Repository navigation

docs(security): note CVE-2026-43868 in thrift Rust crate; ci: skip docs-only PRs #23

Workflow file for this run

	name: ci

	# Core CI: formatting, linting, workspace tests, and a publish dry-run
	# of hyperdb-bootstrap. Separate from verify-hyperd-pin.yml, which only
	# HEADs the pinned release's URLs.

	on:
	# Pure-prose changes don't affect Rust compilation, lint output,
	# advisory checks, or the publish dry-run. The paths-ignore lists
	# below skip CI on docs-only PRs to avoid burning CI minutes. Note:
	# `deny.toml` and `.cargo/audit.toml` are deliberately NOT in the
	# ignore list — those files configure the security checks themselves
	# and a typo would silently disable them. Keep the two lists in sync.
	push:
	branches: [main]
	paths-ignore:
	- "*/.md"
	- "docs/**"
	- "LICENSE-*"
	- "NOTICE"
	- ".github/ISSUE_TEMPLATE/**"
	- ".github/pull_request_template.md"
	pull_request:
	paths-ignore:
	- "*/.md"
	- "docs/**"
	- "LICENSE-*"
	- "NOTICE"
	- ".github/ISSUE_TEMPLATE/**"
	- ".github/pull_request_template.md"
	workflow_dispatch: {}

	# Cancel a PR's in-progress CI runs when a new push lands on the PR.
	# Pushes to main always run to completion.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	env:
	CARGO_TERM_COLOR: always
	RUST_BACKTRACE: 1

	jobs:
	fmt:
	name: rustfmt
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@v6
	- uses: actions-rust-lang/setup-rust-toolchain@v1
	with:
	toolchain: stable
	components: rustfmt
	cache: false
	# Disable the action's default RUSTFLAGS=-D warnings; workspace
	# lint policy lives in [workspace.lints] in Cargo.toml, and
	# promoting warn-level lints to errors at the env level would
	# break local-friendly behaviors elsewhere.
	rustflags: ""
	- run: cargo fmt --all --check

	clippy:
	# Clippy lints are platform-independent, so a single runner is enough.
	# If a lint ever diverges by target (rare), broaden the matrix.
	name: clippy
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- uses: actions/checkout@v6
	- name: Install system libraries (fontconfig for plotters, mold for fast linking, protobuf)
	run: sudo apt-get update -q && sudo apt-get install -y libfontconfig1-dev mold protobuf-compiler
	- uses: actions-rust-lang/setup-rust-toolchain@v1
	with:
	toolchain: stable
	components: clippy
	cache-key: clippy
	# See fmt job for rationale; clippy enforces -D warnings via
	# the explicit `-- -D warnings` arg below, not via env.
	rustflags: ""
	- name: Clippy (workspace, all targets)
	# Every crate in the workspace is linted under the Microsoft Rust
	# Guidelines config in `[workspace.lints]` (see Cargo.toml and
	# docs/RUST_GUIDELINES.md). Warnings are treated as errors.
	run: cargo clippy --workspace --all-targets --all-features -- -D warnings

	test:
	name: test (${{ matrix.os }})
	runs-on: ${{ matrix.os }}
	timeout-minutes: 45
	strategy:
	fail-fast: false
	matrix:
	os: [ubuntu-latest, macos-14, windows-latest]
	steps:
	- uses: actions/checkout@v6
	- name: Free disk space (Linux only)
	if: runner.os == 'Linux'
	run: \|
	sudo rm -rf /usr/local/lib/android
	sudo rm -rf /usr/share/dotnet
	sudo rm -rf /opt/ghc
	sudo rm -rf /usr/local/share/boost
	- name: Install system libraries (Linux)
	if: runner.os == 'Linux'
	run: sudo apt-get update -q && sudo apt-get install -y libfontconfig1-dev mold protobuf-compiler
	- name: Install protobuf (macOS)
	if: runner.os == 'macOS'
	run: brew install protobuf
	- name: Install protobuf (Windows)
	if: runner.os == 'Windows'
	run: choco install protoc -y
	- name: Remove pre-installed Homebrew rust (macOS)
	# Recent macos-14 runner images ship Homebrew's `rust` package,
	# which symlinks `cargo` to `rustup-init`. With no toolchain
	# installed, `cargo test` then invokes rustup-init's CLI parser
	# and fails with "unexpected argument 'test' found". Removing
	# brew's rust before installing the real toolchain avoids the
	# symlink shadowing.
	if: runner.os == 'macOS'
	shell: bash
	run: \|
	brew list rust >/dev/null 2>&1 && brew uninstall --ignore-dependencies rust \|\| true
	rm -f /usr/local/bin/cargo /usr/local/bin/rustc /usr/local/bin/rustup-init \|\| true
	rm -f /opt/homebrew/bin/cargo /opt/homebrew/bin/rustc /opt/homebrew/bin/rustup-init \|\| true

	- uses: actions-rust-lang/setup-rust-toolchain@v1
	with:
	toolchain: stable
	# Keep this cache separate from the clippy job's; the test
	# profile has different artifacts and mixing them causes
	# unnecessary rebuilds.
	cache-key: test-${{ matrix.os }}
	# See fmt job for rationale.
	rustflags: ""

	- name: Cache hyperd binary
	# Keyed on the pinned release file, so bumping the pin
	# (hyperdb-bootstrap/hyperd-version.toml) invalidates the cache
	# automatically and the next run re-downloads.
	id: hyperd-cache
	uses: actions/cache@v4
	with:
	path: .hyperd
	key: hyperd-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('hyperdb-bootstrap/hyperd-version.toml') }}

	- name: Download hyperd
	if: steps.hyperd-cache.outputs.cache-hit != 'true'
	run: cargo run --release -p hyperdb-bootstrap --bin hyperdb-bootstrap -- download

	- name: Workspace tests
	shell: bash
	env:
	# .hyperd/current accepts either a file or directory per the
	# hyperdb-api process loader; passing the directory keeps the
	# command identical across OSes (hyperd vs hyperd.exe).
	HYPERD_PATH: ${{ github.workspace }}/.hyperd/current
	run: \|
	cargo test --workspace \
	--exclude hyperdb-api-node \
	--exclude hyperdb-bootstrap
	# hyperdb-api-node needs napi-rs + a Node.js toolchain; it gets
	# its own workflow when wired up. hyperdb-bootstrap has its own
	# coverage (next step) and doesn't need hyperd running.

	- name: hyperdb-bootstrap tests
	run: cargo test -p hyperdb-bootstrap

	publish-dry-run:
	# Catches Cargo.toml metadata regressions (missing license, bad
	# include paths, etc.) on the subset of crates that have no
	# workspace deps — those are the only ones `cargo publish --dry-run`
	# can check before anything's on crates.io. The other 4 crates
	# (hyperdb-api-core, hyperdb-api-salesforce, hyperdb-api, hyperdb-mcp)
	# resolve their path+version deps against the live index, which can't
	# succeed until those deps are themselves published. (Note:
	# hyperdb-api-core has an optional workspace dep on
	# hyperdb-api-salesforce via its `salesforce-auth` feature, which
	# triggers the same path-resolution failure even though the dep is
	# optional.) They're exercised end-to-end by release.yml at tag
	# time, when the whole wave ships together.
	name: publish dry-run
	runs-on: ubuntu-latest
	timeout-minutes: 15
	steps:
	- uses: actions/checkout@v6
	- name: Install mold linker
	run: sudo apt-get update -q && sudo apt-get install -y mold
	- uses: actions-rust-lang/setup-rust-toolchain@v1
	with:
	toolchain: stable
	cache-key: publish-dry-run
	rustflags: ""
	- run: \|
	cargo publish -p hyperdb-bootstrap --dry-run
	cargo publish -p sea-query-hyperdb --dry-run

	deny:
	# Enforces license allowlist, advisory ignore list, and banned-source
	# rules from deny.toml. Pairs with the `audit` job — `cargo-deny` and
	# `cargo-audit` have separate ignore mechanisms; both must agree.
	name: cargo-deny
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@v6
	- uses: EmbarkStudios/cargo-deny-action@v2
	with:
	command: check
	arguments: --all-features --workspace

	audit:
	# Enforces the RustSec advisory ignore list in .cargo/audit.toml.
	# Fails on any unfixed advisory for a crate in the lockfile.
	name: cargo-audit
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@v6
	- uses: actions-rust-lang/setup-rust-toolchain@v1
	with:
	toolchain: stable
	cache-key: audit
	rustflags: ""
	- run: cargo install cargo-audit --locked
	- run: cargo audit --deny warnings

Navigation Menu

Repository navigation

docs(security): note CVE-2026-43868 in thrift Rust crate; ci: skip docs-only PRs #23

Workflow file

docs(security): note CVE-2026-43868 in thrift Rust crate; ci: skip docs-only PRs #23

Uh oh!

Workflow file for this run