ci: adopt the fleet reusable workflow - #9
Merged
Merged
Conversation
Replaces the hand-maintained ci.yml with a call to
SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml, pinned to
619094ad54edc586f5c2733358e00326b30790bd.
What the old gate enforced, and where each piece went:
fmt / clippy / test (3-OS) / deny / secrets / docs / fuzz-check
-> the shared workflow's equivalent jobs, same shape.
msrv (1.96, `cargo test --all-features`) and
msrv-libs (1.80, `cargo build -p sqlite-core -p sqlite-forensic`)
-> the shared per-member MSRV matrix, which reads each member's declared
rust-version: sqlite-cli 1.96, sqlite-core 1.80, sqlite-forensic 1.80.
msrv-check is left at the default `build`. `test` would newly RUN the
suite at 1.80, which the old msrv-libs job never did; `build` only
drops the test-at-1.96 strictness, and the stable test job still
covers that ground.
coverage (`--fail-under-functions 100`)
-> kept VERBATIM as the `coverage` job, with coverage-gate: "off" on the
call. The shared coverage inputs express LINE gates only; inheriting
the `strict` default would impose a 100%-line gate this repo has never
met (measured on this tree: 100.00% functions, 97.02% lines).
package completeness / geiger
-> copied verbatim below `ci:`, unchanged.
The caller keeps `env: RUSTFLAGS: -D warnings` because a called workflow does
not inherit the caller's env — without it the three verbatim jobs would run
relaxed relative to before.
NEW gate this adoption adds: cargo-vet. The repo carries supply-chain/
{config,audits,imports}.toml but its ci.yml had no vet job, and the shared
workflow runs one by default. Left on deliberately (ADR-0018), flagged here
because it is an addition, not a carry-over.
Knowingly NOT carried across (no input expresses it):
* `cargo test` on DEFAULT features. The old test job ran the suite twice,
once default and once --all-features; the shared job runs --all-features
only.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`ci / cargo-deny` fails on this PR, and not because of anything in this
repository. The pin `619094ad` predates the one commit that changed
`deny-config-repo`'s default, so CI runs:
deny-config-repo: SecurityRonin/fleet-config
cargo deny check --config .fleet-config/deny.toml all
The shared config carries 21 bare RUSTSEC ignores with no reason and no removal
condition, and — the part that matters here — it OVERRIDES this repo's own
deny.toml, which already carries honest, reasoned ignores with removal
conditions for exactly the advisories now being reported.
Measured both ways: against this repo's own config `cargo deny check` passes;
against the shared config it fails. So the failure is the wrong config being
used, not a missing suppression. Adding new ignores would be suppression layered
on top of policy that already passes.
Repinned to f9802dca, where the default is the repository's own deny.toml and
opting into the shared one is explicit. One line; no deny.toml, vet or source
change anywhere.
Pinning a dependency down to keep this repo's declared MSRV achievable moved the resolved set, and the vet store had no record for the versions that came out. Each takes the strongest mechanism that applies per ADR-0018: publisher trust for crates we publish or whose publisher an imported aggregate auditor already vouches for, and honest [[exemptions]] only for the remainder. An exemption asserts that nobody audited the crate — equally true before and after a version change — so refreshing one claims nothing new. No `cargo vet certify --accept-all`: a certify record asserts a human read the source, so bulk-certifying fabricates the condition being claimed. audits.toml carries zero self-certified entries after this change. `cargo vet --locked` passes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ci: adopt the fleet reusable workflow
Replaces the hand-maintained ci.yml with a call to
SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml, pinned to
619094ad54edc586f5c2733358e00326b30790bd.
What the old gate enforced, and where each piece went:
fmt / clippy / test (3-OS) / deny / secrets / docs / fuzz-check
-> the shared workflow's equivalent jobs, same shape.
msrv (1.96,
cargo test --all-features) andmsrv-libs (1.80,
cargo build -p sqlite-core -p sqlite-forensic)-> the shared per-member MSRV matrix, which reads each member's declared
rust-version: sqlite-cli 1.96, sqlite-core 1.80, sqlite-forensic 1.80.
msrv-check is left at the default
build.testwould newly RUN thesuite at 1.80, which the old msrv-libs job never did;
buildonlydrops the test-at-1.96 strictness, and the stable test job still
covers that ground.
coverage (
--fail-under-functions 100)-> kept VERBATIM as the
coveragejob, with coverage-gate: "off" on thecall. The shared coverage inputs express LINE gates only; inheriting
the
strictdefault would impose a 100%-line gate this repo has nevermet (measured on this tree: 100.00% functions, 97.02% lines).
package completeness / geiger
-> copied verbatim below
ci:, unchanged.The caller keeps
env: RUSTFLAGS: -D warningsbecause a called workflow doesnot inherit the caller's env — without it the three verbatim jobs would run
relaxed relative to before.
NEW gate this adoption adds: cargo-vet. The repo carries supply-chain/
{config,audits,imports}.toml but its ci.yml had no vet job, and the shared
workflow runs one by default. Left on deliberately (ADR-0018), flagged here
because it is an addition, not a carry-over.
Knowingly NOT carried across (no input expresses it):
cargo teston DEFAULT features. The old test job ran the suite twice,once default and once --all-features; the shared job runs --all-features
only.
Co-Authored-By: Claude Opus 5 noreply@anthropic.com
🤖 Generated with Claude Code