Skip to content

Commit 55ab8b0

Browse files
2bndy52bndy5
committed
chore(dev): review CI
- resolves #182 by replacing rust-based benchmark with nushell script (which employs `hyperfine`) - satisfies `zizmor` linting of CI workflows - migrate from `nox` to `nur` for dev task runner (uses nushell script) - updated pre-commit hooks - updated locked python deps
1 parent 02c500c commit 55ab8b0

24 files changed

+1007
-1010
lines changed

‎.gitattributes‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,5 @@
2727
*.code-workspace text eol=lf
2828
*.clang-tidy text eol=lf
2929
*.clang-format text eol=lf
30+
nurfile text eol=lf
31+
*.nu text eol=lf

‎.github/workflows/benchmark.yml‎

Lines changed: 106 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,62 +1,135 @@
1-
name: Benchmark
1+
name: Performance Regression
22

33
on:
44
push:
55
branches: [main]
66
paths:
7-
- cpp-linter/src/
8-
- cpp-linter/benches/
7+
- cpp-linter/src/**
98
- cpp-linter/Cargo.toml
109
- Cargo.toml
1110
- Cargo.lock
1211
- .github/workflows/benchmark.yml
13-
tags-ignore: ['*']
1412
pull_request:
1513
branches: [main]
1614
paths:
17-
- cpp-linter/src/
18-
- cpp-linter/benches/
15+
- cpp-linter/src/**
1916
- cpp-linter/Cargo.toml
2017
- Cargo.toml
2118
- Cargo.lock
2219
- .github/workflows/benchmark.yml
23-
# `workflow_dispatch` allows CodSpeed to trigger back-test
24-
# performance analysis in order to generate initial data.
25-
workflow_dispatch:
2620

27-
# This CI workflow can take up to 2 hours.
28-
# This setting will auto-cancel a old run if a new run is started.
29-
concurrency:
30-
group: ${{ github.workflow }}-${{ github.ref }}
31-
cancel-in-progress: true
21+
permissions: {}
3222

3323
jobs:
24+
build-bin:
25+
name: Build ${{ matrix.name }} binary
26+
runs-on: ubuntu-latest
27+
strategy:
28+
matrix:
29+
include:
30+
- commit: ${{ github.sha }}
31+
name: current
32+
- commit: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
33+
name: previous
34+
env:
35+
BIN: target/release/cpp-linter
36+
steps:
37+
- name: Checkout ${{ matrix.name }}
38+
uses: actions/checkout@v5
39+
with:
40+
ref: ${{ matrix.commit }}
41+
persist-credentials: false
42+
- name: Cache base ref build
43+
uses: actions/cache@v4
44+
id: cache
45+
with:
46+
key: bin-cache-${{ hashFiles('cpp-linter/src/**', 'Cargo.toml', 'Cargo.lock', 'cpp-linter/Cargo.toml') }}
47+
path: ${{ env.BIN }}
48+
- name: Validate cached binary
49+
if: steps.cache.outputs.cache-hit == 'true'
50+
id: validate
51+
run: |
52+
chmod +x ${{ env.BIN }}
53+
if ! ${{ env.BIN }} version; then
54+
echo "Cached binary is invalid, rebuilding..."
55+
echo "cache-valid=false" >> "$GITHUB_OUTPUT"
56+
fi
57+
- run: rustup update --no-self-update
58+
if: steps.cache.outputs.cache-hit != 'true' || steps.validate.outputs.cache-valid == 'false'
59+
- run: cargo build --bin cpp-linter --release
60+
if: steps.cache.outputs.cache-hit != 'true' || steps.validate.outputs.cache-valid == 'false'
61+
- name: Upload build artifact
62+
uses: actions/upload-artifact@v4
63+
with:
64+
name: ${{ matrix.name }}
65+
path: ${{ env.BIN }}
66+
67+
build-py-binding:
68+
runs-on: ubuntu-latest
69+
steps:
70+
- uses: actions/checkout@v5
71+
with:
72+
persist-credentials: false
73+
- name: Set up Python
74+
uses: actions/setup-python@v4
75+
id: setup-python
76+
with:
77+
python-version: '3.x'
78+
- name: Build wheels
79+
uses: PyO3/maturin-action@86b9d133d34bc1b40018696f782949dac11bd380 # v1.49.4
80+
with:
81+
target: x86_64
82+
args: --release --out dist --find-interpreter --features openssl-vendored
83+
manylinux: auto
84+
before-script-linux: |
85+
# NOTE: rust-cross/manylinux docker images are CentOS based
86+
yum update -y
87+
yum install -y openssl openssl-devel
88+
- name: Upload wheels
89+
uses: actions/upload-artifact@v4
90+
with:
91+
name: wheel
92+
path: dist/*
93+
3494
benchmark:
95+
name: Measure Performance Difference
96+
needs: [build-bin, build-py-binding]
3597
runs-on: ubuntu-latest
3698
steps:
3799
- uses: actions/checkout@v5
38-
# using the generated compilation database,
39-
# we will use cpp-linter to scan libgit2 src/libgit2/**.c files.
100+
with:
101+
persist-credentials: false
40102
- name: Checkout libgit2
41103
uses: actions/checkout@v5
42104
with:
43105
repository: libgit2/libgit2
44106
ref: v1.8.1
45-
path: cpp-linter/benches/libgit2
46-
- name: Generate compilation database
47-
working-directory: cpp-linter/benches/libgit2
48-
run: |
49-
mkdir build && cd build
50-
cmake -DCMAKE_EXPORT_COMPILE_COMMANDS=ON ..
107+
path: benchmark/libgit2
108+
persist-credentials: false
109+
110+
- name: Download built binaries
111+
uses: actions/download-artifact@v5
112+
51113
- name: Install cargo-binstall
52-
uses: cargo-bins/cargo-binstall@main
53-
- name: Install cargo-codspeed
54-
run: cargo binstall -y cargo-codspeed
55-
- name: Build the benchmark target(s)
56-
run: cargo codspeed build
57-
- name: Run benchmarks
58-
uses: CodSpeedHQ/action@v4
59-
with:
60-
mode: instrumentation
61-
run: cargo codspeed run
62-
token: ${{ secrets.CODSPEED_TOKEN }}
114+
uses: cargo-bins/cargo-binstall@38e8f5e4c386b611d51e8aa997b9a06a3c8eb67a # v1.15.6
115+
env:
116+
GITHUB_TOKEN: ${{ github.token }}
117+
- name: Install hyperfine
118+
env:
119+
GITHUB_TOKEN: ${{ github.token }}
120+
run: cargo binstall -y hyperfine
121+
- name: Install nushell
122+
uses: hustcer/setup-nu@985d59ec83ae3e3418f9d36471cda38b9d8b9879 # v3.20
123+
124+
- name: Run benchmark script
125+
working-directory: benchmark
126+
shell: nu {0}
127+
run: |-
128+
let new_py = (
129+
glob "../wheel/cpp_linter-*.whl"
130+
| first
131+
| path expand
132+
)
133+
let prev_bin = "../previous/cpp-linter" | path expand
134+
let curr_bin = "../current/cpp-linter" | path expand
135+
nu benchmark.nu --new-py $new_py --rust-bin $curr_bin --prev-rust-bin $prev_bin

‎.github/workflows/binary-builds.yml‎

Lines changed: 42 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
name: Binary builds
22

3-
permissions:
4-
contents: read
5-
63
on:
74
push:
85
branches: [main]
@@ -25,9 +22,7 @@ env:
2522
CARGO_TERM_COLOR: always
2623
RUST_BACKTRACE: 1
2724

28-
defaults:
29-
run:
30-
shell: bash
25+
permissions: {}
3126

3227
jobs:
3328

@@ -103,19 +98,26 @@ jobs:
10398
steps:
10499
- name: Checkout
105100
uses: actions/checkout@v5
101+
with:
102+
persist-credentials: false
106103

107104
- name: Setup Rust
108-
uses: dtolnay/rust-toolchain@stable
109-
with:
110-
target: ${{ matrix.target }}
105+
env:
106+
RS_TARGET: ${{ matrix.target }}
107+
run: |-
108+
rustup update stable --no-self-update
109+
rustup target add $RS_TARGET
111110
111+
- name: Install cargo-binstall
112+
if: matrix.cross
113+
uses: cargo-bins/cargo-binstall@38e8f5e4c386b611d51e8aa997b9a06a3c8eb67a # v1.15.6
114+
env:
115+
GITHUB_TOKEN: ${{ github.token }}
112116
- name: Install cross (cargo cross compiler)
113117
if: matrix.cross
114-
uses: taiki-e/install-action@v2
115118
env:
116119
GITHUB_TOKEN: ${{ github.token }}
117-
with:
118-
tool: cross
120+
run: cargo binstall -y cross
119121

120122
- name: Build
121123
run: >-
@@ -127,8 +129,25 @@ jobs:
127129
--target ${{ matrix.target }}
128130
${{ matrix.vendored && '--features openssl-vendored' || '' }}
129131
130-
- name: Prepare artifacts
131-
run: mv target/${{ matrix.target }}/release/cpp-linter${{ runner.os == 'Windows' && '.exe' || '' }} ./cpp-linter-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}
132+
- name: Prepare artifacts (unix)
133+
if: runner.os != 'Windows'
134+
shell: bash
135+
run: |-
136+
tgt="cpp-linter"
137+
mv "target/${{ matrix.target }}/release/${tgt}" "${tgt}"
138+
arc_name="cpp-linter-${{ matrix.target }}.tar.gz"
139+
tar -a -c -v -z -f "${arc_name}" ${tgt} LICENSE
140+
- name: Prepare artifacts (windows)
141+
if: runner.os == 'Windows'
142+
shell: pwsh
143+
# `tar.exe` in powershell is different from `tar` in bash.
144+
# need to use `tar.exe` in powershell to create a valid zip file.
145+
run: |-
146+
$tgt = "cpp-linter.exe"
147+
mv "target/${{ matrix.target }}/release/${tgt}" "${tgt}"
148+
$arc_name = "cpp-linter-${{ matrix.target }}.zip"
149+
tar -a -c -v -f "${arc_name}" ${tgt} LICENSE
150+
132151
- name: Upload artifacts
133152
uses: actions/upload-artifact@v4
134153
with:
@@ -141,6 +160,7 @@ jobs:
141160
runs-on: ubuntu-latest
142161
needs: [create-assets]
143162
permissions:
163+
id-token: write
144164
contents: write
145165
steps:
146166
- uses: actions/checkout@v5
@@ -160,9 +180,14 @@ jobs:
160180
- name: Create a Github Release
161181
env:
162182
GH_TOKEN: ${{ github.token }}
183+
GIT_REF: ${{ github.ref_name }}
163184
run: |
164185
files=$(ls dist/cpp-linter*)
165-
gh release upload "${{ github.ref_name }}" $files
166-
- run: cargo publish -p cpp-linter
186+
gh release upload "$GIT_REF" $files
187+
- name: Establish provenance
188+
id: auth
189+
uses: rust-lang/crates-io-auth-action@e919bc7605cde86df457cf5b93c5e103838bd879 # v1.0.1
190+
- name: Publish package
167191
env:
168-
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
192+
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
193+
run: cargo publish -p cpp-linter

‎.github/workflows/build-docs.yml‎

Lines changed: 48 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,15 @@ env:
2323
CARGO_TERM_COLOR: always
2424
RUST_BACKTRACE: 1
2525

26+
permissions: {}
27+
2628
jobs:
2729
cache-deps:
2830
runs-on: ubuntu-latest
2931
steps:
3032
- uses: actions/checkout@v5
33+
with:
34+
persist-credentials: false
3135
- run: rustup update --no-self-update
3236
- name: Cache .cargo locked resources
3337
uses: actions/cache@v4
@@ -39,51 +43,78 @@ jobs:
3943
build-mkdocs:
4044
runs-on: ubuntu-latest
4145
needs: [cache-deps]
42-
permissions:
43-
contents: write
4446
steps:
4547
- uses: actions/checkout@v5
48+
with:
49+
persist-credentials: false
4650
- name: Cache .cargo locked resources
4751
uses: actions/cache/restore@v4
4852
with:
4953
path: ~/.cargo
5054
key: ${{ runner.os }}-docs-cargo-${{ hashFiles('Cargo.lock') }}
5155
- name: Install uv
52-
uses: astral-sh/setup-uv@v6
53-
with:
54-
enable-cache: true
55-
cache-dependency-glob: "uv.lock"
56+
uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
57+
- name: Install cargo-binstall
58+
uses: cargo-bins/cargo-binstall@38e8f5e4c386b611d51e8aa997b9a06a3c8eb67a # v1.15.6
59+
env:
60+
GITHUB_TOKEN: ${{ github.token }}
61+
- name: Install nur
62+
run: cargo binstall -y nur
63+
env:
64+
GITHUB_TOKEN: ${{ github.token }}
5665
- name: Build docs
57-
run: uvx nox -s docs-build
66+
run: nur docs --build
5867
- name: Upload docs build as artifact
59-
uses: actions/upload-artifact@v4
68+
uses: actions/upload-pages-artifact@v4
6069
with:
6170
name: cpp-linter-docs
6271
path: docs/site
63-
- name: Upload to github pages
64-
# only publish doc changes from main branch
65-
if: github.ref == 'refs/heads/main'
66-
uses: peaceiris/actions-gh-pages@v4
67-
with:
68-
github_token: ${{ secrets.GITHUB_TOKEN }}
69-
publish_dir: docs/site
7072

7173
build-rustdoc:
7274
runs-on: ubuntu-latest
7375
needs: [cache-deps]
7476
steps:
7577
- uses: actions/checkout@v5
78+
with:
79+
persist-credentials: false
7680
- run: rustup update --no-self-update
7781
- name: Cache .cargo locked resources
7882
uses: actions/cache/restore@v4
7983
with:
8084
path: ~/.cargo
8185
key: ${{ runner.os }}-docs-cargo-${{ hashFiles('Cargo.lock') }}
8286
- name: Install uv
83-
uses: astral-sh/setup-uv@v6
84-
- run: uvx nox -s docs-rs
87+
uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
88+
- name: Install cargo-binstall
89+
uses: cargo-bins/cargo-binstall@38e8f5e4c386b611d51e8aa997b9a06a3c8eb67a # v1.15.6
90+
env:
91+
GITHUB_TOKEN: ${{ github.token }}
92+
- name: Install nur
93+
run: cargo binstall -y nur
94+
env:
95+
GITHUB_TOKEN: ${{ github.token }}
96+
- run: nur docs rs
8597
- name: upload rustdoc build as artifact
8698
uses: actions/upload-artifact@v4
8799
with:
88100
path: target/doc
89101
name: cpp-linter-api_docs
102+
103+
deploy:
104+
if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
105+
needs: [build-mkdocs]
106+
runs-on: ubuntu-latest
107+
permissions:
108+
pages: write # to deploy to Pages
109+
id-token: write # to verify the deployment originates from an appropriate source
110+
# Deploy to the github-pages environment
111+
environment:
112+
name: github-pages
113+
url: ${{ steps.deployment.outputs.page_url }}
114+
steps:
115+
- name: Deploy to GitHub Pages
116+
uses: actions/deploy-pages@v4
117+
id: deployment
118+
with:
119+
token: ${{ secrets.GITHUB_TOKEN }}
120+
artifact_name: cpp-linter-docs

0 commit comments

Comments
 (0)