fix(release): restore 2.5.21 cross builds (#1403) #1834
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint subprocess spawns | |
| # Regression guard for FastLED/fbuild#141: every subprocess fbuild | |
| # starts must flow through the fbuild-core::subprocess wrappers (which | |
| # are backed by running-process). Direct std::process::Command / | |
| # tokio::process::Command spawns are only allowed when annotated with | |
| # an // allow-direct-spawn: <reason> marker. | |
| # | |
| # Keeps pipe-deadlock and containment-drift bugs from creeping back in. | |
| on: | |
| workflow_dispatch: {} | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # Auto-cancel superseded PR runs: pushing again to a feature branch | |
| # supersedes the in-flight run instead of queueing behind it. Non-PR | |
| # events key on run_id so each gets its own group -- a shared group keeps | |
| # only ONE pending run, which would silently drop queued main SHAs. | |
| concurrency: | |
| group: lint-subprocess.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| jobs: | |
| lint-subprocess: | |
| name: Lint subprocess spawns | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: astral-sh/setup-uv@v3 | |
| # `--no-project` is load-bearing: without it, `uv run` triggers an | |
| # editable install of the `fbuild` package, whose build backend | |
| # requires a globally-installed `soldr` (see `setup.py` / | |
| # `build_backend.py`). This workflow does not install soldr — it | |
| # is a stdlib-only Python lint, not a Rust build — so the install | |
| # fails with `ERROR: 'soldr' is required to build fbuild from | |
| # source`. The script itself carries a PEP 723 header declaring | |
| # only `requires-python = ">=3.10"` and no third-party deps, so | |
| # skipping project sync is safe. | |
| - name: Check no unannotated direct Command::new spawns | |
| run: uv run --no-project python ci/find_direct_subprocess.py --fail |