Enhance and harden CI/CD workflows

.codecov.yml

@@ -1,20 +1,21 @@
 codecov:
   require_ci_to_pass: true
 coverage:
-  range: 50..90 # coverage lower than 50 is red, higher than 90 green, between color code
+  range: 50..90
   status:
     project:
-      default: # settings affecting project coverage
-        enabled: true # auto % coverage target
-        threshold: "5%" # allow for 5% reduction of coverage without failing
-    # do not run coverage on patch nor changes
-      target: false
-    patch: false
+      default:
+        target: "65%"
+        threshold: "1%"
+    patch:
+      default:
+        target: "60%"
+        threshold: "5%"
     changes: false
 ignore:
   - "src/bin" # don't consider binaries in coverage report
   - "src/api" # Ignore autogenerated api
   - "tests" # we also don't care about coverage of test code
   - "benches" # or coverage of benchmarks
   - "protos" # coverage for protos are not necessary either
-  - "migrations" # exclude database stuff
+  - "migrations" # exclude database stuff

.github/workflows/ci.yaml

@@ -0,0 +1,93 @@
+name: CI
+on:
+  - push
+  - pull_request
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install actionlint
+        run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+
+      - name: Check workflows
+        run: |
+          "$(go env GOPATH)/bin/actionlint"
+
+  tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Run workspace tests
+        run: cargo test --locked --workspace --all-targets
+
+  fmt:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install stable rustfmt
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+  clippy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install stable clippy
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Run clippy
+        run: cargo clippy --locked --workspace --all-targets -- -D warnings
+
+  deny:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny
+
+      - name: Check dependency policy
+        run: cargo deny check

.github/workflows/codecov.yaml

@@ -6,22 +6,16 @@ name: coverage
 jobs:
   report:
     name: Report
-    environment: coverage
     runs-on: ubuntu-latest
-    env:
-      CARGO_INCREMENTAL: "0"
-      RUSTFLAGS: "-Ccodegen-units=1 -Copt-level=0 -Clink-dead-code -Coverflow-checks=off -Zpanic_abort_tests -Cpanic=abort"
-      RUSTDOCFLAGS: "-Cpanic=abort"
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
       - id: setup
         name: Setup Toolchain
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@stable
         with:
-          toolchain: nightly
           components: llvm-tools-preview
 
       - id: cache
@@ -36,14 +30,15 @@ jobs:
       - id: coverage
         name: Generate Coverage Report
         run: |
-          mkdir .coverage
-          cargo llvm-cov --lcov --output-path=./.coverage/lcov.info
+          mkdir -p .coverage
+          cargo llvm-cov --locked --workspace --all-targets --lcov --output-path=./.coverage/lcov.info
 
       - id: upload
         name: Upload Coverage Report
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
         uses: codecov/codecov-action@v4
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           file: ./.coverage/lcov.info
           verbose: true
-          fail_ci_if_error: true
+          fail_ci_if_error: true

.github/workflows/tag_publish.yaml

@@ -1,31 +1,126 @@
-name: automatic_test_build_publish
+name: Publish crates.io packages
+
 on:
   push:
     tags:
       - v*
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-${{ github.ref_name }}
+  cancel-in-progress: false
+
 jobs:
-  build:
+  publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
+    environment: release
     steps:
-      - uses: actions/checkout@v3
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Derive release version
-        run: echo "RELEASE_VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
-      - name: Test workspace
-        run: cargo test --workspace --locked
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny
+
+      - name: Validate release tag and package versions
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]]; then
+            printf 'Release tag must be vX.Y.Z compliant with SemVer: %s\n' "$RELEASE_TAG" >&2
+            exit 1
+          fi
+
+          RELEASE_VERSION="${RELEASE_TAG#v}"
+          RELEASE_COMMIT="$(git rev-list -n 1 "$GITHUB_REF")"
+          git merge-base --is-ancestor "$RELEASE_COMMIT" origin/main || {
+            printf 'Release tag must point to a commit reachable from main.\n' >&2
+            exit 1
+          }
+
+          for package in pithos_lib pithos; do
+            package_id="$(cargo pkgid -p "$package")"
+            package_version="${package_id##*@}"
+            if [[ "$package_version" != "$RELEASE_VERSION" ]]; then
+              printf '%s version %s does not match release tag %s.\n' "$package" "$package_version" "$RELEASE_VERSION" >&2
+              exit 1
+            fi
+          done
+
+          printf 'RELEASE_VERSION=%s\n' "$RELEASE_VERSION" >> "$GITHUB_ENV"
+
+      - name: Run workspace tests
+        run: cargo test --locked --workspace --all-targets
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Run Clippy
+        run: cargo clippy --locked --workspace --all-targets -- -D warnings
+
+      - name: Check dependency policy
+        run: cargo deny check
+
       - name: Package library
         run: cargo package -p pithos_lib --locked
+
       - name: Dry-run library publish
         run: cargo publish -p pithos_lib --dry-run --locked
-      - name: Publish library
-        run: cargo publish -p pithos_lib --token ${CRATES_TOKEN} --locked
+
+      - name: Publish or verify library
+        shell: bash
         env:
-          CRATES_TOKEN: ${{ secrets.CRATES_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_TOKEN }}
+        run: |
+          if cargo publish -p pithos_lib --locked; then
+            exit 0
+          fi
+
+          cargo info "pithos_lib@$RELEASE_VERSION" --registry crates-io >/dev/null
+
+      - name: Wait for library to reach crates.io
+        shell: bash
+        run: |
+          for _ in {1..30}; do
+            if cargo info "pithos_lib@$RELEASE_VERSION" --registry crates-io >/dev/null 2>&1; then
+              exit 0
+            fi
+
+            sleep 10
+          done
+
+          printf 'pithos_lib %s did not become available on crates.io.\n' "$RELEASE_VERSION" >&2
+          exit 1
+
       - name: Package CLI
         run: cargo package -p pithos --locked
+
       - name: Dry-run CLI publish
         run: cargo publish -p pithos --dry-run --locked
-      - name: Publish CLI
-        run: cargo publish -p pithos --token ${CRATES_TOKEN} --locked
+
+      - name: Publish or verify CLI
+        shell: bash
         env:
-          CRATES_TOKEN: ${{ secrets.CRATES_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_TOKEN }}
+        run: |
+          if cargo publish -p pithos --locked; then
+            exit 0
+          fi
+
+          cargo info "pithos@$RELEASE_VERSION" --registry crates-io >/dev/null

Cargo.toml

@@ -8,6 +8,7 @@ resolver = "2"
 version = "0.7.2"
 authors = ["Jannis Schlegel <das_Abroxas@proton.me>", "Sebastian Beyvers <sb@pus.de>"]
 edition = "2024"
+rust-version = "1.88"
 repository = "https://github.com/arunaengine/pithos"
 license = "MIT OR Apache-2.0"