ci: add the Rust build + test gate - #22
Merged
Merged
Conversation
CI ran only security scanners — CodeQL, ThreatCrush, gitleaks, semgrep, Socket, bun audit. Nothing compiled the workspace or ran a test, so a PR could break every crate in the tree and still show all-green. `build-and-test` is blocking: `cargo build --workspace --all-targets --locked` then `cargo test --workspace --locked`. `lint` (fmt + clippy) is advisory for now. The tree does not currently satisfy `cargo fmt --check`, and clippy has pre-existing warnings in c0mpute-net and c0mpute-update; making either blocking today would redden every PR for reasons unrelated to its diff. Running them now keeps the backlog visible instead of letting it grow silently — clear the tree, drop the `continue-on-error` lines, and they become real gates. The toolchain version is read from .mise.toml rather than pinned in the workflow, so CI cannot drift from what contributors run locally (DIP-0004). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LsQAuvXkmyHTgnvquLHrRx
ThreatCrush Security Scan8 finding(s) HIGH/CRITICAL: 5 | MEDIUM: 3
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the missing Rust build/test gate.
CI currently runs only security scanners — CodeQL, ThreatCrush, gitleaks, semgrep, Socket, bun audit. Nothing compiles the workspace or runs a test, so a PR could break every crate in the tree and still show all-green. Both bugs found while implementing CIP-002 (#21) would have sailed through.
What's blocking vs. advisory
build-and-testis the gate:lint(fmt + clippy) is advisory, deliberately. The tree does not currently satisfycargo fmt --check, and clippy has pre-existing warnings inc0mpute-netandc0mpute-update. Making either blocking today reddens every PR for reasons unrelated to its diff. Running them now keeps the backlog visible rather than letting it grow silently — clear the tree, delete thecontinue-on-errorlines, and they become real gates. The job summary says exactly that, so whoever hits it knows what to do.Notes
.mise.tomlrather than pinned in the workflow, so CI can't drift from what contributors run locally (DIP-0004). Written in two places, the two would disagree eventually and CI would be testing a compiler nobody uses.--lockedso a PR that forgets to commitCargo.lockfails loudly instead of silently resolving different dependencies than everyone else.concurrencywithcancel-in-progress— Rust builds are the most expensive job here and there's no value finishing one for a superseded commit.Swatinem/rust-cachekeeps it cheap instead.ffmpeg(verified: the suite passes on a machine without it).Worth merging ahead of #20/#21 so it gates them.
🤖 Generated with Claude Code
https://claude.ai/code/session_01LsQAuvXkmyHTgnvquLHrRx