This repository was archived by the owner on Jul 31, 2026. It is now read-only.
ci: add OSSF Scorecard workflow for security analysis #197
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Rust CI & Publish | |
| on: | |
| push: | |
| branches: [ "main", "dev" ] | |
| tags: | |
| - 'v*' | |
| pull_request: | |
| branches: [ "main", "dev" ] | |
| # Permissão global padrão (Mínimo privilégio exigido pelo CodeQL) | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| build_and_test: | |
| name: Build and Test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Rust | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| with: | |
| components: clippy, rustfmt | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }} | |
| - name: Check Formatting | |
| run: cargo fmt -- --check | |
| - name: Run cargo-audit | |
| uses: actions-rust-lang/audit@v1 | |
| - name: Run Clippy (deny warnings) | |
| run: cargo clippy --workspace --all-features --all-targets -- -D warnings | |
| - name: Install cargo-llvm-cov | |
| uses: taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9 # cargo-llvm-cov | |
| with: | |
| tool: cargo-llvm-cov | |
| - name: Run Tests & Generate Coverage | |
| run: cargo llvm-cov --workspace --all-features --lcov --output-path lcov.info | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: lcov.info | |
| fail_ci_if_error: false | |
| - name: Run cargo-deny | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| - name: Measure build time | |
| run: | | |
| (/usr/bin/time -v cargo build --workspace --all-features) 2>&1 | tee build_time.txt || true | |
| - name: Upload build time artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: build-time | |
| path: build_time.txt | |
| publish: | |
| name: Publish to Crates.io | |
| needs: build_and_test | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read # Escopo isolado e seguro para o deploy | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Rust | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| - name: Publish Macro Crate | |
| run: cargo publish -p rullst-orm-macros --token ${{ secrets.CARGO_REGISTRY_TOKEN }} | |
| - name: Wait for crates.io index sync | |
| run: sleep 30 | |
| - name: Publish Core Crate | |
| run: | | |
| cargo publish -p rullst-orm --token ${{ secrets.CARGO_REGISTRY_TOKEN }} || \ | |
| (sleep 30 && cargo publish -p rullst-orm --token ${{ secrets.CARGO_REGISTRY_TOKEN }}) |