From 0444662cebf854c3d041b13fb5097a9150e03d3b Mon Sep 17 00:00:00 2001 From: Quantum Explorer Date: Wed, 5 Aug 2026 03:51:51 +0700 Subject: [PATCH 1/2] ci: schedule Rust workspace tests on macOS or Linux self-hosted runners `runs-on` label arrays are AND-ed, so `[self-hosted, macOS, ARM64]` could never also match the new Linux runner. Select on a shared custom label instead: `[self-hosted, rust-ci]`, applied to both mac runners and the Linux one. Keeping `self-hosted` in the list means GitHub-hosted runners still can't pick the job up. Making the job portable: - Homebrew setup is gated to macOS; Linux gets an apt equivalent for what ./.github/actions/rust doesn't already install (it handles clang, llvm and libsnappy), plus gh for the immutable-structure check and rustup for dtolnay/rust-toolchain. Every branch is a no-op after the first run. - The disk prune clamps its absolute caps to a share of the volume, so a smaller runner doesn't purge target/ on every run and cold-rebuild. - The GPG keyboxd reset is a macOS runner workaround, so it's gated too. Linux builds rocksdb from source like macOS does rather than linking the prebuilt static lib the old Ubuntu jobs used. The persistent target/ makes that a one-time cost, and it avoids their sed pass over Cargo.toml crate types, which static rocksdb forced. The three Ubuntu backup jobs and their poll-the-Mac-job dance are removed. UBUNTU_BACKUP_ENABLED has been false, so they were dead code, and a second self-hosted runner is the redundancy they were standing in for. That empties tests-rs-doctests.yml; doctests already run inside both Rust jobs under `doctests-changed`. The job is renamed Tests (macOS) -> Tests. No branch protection rule references it. Requires the `rust-ci` label on all three runners. Co-Authored-By: Claude Opus 5 --- .github/actionlint.yaml | 9 + .github/workflows/tests-rs-doctests.yml | 88 ----- .github/workflows/tests-rs-wallet.yml | 14 +- .github/workflows/tests-rs-workspace.yml | 390 ++++------------------- .github/workflows/tests.yml | 19 +- 5 files changed, 90 insertions(+), 430 deletions(-) create mode 100644 .github/actionlint.yaml delete mode 100644 .github/workflows/tests-rs-doctests.yml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml new file mode 100644 index 00000000000..7fe46e892d5 --- /dev/null +++ b/.github/actionlint.yaml @@ -0,0 +1,9 @@ +# Custom labels carried by this repo's self-hosted runners. Without this, +# actionlint flags `runs-on: [self-hosted, rust-ci]` as an unknown label +# because it can't resolve it against the GitHub-hosted runner names. +# +# `rust-ci` must be applied to every runner allowed to take the Rust workspace +# test job (Settings -> Actions -> Runners -> -> Labels). +self-hosted-runner: + labels: + - rust-ci diff --git a/.github/workflows/tests-rs-doctests.yml b/.github/workflows/tests-rs-doctests.yml deleted file mode 100644 index a561e93ffac..00000000000 --- a/.github/workflows/tests-rs-doctests.yml +++ /dev/null @@ -1,88 +0,0 @@ -on: - workflow_call: - -jobs: - doctests: - name: Doctests backup - if: vars.UBUNTU_BACKUP_ENABLED == 'true' - runs-on: ubuntu-24.04 - timeout-minutes: 20 - permissions: - id-token: write - contents: read - steps: - - name: Wait and check if Mac runner is available - id: check-mac - env: - GH_TOKEN: ${{ github.token }} - run: | - sleep 15 - MAC_JOB=$(gh api repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs \ - --jq '.jobs[] | select(.name == "Rust workspace tests / Tests (macOS)")' 2>/dev/null || echo "{}") - MAC_STATUS=$(echo "$MAC_JOB" | jq -r '.status // "unknown"') - MAC_CONCLUSION=$(echo "$MAC_JOB" | jq -r '.conclusion // ""') - echo "mac-status=$MAC_STATUS" >> "$GITHUB_OUTPUT" - if [ "$MAC_STATUS" = "in_progress" ]; then - echo "Mac runner picked up the job — skipping Ubuntu doctests" - echo "skip=true" >> "$GITHUB_OUTPUT" - elif [ "$MAC_STATUS" = "completed" ] && [ "$MAC_CONCLUSION" = "failure" ]; then - echo "Mac runner already failed — failing Ubuntu fallback too" - exit 1 - else - echo "Mac runner not available (status: $MAC_STATUS) — running doctests on Ubuntu" - echo "skip=false" >> "$GITHUB_OUTPUT" - fi - - - name: Free disk space - if: steps.check-mac.outputs.skip == 'false' - run: | - sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/share/powershell /usr/share/swift - df -h / - - - name: Check out repo - if: steps.check-mac.outputs.skip == 'false' - uses: actions/checkout@v4 - - - name: Strip cdylib crate-types (incompatible with static rocksdb) - if: steps.check-mac.outputs.skip == 'false' - run: | - sed -i 's/\["cdylib", "rlib"\]/["rlib"]/' packages/rs-sdk/Cargo.toml packages/wasm-drive-verify/Cargo.toml - sed -i 's/\["cdylib", "lib"\]/["lib"]/' packages/wasm-dpp2/Cargo.toml - sed -i 's/\["cdylib"\]/["rlib"]/' packages/wasm-sdk/Cargo.toml - sed -i 's/\["staticlib", "cdylib", "rlib"\]/["staticlib", "rlib"]/g' packages/rs-sdk-ffi/Cargo.toml packages/rs-platform-wallet-ffi/Cargo.toml - - - name: Setup Rust - if: steps.check-mac.outputs.skip == 'false' - uses: ./.github/actions/rust - - - name: Setup sccache - if: steps.check-mac.outputs.skip == 'false' - uses: ./.github/actions/sccache - with: - bucket: ${{ vars.CACHE_S3_BUCKET }} - region: ${{ vars.CACHE_REGION }} - endpoint: ${{ vars.CACHE_S3_ENDPOINT }} - access_key_id: ${{ secrets.CACHE_KEY_ID }} - secret_access_key: ${{ secrets.CACHE_SECRET_KEY }} - - - name: Install librocksdb - if: steps.check-mac.outputs.skip == 'false' - uses: ./.github/actions/librocksdb - - - name: Run doctests - if: steps.check-mac.outputs.skip == 'false' - run: | - cargo test \ - --workspace \ - --all-features \ - --locked \ - --doc - env: - CARGO_INCREMENTAL: "0" - CARGO_PROFILE_DEV_DEBUG: "0" - CARGO_PROFILE_DEV_CODEGEN_UNITS: "256" - SCCACHE_S3_KEY_PREFIX: ${{ runner.os }}/sccache/${{ runner.arch }}/linux-gnu - ROCKSDB_STATIC: "/opt/rocksdb/usr/local/lib/librocksdb.a" - ROCKSDB_LIB_DIR: "/opt/rocksdb/usr/local/lib" - SNAPPY_STATIC: "/usr/lib/x86_64-linux-gnu/libsnappy.a" - SNAPPY_LIB_DIR: "/usr/lib/x86_64-linux-gnu" diff --git a/.github/workflows/tests-rs-wallet.yml b/.github/workflows/tests-rs-wallet.yml index bf241e8eb58..de451d633ea 100644 --- a/.github/workflows/tests-rs-wallet.yml +++ b/.github/workflows/tests-rs-wallet.yml @@ -19,11 +19,12 @@ # through the fast path that the full path would have rejected. # # Coverage upload is intentionally omitted (codecov never gates the merge — -# `fail_ci_if_error: false`). Known trade-offs: no Ubuntu backup jobs exist -# here (if `UBUNTU_BACKUP_ENABLED` is turned on, wallet PRs still depend on -# the mac runner being online), and the scoped `-p` builds feature-unify -# shared deps differently than `--workspace` builds, so the shared target/ -# carries an extra artifact flavor. +# `fail_ci_if_error: false`). Known trade-offs: this fast path stays pinned to +# the macOS runners (unlike the full workspace job, which schedules onto any +# `rust-ci` self-hosted runner), so wallet PRs depend on a mac runner being +# online; and the scoped `-p` builds feature-unify shared deps differently +# than `--workspace` builds, so the shared target/ carries an extra artifact +# flavor. on: workflow_call: inputs: @@ -198,8 +199,7 @@ jobs: # Wallet-only PRs can only change doc examples in the wallet crates, so # scoped doctests are equivalent to the full job's `--workspace --doc` - # run for this scope. (The standalone rs-doctests job in tests.yml is - # only an Ubuntu backup gated on UBUNTU_BACKUP_ENABLED.) + # run for this scope. - name: Run doctests (wallet crates) if: ${{ inputs.doctests-changed }} run: | diff --git a/.github/workflows/tests-rs-workspace.yml b/.github/workflows/tests-rs-workspace.yml index 7fa35e87614..d8fee5d1ddc 100644 --- a/.github/workflows/tests-rs-workspace.yml +++ b/.github/workflows/tests-rs-workspace.yml @@ -7,9 +7,15 @@ on: default: false jobs: - test-mac: - name: Tests (macOS) - runs-on: [self-hosted, macOS, ARM64] + test: + name: Tests + # Scheduled onto whichever self-hosted runner is free — the macOS boxes or + # the Linux one. `rust-ci` is a custom label applied to exactly those + # runners; pairing it with `self-hosted` keeps the job off GitHub-hosted + # runners entirely, so untrusted code never reaches a hosted Linux VM by + # way of a label collision. + runs-on: [self-hosted, rust-ci] + # Fork PRs must not execute on any persistent runner, macOS or Linux. if: >- github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository @@ -21,7 +27,7 @@ jobs: with: clean: false - - name: Prune macOS runner disk before tests + - name: Prune runner disk before tests run: | for path in ../target-backup-before-*-clean-* target/llvm-cov-target; do if [ -e "$path" ]; then @@ -30,21 +36,33 @@ jobs: fi done - TARGET_MAX_MB=120000 - MIN_FREE_MB=60000 - SIZE=$(du -sm target 2>/dev/null | awk '{print $1}' || echo 0) + # Absolute caps tuned for the large macOS volumes, clamped to a share + # of the volume so a smaller runner doesn't purge target/ every run + # and force a cold rebuild on each job. + TOTAL=$(df -m . | awk 'NR == 2 {print $2}') FREE=$(df -m . | awk 'NR == 2 {print $4}') - SIZE=${SIZE:-0} + SIZE=$(du -sm target 2>/dev/null | awk '{print $1}' || echo 0) + TOTAL=${TOTAL:-0} FREE=${FREE:-0} + SIZE=${SIZE:-0} - echo "target/ size: ${SIZE}MB" - echo "available disk: ${FREE}MB" + TARGET_MAX_MB=120000 + MIN_FREE_MB=60000 + if [ "$TOTAL" -gt 0 ]; then + [ $((TOTAL / 3)) -lt "$TARGET_MAX_MB" ] && TARGET_MAX_MB=$((TOTAL / 3)) + [ $((TOTAL / 5)) -lt "$MIN_FREE_MB" ] && MIN_FREE_MB=$((TOTAL / 5)) + fi + + echo "volume size: ${TOTAL}MB" + echo "target/ size: ${SIZE}MB (cap ${TARGET_MAX_MB}MB)" + echo "available disk: ${FREE}MB (floor ${MIN_FREE_MB}MB)" if [ "$SIZE" -gt "$TARGET_MAX_MB" ] || [ "$FREE" -lt "$MIN_FREE_MB" ]; then echo "target/ exceeds ${TARGET_MAX_MB}MB or disk is below ${MIN_FREE_MB}MB free; removing target/" rm -rf target fi - - name: Install build dependencies + - name: Install build dependencies (macOS) + if: runner.os == 'macOS' run: | echo "/opt/homebrew/bin" >> $GITHUB_PATH echo "/opt/homebrew/opt/llvm/bin" >> $GITHUB_PATH @@ -53,6 +71,44 @@ jobs: brew list llvm &>/dev/null || brew install llvm brew list gnupg &>/dev/null || brew install gnupg + # clang, llvm and libsnappy are installed by ./.github/actions/rust on + # Linux; this covers what the rest of the job needs and what a bare + # self-hosted image doesn't ship. Every branch is a no-op once the + # persistent runner has been provisioned by the first run. + - name: Install build dependencies (Linux) + if: runner.os == 'Linux' + run: | + set -euo pipefail + + MISSING=() + for pkg in build-essential cmake libgmp-dev pkg-config jq zip; do + dpkg -s "$pkg" >/dev/null 2>&1 || MISSING+=("$pkg") + done + if [ ${#MISSING[@]} -gt 0 ]; then + echo "Installing: ${MISSING[*]}" + sudo apt-get update -qq + sudo apt-get install -qq --yes "${MISSING[@]}" + fi + + # Needed by the immutable-structure check below. + if ! command -v gh >/dev/null 2>&1; then + sudo apt-get install -qq --yes gh || { + curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \ + | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg + echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \ + | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null + sudo apt-get update -qq + sudo apt-get install -qq --yes gh + } + fi + + # dtolnay/rust-toolchain drives rustup; it must already exist. + if ! command -v rustup >/dev/null 2>&1; then + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \ + | sh -s -- -y --no-modify-path --default-toolchain none + echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" + fi + - name: Setup Rust uses: ./.github/actions/rust with: @@ -217,8 +273,8 @@ jobs: cargo llvm-cov report --lcov --output-path lcov.info git rev-parse HEAD^{tree} > target/lcov-tree-hash - - name: Reset GPG state (fix stale keyboxd locks on self-hosted runners) - if: always() + - name: Reset GPG state (fix stale keyboxd locks on the macOS runners) + if: always() && runner.os == 'macOS' run: | gpgconf --kill all 2>/dev/null || true rm -rf ~/.gnupg/public-keys.d/*.lock 2>/dev/null || true @@ -262,311 +318,3 @@ jobs: env: CARGO_PROFILE_DEV_DEBUG: "0" CARGO_PROFILE_DEV_CODEGEN_UNITS: "256" - - test-ubuntu: - name: "Tests backup (shard ${{ matrix.partition }}/4)" - if: vars.UBUNTU_BACKUP_ENABLED == 'true' - runs-on: ubuntu-24.04 - timeout-minutes: 30 - permissions: - id-token: write - contents: read - strategy: - fail-fast: false - matrix: - partition: [1, 2, 3, 4] - steps: - - name: Wait and check if Mac runner is available - id: check-mac - env: - GH_TOKEN: ${{ github.token }} - run: | - sleep 15 - MAC_JOB=$(gh api repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs \ - --jq '.jobs[] | select(.name == "Rust workspace tests / Tests (macOS)")' 2>/dev/null || echo "{}") - MAC_STATUS=$(echo "$MAC_JOB" | jq -r '.status // "unknown"') - MAC_CONCLUSION=$(echo "$MAC_JOB" | jq -r '.conclusion // ""') - echo "mac-status=$MAC_STATUS" >> "$GITHUB_OUTPUT" - if [ "$MAC_STATUS" = "in_progress" ]; then - echo "Mac runner picked up the job — skipping Ubuntu fallback" - echo "skip=true" >> "$GITHUB_OUTPUT" - elif [ "$MAC_STATUS" = "completed" ] && [ "$MAC_CONCLUSION" = "failure" ]; then - echo "Mac runner already failed — failing Ubuntu fallback too" - exit 1 - else - echo "Mac runner not available (status: $MAC_STATUS) — running on Ubuntu" - echo "skip=false" >> "$GITHUB_OUTPUT" - fi - - - name: Free disk space - if: steps.check-mac.outputs.skip == 'false' - run: | - sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/share/powershell /usr/share/swift - df -h / - - - name: Check out repo - if: steps.check-mac.outputs.skip == 'false' - uses: actions/checkout@v4 - - - name: Strip cdylib crate-types (incompatible with static rocksdb) - if: steps.check-mac.outputs.skip == 'false' - run: | - sed -i 's/\["cdylib", "rlib"\]/["rlib"]/' packages/rs-sdk/Cargo.toml packages/wasm-drive-verify/Cargo.toml - sed -i 's/\["cdylib", "lib"\]/["lib"]/' packages/wasm-dpp2/Cargo.toml - sed -i 's/\["cdylib"\]/["rlib"]/' packages/wasm-sdk/Cargo.toml - sed -i 's/\["staticlib", "cdylib", "rlib"\]/["staticlib", "rlib"]/g' packages/rs-sdk-ffi/Cargo.toml packages/rs-platform-wallet-ffi/Cargo.toml - - - name: Setup Rust - if: steps.check-mac.outputs.skip == 'false' - uses: ./.github/actions/rust - - - name: Setup sccache - if: steps.check-mac.outputs.skip == 'false' - uses: ./.github/actions/sccache - with: - bucket: ${{ vars.CACHE_S3_BUCKET }} - region: ${{ vars.CACHE_REGION }} - endpoint: ${{ vars.CACHE_S3_ENDPOINT }} - access_key_id: ${{ secrets.CACHE_KEY_ID }} - secret_access_key: ${{ secrets.CACHE_SECRET_KEY }} - - - name: Install librocksdb - if: steps.check-mac.outputs.skip == 'false' - uses: ./.github/actions/librocksdb - - - uses: taiki-e/install-action@cargo-nextest - if: steps.check-mac.outputs.skip == 'false' - - - name: Configure core dumps - if: steps.check-mac.outputs.skip == 'false' - run: | - sudo mkdir /cores - sudo chmod 777 /cores - sudo bash -c 'echo "/cores/%e.%p.%t" > /proc/sys/kernel/core_pattern' - - - name: Run tests (shard ${{ matrix.partition }}/6) - if: steps.check-mac.outputs.skip == 'false' - run: | - ulimit -c unlimited - cargo nextest run \ - --package drive \ - --package dpp \ - --package drive-abci \ - --package dash-sdk \ - --package platform-value \ - --package rs-dapi \ - --package platform-wallet \ - --package platform-wallet-storage \ - --package rs-sdk-ffi \ - --package platform-wallet-ffi \ - --package rs-dapi-client \ - --package platform-serialization \ - --package dapi-grpc \ - --package json-schema-compatibility-validator \ - --package dashpay-contract \ - --package dpns-contract \ - --package masternode-reward-shares-contract \ - --package withdrawals-contract \ - --package token-history-contract \ - --package wallet-utils-contract \ - --package keyword-search-contract \ - --all-features \ - --locked \ - --partition count:${{ matrix.partition }}/4 - env: - RUST_MIN_STACK: 4194304 - CARGO_INCREMENTAL: "0" - CARGO_PROFILE_DEV_DEBUG: "0" - CARGO_PROFILE_DEV_CODEGEN_UNITS: "256" - SCCACHE_S3_KEY_PREFIX: ${{ runner.os }}/sccache/${{ runner.arch }}/linux-gnu - ROCKSDB_STATIC: "/opt/rocksdb/usr/local/lib/librocksdb.a" - ROCKSDB_LIB_DIR: "/opt/rocksdb/usr/local/lib" - SNAPPY_STATIC: "/usr/lib/x86_64-linux-gnu/libsnappy.a" - SNAPPY_LIB_DIR: "/usr/lib/x86_64-linux-gnu" - - - name: Collect crash artifacts - if: failure() && steps.check-mac.outputs.skip == 'false' - run: | - set -euo pipefail - shopt -s nullglob - - if ! compgen -G "/cores/*" > /dev/null; then - echo "No core dumps were produced; skipping artifact archive." - exit 0 - fi - - ARTIFACT_DIR=crash-artifacts - rm -rf "${ARTIFACT_DIR}" - mkdir -p "${ARTIFACT_DIR}/cores" "${ARTIFACT_DIR}/binaries" - - cp -a /cores/. "${ARTIFACT_DIR}/cores/" - - for path in target/debug/deps/*; do - if [[ -f "$path" && -x "$path" && ! "$path" == *.d ]]; then - cp -a "$path" "${ARTIFACT_DIR}/binaries/" - fi - done - - (cd "${ARTIFACT_DIR}" && zip -9 -r ../core-dumps.zip .) - - - name: Upload core dumps - if: failure() && steps.check-mac.outputs.skip == 'false' - uses: actions/upload-artifact@v4 - with: - name: core-dumps-shard-${{ matrix.partition }}-of-4 - path: core-dumps.zip - if-no-files-found: ignore - retention-days: 3 - - lint-ubuntu: - name: "Formatting & Linting backup" - if: vars.UBUNTU_BACKUP_ENABLED == 'true' - runs-on: ubuntu-24.04 - timeout-minutes: 20 - permissions: - id-token: write - contents: read - steps: - - name: Wait and check if Mac runner is available - id: check-mac - env: - GH_TOKEN: ${{ github.token }} - run: | - sleep 15 - MAC_JOB=$(gh api repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs \ - --jq '.jobs[] | select(.name == "Rust workspace tests / Tests (macOS)")' 2>/dev/null || echo "{}") - MAC_STATUS=$(echo "$MAC_JOB" | jq -r '.status // "unknown"') - MAC_CONCLUSION=$(echo "$MAC_JOB" | jq -r '.conclusion // ""') - echo "mac-status=$MAC_STATUS" >> "$GITHUB_OUTPUT" - if [ "$MAC_STATUS" = "in_progress" ]; then - echo "Mac runner picked up the job — skipping Ubuntu fallback" - echo "skip=true" >> "$GITHUB_OUTPUT" - elif [ "$MAC_STATUS" = "completed" ] && [ "$MAC_CONCLUSION" = "failure" ]; then - echo "Mac runner already failed — failing Ubuntu fallback too" - exit 1 - else - echo "Mac runner not available (status: $MAC_STATUS) — running on Ubuntu" - echo "skip=false" >> "$GITHUB_OUTPUT" - fi - - - name: Check out repo - if: steps.check-mac.outputs.skip == 'false' - uses: actions/checkout@v4 - - - name: Strip cdylib crate-types (incompatible with static rocksdb) - if: steps.check-mac.outputs.skip == 'false' - run: | - sed -i 's/\["cdylib", "rlib"\]/["rlib"]/' packages/rs-sdk/Cargo.toml packages/wasm-drive-verify/Cargo.toml - sed -i 's/\["cdylib", "lib"\]/["lib"]/' packages/wasm-dpp2/Cargo.toml - sed -i 's/\["cdylib"\]/["rlib"]/' packages/wasm-sdk/Cargo.toml - sed -i 's/\["staticlib", "cdylib", "rlib"\]/["staticlib", "rlib"]/g' packages/rs-sdk-ffi/Cargo.toml packages/rs-platform-wallet-ffi/Cargo.toml - - - name: Setup Rust - if: steps.check-mac.outputs.skip == 'false' - uses: ./.github/actions/rust - with: - components: rustfmt, clippy - - - name: Setup sccache - if: steps.check-mac.outputs.skip == 'false' - uses: ./.github/actions/sccache - with: - bucket: ${{ vars.CACHE_S3_BUCKET }} - region: ${{ vars.CACHE_REGION }} - endpoint: ${{ vars.CACHE_S3_ENDPOINT }} - access_key_id: ${{ secrets.CACHE_KEY_ID }} - secret_access_key: ${{ secrets.CACHE_SECRET_KEY }} - - - name: Install librocksdb - if: steps.check-mac.outputs.skip == 'false' - uses: ./.github/actions/librocksdb - - - name: Check formatting - if: steps.check-mac.outputs.skip == 'false' - run: cargo fmt --check --all - - - name: Clippy lints - if: steps.check-mac.outputs.skip == 'false' - run: | - cargo clippy \ - --workspace \ - --all-features \ - --locked \ - -- --no-deps -D warnings - env: - CARGO_INCREMENTAL: "0" - CARGO_PROFILE_DEV_DEBUG: "0" - SCCACHE_S3_KEY_PREFIX: ${{ runner.os }}/sccache/${{ runner.arch }}/linux-gnu - ROCKSDB_STATIC: "/opt/rocksdb/usr/local/lib/librocksdb.a" - ROCKSDB_LIB_DIR: "/opt/rocksdb/usr/local/lib" - SNAPPY_STATIC: "/usr/lib/x86_64-linux-gnu/libsnappy.a" - SNAPPY_LIB_DIR: "/usr/lib/x86_64-linux-gnu" - - - name: Find unused dependencies - if: steps.check-mac.outputs.skip == 'false' - run: | - cargo install cargo-machete 2>/dev/null || true - cargo machete - env: - ROCKSDB_STATIC: "/opt/rocksdb/usr/local/lib/librocksdb.a" - ROCKSDB_LIB_DIR: "/opt/rocksdb/usr/local/lib" - SNAPPY_STATIC: "/usr/lib/x86_64-linux-gnu/libsnappy.a" - SNAPPY_LIB_DIR: "/usr/lib/x86_64-linux-gnu" - - - name: Detect immutable structure changes - if: steps.check-mac.outputs.skip == 'false' && github.event_name == 'pull_request' - env: - GH_TOKEN: ${{ github.token }} - run: | - CHANGED_RS=$(gh pr view ${{ github.event.pull_request.number }} --json files --jq '[.files[].path] | map(select(test("\\.rs$"))) | .[]') - if [ -z "$CHANGED_RS" ]; then - echo "No .rs files changed — skipping" - exit 0 - fi - - # Brace-aware extractor: captures from @tag through the matching closing brace - extract_tagged_block() { - local tag="$1" - awk -v tag="$tag" ' - $0 ~ tag { found=1; depth=0 } - found { - for (i=1; i<=length($0); i++) { - c = substr($0,i,1) - if (c == "{") depth++ - if (c == "}") depth-- - } - print - if (found && depth <= 0 && index($0, "}")) { found=0 } - } - ' - } - - git fetch origin ${{ github.event.pull_request.base.ref }} --depth=1 - for file in $CHANGED_RS; do - if [ ! -f "$file" ]; then continue; fi - BASE_CONTENT=$(git show origin/${{ github.event.pull_request.base.ref }}:"$file" 2>/dev/null || true) - if [ -z "$BASE_CONTENT" ]; then continue; fi - - BASE_APPEND=$(echo "$BASE_CONTENT" | extract_tagged_block "@append_only") - PR_APPEND=$(extract_tagged_block "@append_only" < "$file") - BASE_IMMUTABLE=$(echo "$BASE_CONTENT" | extract_tagged_block "@immutable") - PR_IMMUTABLE=$(extract_tagged_block "@immutable" < "$file") - - if [ -n "$BASE_APPEND" ]; then - DELETIONS=$(diff <(echo "$BASE_APPEND") <(echo "$PR_APPEND") | grep "^<" | grep -v "@append_only" | grep -v "^< *$" | grep -v "^< *///" | grep -v "^< *//" || true) - if [ -n "$DELETIONS" ]; then - echo "Deletions detected in @append_only structures in $file" - echo "$DELETIONS" - exit 1 - fi - fi - if [ -n "$BASE_IMMUTABLE" ]; then - CHANGES=$(diff <(echo "$BASE_IMMUTABLE") <(echo "$PR_IMMUTABLE") | grep -E "^[<>]" | grep -v "^[<>] *$" | grep -v "^[<>] *///" | grep -v "^[<>] *//" | grep -v "@immutable" || true) - if [ -n "$CHANGES" ]; then - echo "Code changes detected in @immutable structures in $file" - echo "$CHANGES" - exit 1 - fi - fi - done - echo "No immutable/append_only structure violations found" diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index fce0dd59e48..b6024ad3e2a 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -86,7 +86,6 @@ jobs: rs-workflows: - .github/workflows/tests-rs-workspace.yml - .github/workflows/tests-rs-wallet.yml - - .github/workflows/tests-rs-doctests.yml - .github/workflows/tests.yml - .github/scripts/check-wallet-closure.py @@ -156,11 +155,11 @@ jobs: if: ${{ github.event_name != 'workflow_dispatch' }} run: | # The fast path applies only to same-repo pull requests. Fork PRs - # must take the full workspace path (whose Ubuntu backup jobs cover - # them when UBUNTU_BACKUP_ENABLED is set, while the wallet - # workflow's only job skips fork PRs). Push and schedule runs have - # no reliable base SHA — scope computed from the last commit alone - # could silently downgrade the nightly / post-merge full runs. + # must take the full workspace path (both Rust workflows skip fork + # PRs outright, since neither may run untrusted code on a persistent + # runner). Push and schedule runs have no reliable base SHA — scope + # computed from the last commit alone could silently downgrade the + # nightly / post-merge full runs. if [ "${{ github.event_name }}" != "pull_request" ]; then echo "scope=full" >> "$GITHUB_OUTPUT" echo "Not a pull request — using full Rust workspace tests" @@ -363,14 +362,6 @@ jobs: with: doctests-changed: ${{ needs.changes.outputs.doctests-changed == 'true' }} - rs-doctests: - name: Rust doctests - needs: - - changes - if: ${{ needs.changes.outputs.doctests-changed == 'true' }} - secrets: inherit - uses: ./.github/workflows/tests-rs-doctests.yml - swift-sdk-build: name: Swift SDK build needs: From 32f8afc585ef52d6dc2780de9a4a8af4dc160b73 Mon Sep 17 00:00:00 2001 From: QuantumExplorer Date: Wed, 5 Aug 2026 10:52:27 +0700 Subject: [PATCH 2/2] Apply suggestions from code review Co-authored-by: Lil Claw --- .github/workflows/tests-rs-workspace.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/tests-rs-workspace.yml b/.github/workflows/tests-rs-workspace.yml index d8fee5d1ddc..59d28f72c89 100644 --- a/.github/workflows/tests-rs-workspace.yml +++ b/.github/workflows/tests-rs-workspace.yml @@ -81,7 +81,7 @@ jobs: set -euo pipefail MISSING=() - for pkg in build-essential cmake libgmp-dev pkg-config jq zip; do + for pkg in build-essential cmake libgmp-dev libssl-dev pkg-config jq zip; do dpkg -s "$pkg" >/dev/null 2>&1 || MISSING+=("$pkg") done if [ ${#MISSING[@]} -gt 0 ]; then