} + rustflags: -D warnings - name: Install system deps run: | sudo apt-get update