feat(ci): GitHub Actions parity with go template (CD, security scan, codecov) - #14
Merged
Conversation
…ontract
Mirrors zercle-go-template: each feature carries contract/domain/port/
application/adapter/{driving,driven}/di layers; platform/ replaces shared/ +
infrastructure/ + middleware/ + config.rs; a published api::v1 facade exposes
the inbound contract types + error codes outward-only.
- tests/architecture.rs: executable dependency gates (domain innermost,
contract leaf, port->own domain, application->domain+port+contract,
driving/driven adapter isolation, platform feature-agnostic, api
facade outward-only); dedicated CI Architecture job
- platform/server decoupled from features: AppState + grpc_server() builder
live in the shell; features hand over pre-mounted axum routers and a
tonic Router via di::register
- application::Service speaks contract types at the boundary; wire-id
parsing unified in the usecase (one validation path for HTTP + gRPC)
- sentinel->AppError mapping registered in feature di (RegisterSentinel
parity), keeping the domain layer dependency-free
- ci: integration job now runs the FULL suite against postgres+valkey
service containers (--include-ignored); all actions pinned to commit
SHAs; persist-credentials: false on every checkout
- docs: README architecture/CI/testing sections rewritten for the new
layout; Taskfile gains test-architecture, fixes stale --ignored
invocations and a pre-existing YAML plain-scalar bug in the proto task
Verified: fmt=0; clippy --locked -D warnings=0; cargo test 104 passed /
0 failed (incl. live postgres+valkey e2e + HTTP integration);
architecture mutation probe red->green.
BREAKING CHANGE: module paths changed (shared/infrastructure/middleware
folded into platform/; feature modules re-layered; config moved to
platform::config).
…go template) - cd.yml: multi-arch (amd64/arm64) server + migrate images to ghcr.io on v* tags. Unlike the Go CD single buildx call, each platform is built natively (arm64 on an arm64 runner) with per-arch musl build-args, pushed by digest, then merged into manifest lists. - security.yml: weekly Trivy SARIF scan + cargo-audit (RustSec, the go template's govulncheck counterpart). - ci.yml: upload lcov coverage to codecov (non-blocking), matching the go CI's codecov step. - All actions pinned by SHA, consistent with the repo's existing CI.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings the Rust template's
.githubup to parity withzercle-go-template/.github:cd.yml(new): onv*tag push, builds and pushes multi-arch (amd64/arm64)server+migrateimages toghcr.io, mirroring the Go CD. Key divergence (documented in the file header):build-push-actioncan't vary build-args per platform and the Rust musl cross-compile setup is arch-specific, so each platform is built natively (arm64 leg on a nativeubuntu-24.04-armrunner — no QEMU), pushed by digest, then merged into manifest lists.security.yml(new): weekly Trivy SARIF scan +cargo-audit(RustSec — the counterpart of the Go template'sgovulncheck).ci.yml: non-blocking codecov upload of the lcov report, matching the Go CI's codecov step.dependabot.yml: no change — already at parity (cargoecosystem entry).Note: the PR also carries the clean-architecture restructure commit (
b8a4f05) already merged tomainvia #13, bringingdevelopup to date.Verification
actionlintclean on all workflows.docker(digest args and tag set verified under bash).ARGs inContainerfile/Containerfile.migrate(RUST_MUSL_TAG,MUSL_TARGET,MUSL_GCC,MUSL_TARGET_UNDERSCORE,MUSL_TARGET_UPPER,VERSION,COMMIT_SHA,BUILD_TIME).