VectorPin/.github/workflows/ci.yml at main · ThirdKeyAI/VectorPin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  python:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[detectors,dev]"
      - name: Lint
        run: ruff check .
      - name: Test
        run: pytest -v

  rust:
    name: Rust stable
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: rust
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust
      - name: rustfmt
        run: cargo fmt --all -- --check
      - name: clippy
        run: cargo clippy -j2 --all-targets --all-features -- -D warnings
      - name: test
        run: cargo test -j2 --all-targets --all-features
      - name: doctest
        run: cargo test -j2 --doc

  typescript:
    name: TypeScript (Node 20)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: typescript
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: typescript/package-lock.json
      - name: Install
        run: npm ci
      - name: Typecheck
        run: npm run typecheck
      - name: Test
        run: npm test

  cross-language-fixtures-up-to-date:
    name: testvectors/ matches Python output and every port consumes it
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: typescript/package-lock.json
      - name: Install
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
      - name: Regenerate fixtures
        run: python scripts/generate_test_vectors.py
      - name: Verify no drift
        run: |
          if ! git diff --quiet testvectors/; then
            echo "::error::testvectors/ is stale. Run scripts/generate_test_vectors.py and commit."
            git diff testvectors/
            exit 1
          fi
      - name: Python consumes the regenerated fixtures
        run: pytest -q tests/test_v2_test_vectors.py
      - name: Rust consumes the regenerated fixtures
        working-directory: rust
        run: cargo test -j2 --test cross_lang --test legacy_v1
      - name: TypeScript consumes the regenerated fixtures
        working-directory: typescript
        run: |
          npm ci
          npx tsx --test test/cross-lang.test.ts test/legacy-v1.test.ts

  supply-chain:
    name: Dependency audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - uses: dtolnay/rust-toolchain@stable
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
      - name: cargo audit
        working-directory: rust
        run: |
          cargo install cargo-audit --locked
          cargo audit
      - name: npm audit (production dependencies)
        working-directory: typescript
        run: |
          npm ci
          npm audit --omit=dev
      - name: pip-audit
        run: |
          python -m pip install --upgrade pip pip-audit
          pip install -e "."
          pip-audit