ci.yml

name: CI

# The check that gates a merge, and deliberately nothing else: lint, the unit
# tests and a release build on the default gnu target, on every push to main
# and every PR. It should stay a few minutes.
#
# The slower and privileged half of the suite -- the musl target that is
# actually published, the root Landlock regressions in scripts/, and fuzzing --
# lives in assurance.yml, on push-to-main and a nightly schedule. Dependency
# advisories live in audit.yml. Splitting them is the only way to have both:
# a fast required check, and evidence that the isolation properties still hold.
#
# Actions are pinned by commit SHA (the tag comment says which release), because
# a mutable tag on a third-party action is a supply-chain hole in a repo whose
# other workflow publishes a root-executed binary.

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    name: lint, test and build (gnu)
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Cache cargo registry and build artifacts
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      # First, because it is the cheapest way to fail and it compiles what the
      # test step needs anyway. `--all-targets` so the test modules are linted
      # too: most of the security assertions now live in them.
      - name: Lint
        run: cargo clippy --locked --all-targets -- -D warnings

      - name: Run tests
        run: cargo test --locked

      # --locked everywhere: Cargo.lock is the reviewed dependency set, and a
      # build that quietly resolves something newer is not the build that was
      # reviewed. Also what publish.yml does, so the two cannot drift.
      - name: Build release
        run: cargo build --locked --release