Add CI, cargo-deny and publish to crates.io on release

.github/workflows/ci.yml

@@ -1,21 +1,128 @@
 name: CI
 
+# One workflow for the three operating systems. Per system a single job runs
+# clippy, the all-features check and the tests one after the other, so the
+# expensive part of the build (reqwest/rustls, jsonwebtoken)
+# is compiled once and shared. Pull requests only read the build cache; it is
+# written by pushes to master.
+#
+# `Cargo.lock` is not versioned (this is a library), so there is no `--locked`:
+# CI builds against the newest dependencies that `Cargo.toml` allows, which is
+# what a consumer of the crate gets.
 on:
+  pull_request:
+    branches: [master]
+    paths-ignore:
+      - "**.md"
   push:
-    branches: [ master ]
+    branches: [master]
+    paths-ignore:
+      - "**.md"
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  # A new push to a pull request replaces the run in progress; a run on master
+  # always finishes.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+env:
+  CARGO_INCREMENTAL: 0
+  CARGO_NET_RETRY: 10
+  CARGO_TERM_COLOR: always
+  CARGO_HTTP_MULTIPLEXING: false
+  # Backtraces with line numbers only: smaller artifacts and a faster build.
+  CARGO_PROFILE_DEV_DEBUG: line-tables-only
+  RUST_BACKTRACE: 1
 
 jobs:
-  build:
+  fmt:
+    name: fmt
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --all -- --check
+
+  # Every system: some code is platform-specific, so a library is checked
+  # natively on each one.
+  test:
+    name: clippy and test on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          save-if: ${{ github.ref == 'refs/heads/master' }}
+          # A failed run still leaves the dependencies compiled for the next one.
+          cache-on-failure: true
+      # Library, tests, examples and doc tests. The tests that need EVE
+      # credentials are `#[ignore]`d (see `.env.example`).
+      - run: cargo clippy --all-targets -- -D warnings
+      # All features: compiled, not run.
+      - run: cargo check --all-targets --all-features
+      - run: cargo test
+
+  # The one check to require if branch protection is turned on.
+  ci-ok:
+    name: ci-ok
+    if: always()
+    needs: [fmt, test]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if a job failed or was cancelled
+        run: |
+          if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
+            echo "::error::a CI job did not pass"
+            exit 1
+          fi
 
+  # Line coverage; kept as an artifact, no external service.
+  coverage:
+    name: coverage
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
-    if: |
-      !(github.event_name == 'push' && contains(github.event.head_commit.message, '[skip ci]'))
+    timeout-minutes: 45
     steps:
-    - uses: actions/checkout@v3
-    - uses: Swatinem/rust-cache@v2
-    - name: Install clippy
-      run: rustup component add clippy
-    - name: Run tests
-      run: cargo test --verbose --all
-    - name: Run clippy
-      run: cargo clippy -- -D warnings
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: llvm-tools-preview
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: coverage
+          save-if: ${{ github.ref == 'refs/heads/master' }}
+          cache-on-failure: true
+      - uses: taiki-e/install-action@cargo-llvm-cov
+      - name: Run the tests with coverage
+        run: cargo llvm-cov --no-report
+      - name: Write the report
+        env:
+          IGNORE: '(cargo/registry|rustc)'
+        run: |
+          cargo llvm-cov report --ignore-filename-regex "$IGNORE" --lcov --output-path lcov.info
+          {
+            echo '## Line coverage'
+            echo '```'
+            cargo llvm-cov report --ignore-filename-regex "$IGNORE" --summary-only
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: coverage-lcov
+          path: lcov.info
+          if-no-files-found: error

.github/workflows/release.yml

@@ -1,13 +1,67 @@
-name: Release
+name: Publish to crates.io
 
+# Publishes the crate when a GitHub release is published. The release tag has
+# to match the version in `Cargo.toml` (`v0.1.1` or `0.1.1` for version
+# 0.1.1), otherwise nothing is published.
+#
+# Run by hand ("Run workflow") it only packages the crate and runs
+# `cargo publish --dry-run`, to try the release without publishing anything.
+#
+# Authentication is crates.io "trusted publishing": no token is stored in the
+# repository. It has to be configured once on crates.io, under the crate's
+# Settings > Trusted Publishing: repository owner `rafaga`, this repository,
+# workflow file `release.yml`.
 on:
   release:
-    types: [created]
+    types: [published]
+  workflow_dispatch:
+
+# One publish at a time; a second run waits instead of racing the first.
+concurrency:
+  group: publish
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_NET_RETRY: 10
 
 jobs:
-  build:
+  publish:
+    name: publish
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    # The token that trusted publishing exchanges is minted from this one.
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Check that the tag matches the version in Cargo.toml
+        if: github.event_name == 'release'
+        run: |
+          version=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
+          tag="${GITHUB_REF_NAME#v}"
+          if [ "$version" != "$tag" ]; then
+            echo "::error::the release tag is '$GITHUB_REF_NAME' but Cargo.toml says version $version"
+            exit 1
+          fi
+
+      # Packages the crate and builds it from the package, as crates.io would.
+      - name: Dry run
+        run: cargo publish --dry-run
+
+      - name: Authenticate with crates.io
+        if: github.event_name == 'release'
+        id: auth
+        uses: rust-lang/crates-io-auth-action@v1
+
       - name: Publish
-        run: cargo publish --token ${{ secrets.CARGO_TOKEN }}
+        if: github.event_name == 'release'
+        run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

.github/workflows/security.yml

@@ -0,0 +1,33 @@
+name: Security
+
+# Advisories (RustSec), licenses, banned or duplicated crates and unknown
+# sources, from `deny.toml`. It runs weekly too, because a new advisory can
+# appear against dependencies that have not changed.
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  pull_request:
+    branches: [master]
+    paths:
+      - "Cargo.toml"
+      - "deny.toml"
+      - ".github/workflows/security.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: security-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  deny:
+    name: cargo-deny
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check

deny.toml

@@ -0,0 +1,88 @@
+# Copied from https://github.com/rerun-io/rerun_template
+#
+# https://github.com/EmbarkStudios/cargo-deny
+#
+# cargo-deny checks our dependency tree for copy-left licenses,
+# duplicate dependencies, and rustsec advisories (https://rustsec.org/advisories).
+#
+# Install: `cargo install cargo-deny`
+# Check: `cargo deny check`.
+
+
+# Note: running just `cargo deny check` without a `--target` can result in
+# false positives due to https://github.com/EmbarkStudios/cargo-deny/issues/324
+[graph]
+targets = [
+  { triple = "aarch64-apple-darwin" },
+  { triple = "i686-pc-windows-msvc" },
+  { triple = "i686-unknown-linux-gnu" },
+  { triple = "x86_64-apple-darwin" },
+  { triple = "x86_64-pc-windows-msvc" },
+  { triple = "x86_64-unknown-linux-gnu" },
+]
+all-features = true
+
+
+[advisories]
+version = 2
+ignore = [
+  # `rsa` comes through `jsonwebtoken`, which this crate uses to validate EVE SSO
+  # tokens (feature `validate_jwt`). The Marvin attack is a timing side channel in
+  # RSA private-key operations (decryption/signing); only public-key signature
+  # verification happens here. No fixed release exists (`patched = []`). Revisit
+  # when `jsonwebtoken` moves to another backend or `rsa` ships a fix.
+  { id = "RUSTSEC-2023-0071", reason = "rsa timing side channel; only reached through JWT validation, no private key operations, no fix available" },
+]
+
+
+[bans]
+multiple-versions = "warn"
+wildcards = "warn"
+deny = [
+  #{ name = "openssl", reason = "Use rustls" },
+  #{ name = "openssl-sys", reason = "Use rustls" },
+]
+skip = []
+skip-tree = []
+
+
+[licenses]
+version = 2
+private = { ignore = true }
+confidence-threshold = 0.93 # We want really high confidence when inferring licenses from text
+allow = [
+  "Apache-2.0 WITH LLVM-exception", # https://spdx.org/licenses/LLVM-exception.html
+  "Apache-2.0",                     # https://tldrlegal.com/license/apache-license-2.0-(apache-2.0)
+  "BSD-2-Clause",                   # https://tldrlegal.com/license/bsd-2-clause-license-(freebsd)
+  "BSD-3-Clause",                   # https://tldrlegal.com/license/bsd-3-clause-license-(revised)
+  "BSL-1.0",                        # https://tldrlegal.com/license/boost-software-license-1.0-explained
+  "CC0-1.0",                        # https://creativecommons.org/publicdomain/zero/1.0/
+  "ISC",                            # https://www.tldrlegal.com/license/isc-license
+  "CDLA-Permissive-2.0",            # https://spdx.org/licenses/CDLA-Permissive-2.0.html - data crates (webpki-roots)
+  "MIT",                            # https://tldrlegal.com/license/mit-license
+  "MPL-2.0",                        # https://www.mozilla.org/en-US/MPL/2.0/FAQ/ - see Q11. Used by webpki-roots on Linux.
+  "OFL-1.1",                        # https://spdx.org/licenses/OFL-1.1.html
+  "Ubuntu-font-1.0",                # https://spdx.org/licenses/Ubuntu-font-1.0.html - fonts of epaint_default_fonts
+  "Unicode-3.0",                    # https://spdx.org/licenses/Unicode-3.0.html - icu / unicode-ident data
+  "Zlib",                           # https://tldrlegal.com/license/zlib-libpng-license-(zlib)
+]
+exceptions = []
+
+[[licenses.clarify]]
+name = "webpki"
+expression = "ISC"
+license-files = [{ path = "LICENSE", hash = 0x001c7e6c }]
+
+[[licenses.clarify]]
+name = "ring"
+expression = "MIT AND ISC AND OpenSSL"
+license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
+
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+
+[sources.allow-org]
+# 1 or more github.com organizations to allow git sources for
+github = ["rafaga"]