From 443c2ce337b02124ceccfcd1ad4ec727c325495d Mon Sep 17 00:00:00 2001 From: Sidharth Menon Date: Thu, 8 Oct 2026 19:42:54 -0700 Subject: [PATCH 1/3] ci: verify diffr release packages once, alongside platform builds --- .github/workflows/diffr-release.yml | 62 ++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 10 deletions(-) diff --git a/.github/workflows/diffr-release.yml b/.github/workflows/diffr-release.yml index 81effd1b8..381a8a716 100644 --- a/.github/workflows/diffr-release.yml +++ b/.github/workflows/diffr-release.yml @@ -40,6 +40,8 @@ jobs: PYTHON: ${{ startsWith(matrix.os, 'windows') && 'python' || 'python3' }} steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: 1.3.14 @@ -73,8 +75,11 @@ jobs: working-directory: diffr steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: + pattern: '{aarch64,x86_64}-*' path: diffr/dist merge-multiple: true - name: Generate checksums and Homebrew formula @@ -104,6 +109,8 @@ jobs: HOMEBREW_NO_AUTO_UPDATE: '1' steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: release @@ -152,19 +159,43 @@ jobs: approve: name: Approve diffr release if: github.event_name == 'push' && github.ref_type == 'tag' - needs: packaging + needs: [packaging, verify_crates] environment: review-release-approval runs-on: ubuntu-latest permissions: {} steps: - run: echo "Diffr release approved" + verify_crates: + name: Verify Cargo packages + runs-on: ubuntu-22.04 + timeout-minutes: 45 + defaults: + run: + shell: bash + working-directory: diffr + steps: + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + - uses: dtolnay/rust-toolchain@1.99.0 + - name: Verify crates without publishing + run: cargo publish --locked --dry-run -p diffr-grammars -p diffr-core -p diffr-cli + - name: Record verified package checksums + run: | + sha256sum target/package/diffr-{grammars,core,cli}-*.crate > "$RUNNER_TEMP/diffr-crates.sha256" + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: diffr-crate-checksums + path: ${{ runner.temp }}/diffr-crates.sha256 + retention-days: 7 + if-no-files-found: error + crates: - name: Verify and publish Cargo packages - needs: [packaging, approve] - # Manual runs validate packages without entering the publishing approval gate. + name: Publish Cargo packages + needs: [packaging, verify_crates, approve] if: >- - always() && needs.packaging.result == 'success' && + always() && needs.packaging.result == 'success' && needs.verify_crates.result == 'success' && (needs.approve.result == 'success' || (github.event_name == 'workflow_dispatch' && needs.approve.result == 'skipped')) runs-on: ubuntu-22.04 @@ -175,9 +206,17 @@ jobs: working-directory: diffr steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: dtolnay/rust-toolchain@1.99.0 - - name: Verify crates without publishing - run: cargo publish --locked --dry-run -p diffr-grammars -p diffr-core -p diffr-cli + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + with: + name: diffr-crate-checksums + path: ${{ runner.temp }} + - name: Recreate and match verified packages without rebuilding + run: | + cargo publish --locked --dry-run --no-verify -p diffr-grammars -p diffr-core -p diffr-cli + sha256sum --check "$RUNNER_TEMP/diffr-crates.sha256" - name: Publish crates in dependency order if: github.event_name == 'push' && github.ref_type == 'tag' env: @@ -194,7 +233,7 @@ jobs: "https://crates.io/api/v1/crates/$crate/$version") case "$status" in 200) echo "$crate@$version is already published" ;; - 404) cargo publish --locked -p "$crate" ;; + 404) cargo publish --locked --no-verify -p "$crate" ;; *) echo "Could not check $crate@$version: HTTP $status" >&2; exit 1 ;; esac done @@ -220,9 +259,10 @@ jobs: gh release edit "$RELEASE_TAG" --draft=false --latest=false npm: - needs: [packaging, crates, publish] + needs: [packaging, verify_crates, crates, publish] if: >- - always() && needs.packaging.result == 'success' && needs.crates.result == 'success' && + always() && needs.packaging.result == 'success' && needs.verify_crates.result == 'success' && + needs.crates.result == 'success' && (needs.publish.result == 'success' || github.event_name == 'workflow_dispatch') defaults: run: @@ -233,6 +273,8 @@ jobs: runs-on: ubuntu-22.04 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: From da81038884cb39fd1089c7ba967132c5a6165fb1 Mon Sep 17 00:00:00 2001 From: Sidharth Menon Date: Thu, 8 Oct 2026 19:42:54 -0700 Subject: [PATCH 2/3] ci: retain Cargo timings for diffr release builds --- .github/workflows/diffr-release.yml | 8 ++++++++ diffr/xtask/src/main.rs | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/diffr-release.yml b/.github/workflows/diffr-release.yml index 381a8a716..53f9f5820 100644 --- a/.github/workflows/diffr-release.yml +++ b/.github/workflows/diffr-release.yml @@ -66,6 +66,14 @@ jobs: name: ${{ matrix.target }} path: diffr/dist/*.tar.gz if-no-files-found: error + - name: Upload Cargo build timings + if: always() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: diffr-release-timings-${{ matrix.target }} + path: diffr/target/cargo-timings + if-no-files-found: warn + retention-days: 7 prepare: needs: build diff --git a/diffr/xtask/src/main.rs b/diffr/xtask/src/main.rs index 35a269d50..109a8c697 100644 --- a/diffr/xtask/src/main.rs +++ b/diffr/xtask/src/main.rs @@ -71,7 +71,7 @@ fn install(root: &Path, with_cli: bool) -> Result<()> { run( cargo() .current_dir(root) - .args(["install", "--path", ".", "--locked", "--root"]) + .args(["install", "--path", ".", "--locked", "--timings", "--root"]) .arg(&destination), "Installing diffr", )?; From 9fac2d5acac2e7515d4d333faab0a4ddddadff3b Mon Sep 17 00:00:00 2001 From: Sidharth Menon Date: Thu, 8 Oct 2026 19:45:48 -0700 Subject: [PATCH 3/3] ci: remove diffr MIME job that runs no tests Agent-Session: ec5d2c35-3045-44f3-9c41-ba4378797c8e Agent-Session: 01a11ded-d896-7251-bf8f-c71bf07fd283 Agent-Session: 01a11e0a-d042-71d2-9bc9-ac7b652487d1 Agent-Session: b5985b3c-e5d2-4bb4-b6ac-7fec168d8328 --- .github/workflows/diffr-test.yml | 21 --------------------- 1 file changed, 21 deletions(-) diff --git a/.github/workflows/diffr-test.yml b/.github/workflows/diffr-test.yml index 5d9885d81..2c30e807d 100644 --- a/.github/workflows/diffr-test.yml +++ b/.github/workflows/diffr-test.yml @@ -173,27 +173,6 @@ jobs: # The target matrix above exercises the embedded components. - run: cargo xtask test-plugins - test_mime_db: - name: Test with MIME database - runs-on: ubuntu-22.04 - defaults: - run: - working-directory: diffr - steps: - # v4.2.2 - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - with: - persist-credentials: false - - uses: dtolnay/rust-toolchain@1.99.0 - with: - targets: wasm32-wasip2 - - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - with: - workspaces: diffr -> target - cache-workspace-crates: true - # This runs tests that rely on the MIME database being present. - - run: cargo test -- --ignored - test_linux_latest_stable: name: Test Linux (latest stable Rust) if: github.event_name != 'pull_request'