Skip to content

ci: enforce --locked for cargo invocations and add lockfile integrity check #1701

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
GangDev6707 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: enforce --locked for cargo invocations and add lockfile integrity check #1701

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 21 additions & 6 deletions .github/workflows/CI.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,21 @@ defaults:
working-directory: contracts # 👈 all cargo commands run in contracts/

jobs:
lockfile:
name: Lockfile Integrity
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Read pinned toolchain
id: toolchain
run: echo "channel=$(grep -m1 '^channel' rust-toolchain.toml | cut -d'"' -f2)" >> "$GITHUB_OUTPUT"
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@master
with:
toolchain: ${{ steps.toolchain.outputs.channel }}
- name: Verify Cargo.lock is in sync
run: cargo metadata --locked --format-version 1 > /dev/null

format:
name: Format Check
runs-on: ubuntu-latest
Expand Down Expand Up @@ -59,7 +74,7 @@ jobs:
restore-keys: |
${{ runner.os }}-cargo-
- name: Run clippy
run: cargo clippy --all-targets --all-features -- -D warnings
run: cargo clippy --locked --all-targets --all-features -- -D warnings

test:
name: Test Suite
Expand All @@ -85,7 +100,7 @@ jobs:
${{ runner.os }}-cargo-test-
${{ runner.os }}-cargo-
- name: Run tests
run: cargo test --all --verbose
run: cargo test --locked --all --verbose

build:
name: Build Check
Expand All @@ -111,7 +126,7 @@ jobs:
${{ runner.os }}-cargo-build-
${{ runner.os }}-cargo-
- name: Build all crates
run: cargo build --all --verbose
run: cargo build --locked --all --verbose

build-wasm:
name: Build WASM
Expand Down Expand Up @@ -140,7 +155,7 @@ jobs:
# Every crate declares a cdylib crate-type and a #[contract] entrypoint,
# so all five are deployable and all five must be size-checked.
- name: Build all contracts to WASM
run: cargo build --workspace --target wasm32-unknown-unknown --release --verbose
run: cargo build --locked --workspace --target wasm32-unknown-unknown --release --verbose

- name: Check WASM size budgets
run: ./scripts/check-wasm-size.sh | tee "$GITHUB_STEP_SUMMARY"
Expand Down Expand Up @@ -185,7 +200,7 @@ jobs:

- name: Measure this branch
run: |
cargo build --workspace --target wasm32-unknown-unknown --release
cargo build --locked --workspace --target wasm32-unknown-unknown --release
./scripts/check-wasm-size.sh --json > /tmp/head-sizes.json
cat /tmp/head-sizes.json

Expand All @@ -194,7 +209,7 @@ jobs:
git stash --include-untracked || true
git fetch origin "${{ github.base_ref }}" --depth=1
git checkout "origin/${{ github.base_ref }}" -- .
cargo build --workspace --target wasm32-unknown-unknown --release
cargo build --locked --workspace --target wasm32-unknown-unknown --release
./scripts/check-wasm-size.sh --json > /tmp/base-sizes.json || echo '{}' > /tmp/base-sizes.json
cat /tmp/base-sizes.json

Expand Down
1 change: 1 addition & 0 deletions contracts/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion contracts/scripts/deploy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ if [[ "$SKIP_BUILD" -eq 0 ]]; then
log "Building ${#CONTRACTS[@]} contracts for wasm32-unknown-unknown (release)"
for c in "${CONTRACTS[@]}"; do
log " building $c"
cargo build --package "$c" --target wasm32-unknown-unknown --release
cargo build --locked --package "$c" --target wasm32-unknown-unknown --release
done
else
log "Skipping build (--skip-build)"
Expand Down