runway/.gitea/workflows/ci.yml

# The checks the audit said would be machine-enforced.
#
# They were written down at M1 as "lints and CI checks" on the grounds that
# rules living only in a document get forgotten. The lints landed; the CI half
# did not exist until now, which means for twenty-seven milestones the
# forgetting was still possible -- it was just my forgetting rather than the
# repository's.

name: Check

on:
  push:
  pull_request:

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # The toolchain, its components and the wasm target all come from
      # rust-toolchain.toml, so there is one place that says which Rust this is.
      - name: Install the pinned toolchain
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | sh -s -- -y --default-toolchain none
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: cargo-${{ runner.os }}-

      - name: Formatting
        run: cargo fmt --all --check

      - name: Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

      # The CalDAV integration tests skip themselves when there is no server to
      # talk to, which is what happens here. They are exercised against a real
      # Baikal by `crates/runway-caldav/tests/baikal/run.sh`.
      - name: Tests
        run: cargo test --workspace

      - name: The frontend still builds for the browser
        run: cargo check -p runway-web --target wasm32-unknown-unknown

  guardrails:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install the pinned toolchain
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | sh -s -- -y --default-toolchain none
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      # v1 shipped reqwest, ical, regex and indexed_db_futures into a WASM
      # bundle that used none of them.
      - name: No unused dependencies
        run: |
          cargo install cargo-machete --locked
          cargo machete

      - name: Licences and advisories
        run: |
          cargo install cargo-deny --locked
          cargo deny check

      # v1 had 157 of these in its backend, one of which logged the length of a
      # password. Tests may print; the server may not.
      # The print rule is not here on purpose. It already exists as a test --
      # `no_println_or_dbg_in_the_server_or_the_caldav_client` -- so `cargo
      # test` above enforces it, and it covers the CalDAV client too. Doing it
      # again here would mean two rules to keep in step, and the CI copy would
      # be the worse of the two: grep from a shell cannot tell a call from a
      # comment about a call, and this file's first draft failed on the
      # paragraph in `observability.rs` explaining the rule.

  bundle:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install the pinned toolchain
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | sh -s -- -y --default-toolchain none
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Install Trunk
        run: |
          curl -fsSL https://github.com/trunk-rs/trunk/releases/download/v0.21.14/trunk-x86_64-unknown-linux-gnu.tar.gz \
            | tar -xzC /usr/local/bin trunk

      - run: npm ci

      - name: Build the frontend
        working-directory: crates/runway-web
        run: trunk build --release

      # Printed on every run and enforced, because a bundle grows one
      # convenient dependency at a time and nobody notices until it is 2.5 MB.
      # That was v1's. This budget is comfortably above today's and well below
      # that, so it is a ratchet rather than a rubber stamp.
      - name: WASM bundle size
        run: |
          wasm=$(find crates/runway-web/dist -name '*.wasm' -print -quit)
          size=$(stat -c %s "$wasm")
          budget=1800000
          echo "$wasm is $size bytes (budget $budget, v1 shipped 2500000)"
          if [ "$size" -gt "$budget" ]; then
            echo "over budget by $((size - budget)) bytes" >&2
            exit 1
          fi