alice.pds.demo.boltless.dev
This repository has no description
.tangled/workflows: run rust checks and tests
author
did:plc:3fwecdnvtcscjnrx2p4n7a…
committer
Anirudh Oppiliappan
date
(Jul 31, 2026, 10:44 AM +0300)
commit
20c60fb4
20c60fb46793ced32720b2b5b4419ef961ae8f2e
parent
f7f09c9f
f7f09c9f185b31702329f23f1bb9a5d48ea38bef
change-id
xkpultvx
xkpultvxysxxvzyllxquxrynrwsusxyr
did:plc:3fwecdnvtcscjnrx2p4n7a…
committer
+197
-32
+32
.tangled/workflows/rust-checks.yml
+32
.tangled/workflows/rust-checks.yml
···
1
+
when:
2
+
- event: ["push", "pull_request"]
3
+
branch: master
4
+
5
+
engine: nixery
6
+
7
+
dependencies:
8
+
nixpkgs:
9
+
- gcc
10
+
- gnumake
11
+
- cmake
12
+
- perl
13
+
- gawk
14
+
- gnused
15
+
- gnugrep
16
+
- findutils
17
+
- just
18
+
github:nix-community/fenix/f6670530f53e69cc284f7aef818eb0f08fe81905:
19
+
- stable.defaultToolchain
20
+
21
+
environment:
22
+
CARGO_INCREMENTAL: "0"
23
+
CARGO_PROFILE_DEV_DEBUG: "0"
24
+
25
+
steps:
26
+
- name: knot architecture checks
27
+
command: |
28
+
cd knot2 && just checks
29
+
30
+
- name: knot lints
31
+
command: |
32
+
cd knot2 && just clippy
+38
.tangled/workflows/rust-test-bobbin.yml
+38
.tangled/workflows/rust-test-bobbin.yml
···
1
+
when:
2
+
- event: ["push"]
3
+
branch: master
4
+
paths:
5
+
- bobbin/crates/**
6
+
- shuttle/**
7
+
- lexicons/**
8
+
- Cargo.toml
9
+
- Cargo.lock
10
+
- rust-toolchain.toml
11
+
- .tangled/workflows/rust-test-bobbin.yml
12
+
13
+
engine: nixery
14
+
15
+
dependencies:
16
+
nixpkgs:
17
+
- gcc
18
+
- gnumake
19
+
- cmake
20
+
- perl
21
+
- gawk
22
+
- gnused
23
+
- gnugrep
24
+
- findutils
25
+
- protobuf
26
+
github:nix-community/fenix/f6670530f53e69cc284f7aef818eb0f08fe81905:
27
+
- stable.defaultToolchain
28
+
29
+
environment:
30
+
CARGO_INCREMENTAL: "0"
31
+
CARGO_PROFILE_DEV_DEBUG: "0"
32
+
CARGO_PROFILE_TEST_DEBUG: "0"
33
+
RUST_BACKTRACE: "1"
34
+
35
+
steps:
36
+
- name: bobbin and shuttle tests
37
+
command: |
38
+
cargo test --locked -p 'bobbin*' -p shuttle
+54
.tangled/workflows/rust-test-knot.yml
+54
.tangled/workflows/rust-test-knot.yml
···
1
+
when:
2
+
- event: ["push"]
3
+
branch: master
4
+
paths:
5
+
- knot2/**
6
+
- lexicons/**
7
+
- Cargo.toml
8
+
- Cargo.lock
9
+
- rust-toolchain.toml
10
+
- .tangled/workflows/rust-test-knot.yml
11
+
12
+
engine: nixery
13
+
14
+
dependencies:
15
+
nixpkgs:
16
+
- gcc
17
+
- gnumake
18
+
- cmake
19
+
- perl
20
+
- gawk
21
+
- gnused
22
+
- gnugrep
23
+
- findutils
24
+
- just
25
+
- git-lfs
26
+
- openssh
27
+
github:nix-community/fenix/f6670530f53e69cc284f7aef818eb0f08fe81905:
28
+
- stable.defaultToolchain
29
+
30
+
environment:
31
+
CARGO_INCREMENTAL: "0"
32
+
CARGO_PROFILE_DEV_DEBUG: "0"
33
+
CARGO_PROFILE_TEST_DEBUG: "0"
34
+
RUST_BACKTRACE: "1"
35
+
KNOT_LFS_CONFORMANCE: "skip"
36
+
GIT_CONFIG_COUNT: "2"
37
+
GIT_CONFIG_KEY_0: "gc.autoDetach"
38
+
GIT_CONFIG_VALUE_0: "false"
39
+
GIT_CONFIG_KEY_1: "maintenance.auto"
40
+
GIT_CONFIG_VALUE_1: "false"
41
+
42
+
steps:
43
+
- name: user database for ssh-keygen and ssh
44
+
command: |
45
+
printf 'root:x:0:0::/tangled/home:/bin/bash\n' > /etc/passwd &&
46
+
printf 'root:x:0:\n' > /etc/group
47
+
48
+
- name: knot tests
49
+
command: |
50
+
cargo test --locked -p 'knot-*'
51
+
52
+
- name: knot instrumented tests
53
+
command: |
54
+
cd knot2 && just instrument-tests
+12
-3
knot2/crates/knot-bench/tests/gate.rs
+12
-3
knot2/crates/knot-bench/tests/gate.rs
···
2
2
3
3
use knot_bench::{ChurnCount, CommitCount, HistorySpec, PathCount, build_history};
4
4
use knot_git::instrument::measure;
5
-
use knot_git::{Filter, PackBudget};
5
+
use knot_git::{Filter, Haves, PackBudget, Wants};
6
6
use knot_pack::upload_pack;
7
7
use knot_types::Oid;
8
8
···
39
39
let (_selection, reads) = measure(|| {
40
40
history
41
41
.repo()
42
-
.select_pack_objects_filtered(&tips, &[], Filter::None, PackBudget::unbounded())
42
+
.select_pack_objects_filtered(
43
+
Wants::new(&tips),
44
+
Haves::new(&[]),
45
+
Filter::None,
46
+
PackBudget::unbounded(),
47
+
)
43
48
.unwrap()
44
49
});
45
50
assert_eq!(
···
57
62
#[test]
58
63
fn the_upload_pack_server_path_has_an_exact_odb_read_count() {
59
64
let history = build_history(gate_spec());
60
-
let walk = history.repo().rev_walk(&history.tips(), &[]).unwrap();
65
+
let tips = history.tips();
66
+
let walk = history
67
+
.repo()
68
+
.rev_walk(Wants::new(&tips), Haves::new(&[]))
69
+
.unwrap();
61
70
let hidden = walk
62
71
.iter()
63
72
.copied()
+60
-28
knot2/justfile
+60
-28
knot2/justfile
···
13
13
cargo fmt --all --check
14
14
15
15
clippy:
16
-
cargo clippy -p 'knot-*' --all-targets -- -D warnings
16
+
cargo clippy --locked -p 'knot-*' --all-targets -- -D warnings
17
17
18
18
test:
19
-
cargo test -p 'knot-*'
19
+
cargo test --locked -p 'knot-*'
20
20
21
21
fuzz crate='knot-pack' target='pack' time='60':
22
22
cd crates/{{crate}}/fuzz && RUSTUP_TOOLCHAIN=nightly cargo fuzz run {{target}} -- -max_total_time={{time}}
···
31
31
bench-scaling:
32
32
cargo bench -p knot-bench --bench coldstart
33
33
34
-
bench-gate:
35
-
cargo test -p knot-bench --features instrument --test gate
36
-
37
-
bench-gate-registry:
38
-
cargo test -p knot-bench --features instrument --test registry_gate
34
+
instrument-tests:
35
+
cargo test --locked -p knot-bench --features instrument --tests
39
36
40
37
differential:
41
38
cargo test -p knot-pack --test differential
···
43
40
t55xx *tests:
44
41
internal_docs/t55xx/run.sh {{tests}}
45
42
46
-
ci: fmt-check clippy test gates bench-gate fuzz-ci
43
+
ci: fmt-check clippy test checks instrument-tests fuzz-ci
47
44
48
-
gates: gate-no-subprocess (gate-no-banned-deps "no-sql" "an embedded database" "rusqlite|libsqlite3-sys|sqlx|sqlx-core|sled|fjall|redb") (gate-no-banned-deps "no-native-git" "a native git or TLS shim" "git2|libgit2-sys|openssl-sys|zlib-ng|zlib-ng-sys") gate-no-string-ids gate-no-unguarded-receive gate-fuzz-targets-enumerated
45
+
checks: require-tools check-no-subprocess (check-no-banned-deps "no-sql" "an embedded database" "rusqlite|libsqlite3-sys|sqlx|sqlx-core|sled|fjall|redb") (check-no-banned-deps "no-native-git" "a native git or TLS shim" "git2|libgit2-sys|openssl-sys|zlib-ng|zlib-ng-sys") check-no-string-ids check-no-unguarded-receive check-fuzz-targets-enumerated check-workflow-toolchain
49
46
50
-
gate-no-subprocess:
47
+
require-tools:
51
48
#!/usr/bin/env bash
52
49
set -euo pipefail
53
-
hits=$(grep -rn "process::Command" crates/*/src --include="*.rs" | grep -v "/_lex/" || true)
50
+
missing=""
51
+
for tool in cargo comm cut find grep head just mktemp rm sed sort tr; do
52
+
command -v "$tool" >/dev/null 2>&1 || missing="$missing $tool"
53
+
done
54
+
if [ -n "$missing" ]; then
55
+
echo "require-tools failed, these aren't on PATH:$missing" >&2
56
+
exit 1
57
+
fi
58
+
echo "ok: every tool the checks below run is on PATH"
59
+
60
+
check-no-subprocess:
61
+
#!/usr/bin/env bash
62
+
set -euo pipefail
63
+
hits=$(grep -rn --include="*.rs" --exclude-dir=_lex "process::Command" crates/*/src || [ $? = 1 ])
54
64
if [ -n "$hits" ]; then
55
-
echo "no-subprocess gate failed: server source spawns processes" >&2
65
+
echo "no-subprocess check failed: server source spawns processes" >&2
56
66
echo "$hits" >&2
57
67
exit 1
58
68
fi
59
69
echo "ok: no process spawning in server source"
60
70
61
-
gate-no-banned-deps name subject pattern:
71
+
check-no-banned-deps name subject pattern:
62
72
#!/usr/bin/env bash
63
73
set -euo pipefail
64
-
hits=$(cargo tree -p knot-server --edges normal,build --prefix none | sort -u | grep -iE '^({{pattern}}) v' || true)
74
+
tree=$(cargo tree --locked -p knot-server --edges normal,build --prefix none | sort -u)
75
+
hits=$(printf '%s\n' "$tree" | grep -iE '^({{pattern}}) v' || [ $? = 1 ])
65
76
if [ -n "$hits" ]; then
66
-
echo "{{name}} gate failed: {{subject}} is in the knot-server dependency tree" >&2
77
+
echo "{{name}} check failed: {{subject}} is in the knot-server dependency tree" >&2
67
78
echo "$hits" >&2
68
79
exit 1
69
80
fi
70
81
echo "ok: {{subject}} isn't in the knot-server dependency tree"
71
82
72
-
gate-no-string-ids:
83
+
check-no-string-ids:
73
84
#!/usr/bin/env bash
74
85
set -euo pipefail
75
-
hits=$(grep -nE 'pub fn .*(-> *String|: *String\b)' crates/knot-types/src/ids.rs | grep -v 'fn to_hex' || true)
86
+
declared=$(grep -nE 'pub fn .*(-> *String|: *String\b)' crates/knot-types/src/ids.rs || [ $? = 1 ])
87
+
hits=$(printf '%s\n' "$declared" | grep -v 'fn to_hex' || [ $? = 1 ])
76
88
if [ -n "$hits" ]; then
77
-
echo "no-string-ids gate failed: a String-typed id crosses the knot-types boundary" >&2
89
+
echo "no-string-ids check failed: a String-typed id crosses the knot-types boundary" >&2
78
90
echo "$hits" >&2
79
91
exit 1
80
92
fi
81
93
echo "ok: no String-typed id crosses the knot-types boundary"
82
94
83
-
gate-no-unguarded-receive:
95
+
check-no-unguarded-receive:
84
96
#!/usr/bin/env bash
85
97
set -euo pipefail
86
-
hits=$(grep -rn 'receive_pack(\|receive_pack_with_limits(' crates/*/src --include="*.rs" | grep -v 'pub fn ' || true)
98
+
called=$(grep -rn --include="*.rs" 'receive_pack(\|receive_pack_with_limits(' crates/*/src || [ $? = 1 ])
99
+
hits=$(printf '%s\n' "$called" | grep -v 'pub fn ' || [ $? = 1 ])
87
100
if [ -n "$hits" ]; then
88
-
echo "no-unguarded-receive gate failed: server source calls the unguarded receive path, use receive_pack_guarded" >&2
101
+
echo "no-unguarded-receive check failed: server source calls the unguarded receive path, use receive_pack_guarded" >&2
89
102
echo "$hits" >&2
90
103
exit 1
91
104
fi
92
105
echo "ok: the unguarded receive path is reached only from tests"
93
106
94
-
gate-fuzz-targets-enumerated:
107
+
check-fuzz-targets-enumerated:
95
108
#!/usr/bin/env bash
96
109
set -euo pipefail
97
110
disk=$(mktemp)
···
103
116
cut -d' ' -f1,2 "$triplet" > "$recipe"
104
117
while read -r crate target secs; do
105
118
if ! [[ "$secs" =~ ^[1-9][0-9]*$ ]]; then
106
-
echo "fuzz-targets-enumerated gate failed: target '$crate $target' runs for '$secs', not a positive number of seconds" >&2
119
+
echo "fuzz-targets-enumerated check failed: target '$crate $target' runs for '$secs', not a positive number of seconds" >&2
107
120
exit 1
108
121
fi
109
122
done < "$triplet"
110
-
missing=$(comm -23 "$disk" "$recipe" || true)
111
-
extra=$(comm -13 "$disk" "$recipe" || true)
123
+
missing=$(comm -23 "$disk" "$recipe")
124
+
extra=$(comm -13 "$disk" "$recipe")
112
125
if [ -n "$missing" ] || [ -n "$extra" ]; then
113
-
echo "fuzz-targets-enumerated gate failed: the fuzz-ci recipe and the targets on disk disagree" >&2
126
+
echo "fuzz-targets-enumerated check failed: the fuzz-ci recipe and the targets on disk disagree" >&2
114
127
if [ -n "$missing" ]; then
115
128
echo "on disk but absent from fuzz-ci:" >&2
116
129
echo "$missing" >&2
···
124
137
while read -r crate target; do
125
138
manifest="crates/$crate/fuzz/Cargo.toml"
126
139
if ! grep -qF "name = \"$target\"" "$manifest" || ! grep -qF "path = \"fuzz_targets/$target.rs\"" "$manifest"; then
127
-
echo "fuzz-targets-enumerated gate failed: $manifest has no [[bin]] declaring target '$target'" >&2
140
+
echo "fuzz-targets-enumerated check failed: $manifest has no [[bin]] declaring target '$target'" >&2
128
141
exit 1
129
142
fi
130
143
entry=$(grep -oE 'knot_[a-z0-9_]+::fuzz::[a-z0-9_]+' "crates/$crate/fuzz/fuzz_targets/$target.rs" | head -1 | sed -E 's#.*::fuzz::##' || true)
131
144
smoke="crates/$crate/tests/fuzz_smoke.rs"
132
145
if [ -z "$entry" ] || ! grep -qE "fuzz::${entry}\(" "$smoke"; then
133
-
echo "fuzz-targets-enumerated gate failed: target '$target' entry point $(echo "$crate" | tr - _)::fuzz::$entry has no smoke-test coverage in $smoke" >&2
146
+
echo "fuzz-targets-enumerated check failed: target '$target' entry point $(echo "$crate" | tr - _)::fuzz::$entry has no smoke-test coverage in $smoke" >&2
134
147
exit 1
135
148
fi
136
149
done < "$disk"
137
150
echo "ok: every fuzz target is enumerated in fuzz-ci, declared in its fuzz manifest, and smoke-tested"
151
+
152
+
check-workflow-toolchain:
153
+
#!/usr/bin/env bash
154
+
set -euo pipefail
155
+
locked=$(sed -n '/^ "fenix": {/,/^ }/p' ../flake.lock | sed -nE 's/.*"rev": "([0-9a-f]{40})".*/\1/p' | head -1)
156
+
if [ -z "$locked" ]; then
157
+
echo "workflow-toolchain check failed: no fenix node with a revision in flake.lock" >&2
158
+
exit 1
159
+
fi
160
+
used=$(grep -hoE 'github:nix-community/fenix/[0-9a-f]{40}' ../.tangled/workflows/*.yml | sed -E 's#.*/##' | sort -u || [ $? = 1 ])
161
+
if [ -z "$used" ]; then
162
+
echo "workflow-toolchain check failed: no workflow in ../.tangled/workflows references a fenix revision" >&2
163
+
exit 1
164
+
fi
165
+
if [ "$used" != "$locked" ]; then
166
+
echo "workflow-toolchain check failed: flake.lock records fenix $locked and the workflows reference '$used'" >&2
167
+
exit 1
168
+
fi
169
+
echo "ok: every workflow builds with the fenix revision flake.lock records"
+1
-1
nix/modules/spindle.nix
+1
-1
nix/modules/spindle.nix
···
145
145
workflowTimeout = mkOption {
146
146
type = types.str;
147
147
default = "5m";
148
-
description = "Timeout for each workflow step";
148
+
description = "Timeout for a whole workflow, covering the wait for a concurrency slot, setup, and every step in it";
149
149
};
150
150
151
151
nixery = {