481018e1e3
The new token_store module (#78) depends on `sync-secret-service` via `dbus-secret-service`, which in turn links to libdbus-1 at build time through the `dbus` crate. Add `libdbus-1-dev` to: - `check.yml` rust job (alongside the existing webkit/appindicator system deps), so every PR run compiles the keyring backend. - `release.yml` Linux deps step, so tagged builds link correctly. Runtime requires `libdbus-1-3`, which is present on every desktop Linux distro by default, so `.deb` / `.rpm` depends stay unchanged. Also add a non-blocking `cargo audit` step to check.yml to surface advisories across the transitive dep graph (zbus, dbus-secret-service, etc.) without failing unrelated PRs. Drop `appimage` from `bundle.targets` in tauri.conf.json: the release workflow explicitly builds `--bundles deb,rpm` so AppImage was never shipped, and its presence in the config risks a silent fallback to plaintext token storage for anyone running `tauri build` locally without libsecret/libdbus bundled into the AppImage. No behaviour change for CI; follow-up to re-enable AppImage properly would need a linuxdeploy workflow that bundles the backend. Refs #66 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
108 lines
3.5 KiB
YAML
108 lines
3.5 KiB
YAML
name: PR Check
|
|
|
|
# Validates Rust + frontend on every branch push and PR.
|
|
# Goal: catch compile errors, type errors, and failing tests BEFORE merge,
|
|
# instead of waiting for the release tag (which is when release.yml runs).
|
|
|
|
on:
|
|
push:
|
|
branches-ignore:
|
|
- main
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
rust:
|
|
runs-on: ubuntu
|
|
container: ubuntu:22.04
|
|
env:
|
|
PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
CARGO_TERM_COLOR: always
|
|
steps:
|
|
- name: Install system dependencies, Node.js and Rust
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends \
|
|
curl wget git ca-certificates build-essential pkg-config \
|
|
libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libssl-dev \
|
|
libdbus-1-dev
|
|
# Node.js is required by actions/checkout and actions/cache (they
|
|
# are JavaScript actions and need `node` in the container PATH).
|
|
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
|
|
apt-get install -y nodejs
|
|
# Rust toolchain
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
|
|
node --version
|
|
rustc --version
|
|
cargo --version
|
|
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Cache cargo registry and git
|
|
uses: https://github.com/actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cargo/registry
|
|
~/.cargo/git
|
|
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('src-tauri/Cargo.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-cargo-registry-
|
|
|
|
- name: Cache cargo build target
|
|
uses: https://github.com/actions/cache@v4
|
|
with:
|
|
path: src-tauri/target
|
|
key: ${{ runner.os }}-cargo-target-${{ hashFiles('src-tauri/Cargo.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-cargo-target-
|
|
|
|
- name: cargo check
|
|
run: cargo check --manifest-path src-tauri/Cargo.toml --all-targets
|
|
|
|
- name: cargo test
|
|
run: cargo test --manifest-path src-tauri/Cargo.toml --all-targets
|
|
|
|
# Informational audit of transitive dependencies. Failure does not
|
|
# block the CI (advisories can appear on unrelated crates and stall
|
|
# unrelated work); surface them in the job log so we see them on
|
|
# every PR run and can react in a follow-up.
|
|
- name: cargo audit
|
|
continue-on-error: true
|
|
run: |
|
|
cargo install --locked cargo-audit || true
|
|
cargo audit --file src-tauri/Cargo.lock || true
|
|
|
|
frontend:
|
|
runs-on: ubuntu
|
|
container: ubuntu:22.04
|
|
steps:
|
|
- name: Install Node.js 20
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends curl ca-certificates git
|
|
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
|
|
apt-get install -y nodejs
|
|
node --version
|
|
npm --version
|
|
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Cache npm cache
|
|
uses: https://github.com/actions/cache@v4
|
|
with:
|
|
path: ~/.npm
|
|
key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-npm-
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build (tsc + vite)
|
|
run: npm run build
|
|
|
|
- name: Tests (vitest)
|
|
run: npm test
|