loki5512344
aa615a1141
- xdp: CString for if_nametoindex (was UB), real detach via prog fd (fabricated borrow_raw(-1) silently never detached), SAFETY comments, saturating expiry math; +5 unit tests - redis: real pubsub reconnect with exponential backoff (was sleep+return); KEYS -> SCAN in heartbeat sweep - ci: cargo test --all-features, repo-gates job — module size gate (scripts/check_module_size.sh, ratchet baseline) + default-secrets grep - refactor src/ to <=250 LOC/file, <=4 .rs/dir without behavior change; thin bins (rampart.rs 330 -> 6 LOC), new app/, subnet/, intel/, profile/, prefix/, challenge/, filter/, probe/, inventory/, metrics/, node/ - docs: TODO v5.0 (status refresh, new rules, findings backlog), README quickstart now matches real binaries - verify: fmt/clippy -D warnings/test --all-features (164 tests)/clang XDP green
77 lines
2.1 KiB
YAML
77 lines
2.1 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
RUSTFLAGS: -D warnings
|
|
|
|
jobs:
|
|
rust-check:
|
|
name: Rust — check & clippy
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: clippy, rustfmt
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: sudo apt-get update && sudo apt-get install -y libelf-dev libbpf-dev clang linux-libc-dev
|
|
- run: cargo fmt --all --check
|
|
- run: cargo clippy --all-targets --all-features -- -D warnings
|
|
- run: cargo check --all-features
|
|
- name: XDP — build binaries
|
|
run: cargo build --features xdp --bins
|
|
- name: XDP — smoke-check BPF compilation (clang)
|
|
run: |
|
|
mkdir -p target/xdp
|
|
clang -O2 -g -target bpf -c xdp/core/universal_filter.c -o target/xdp/universal_filter.o
|
|
test -f target/xdp/universal_filter.o
|
|
|
|
rust-test:
|
|
name: Rust — test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: cargo test --all-features
|
|
|
|
repo-gates:
|
|
name: Repo — module size & default secrets
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Module size gate
|
|
run: bash scripts/check_module_size.sh
|
|
- name: Default secrets gate
|
|
run: bash scripts/check_default_secrets.sh
|
|
|
|
rust-deny:
|
|
name: Rust — cargo-deny
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: EmbarkStudios/cargo-deny-action@v2
|
|
with:
|
|
command: check
|
|
|
|
docker:
|
|
name: Docker — build edge image
|
|
runs-on: ubuntu-latest
|
|
needs: [rust-test]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: docker/setup-buildx-action@v3
|
|
- name: Build edge
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: deploy/docker/Dockerfile.edge
|
|
load: true
|
|
tags: rampart/edge:ci
|