rythondev
b6023adc1e
Some checks failed
Docker Compose Deploy / build_and_deploy (push) Has been cancelled
revert Merge pull request 'corrected CI label' (#2) from hotfix/ci-runner-fix into main Reviewed-on: #2
46 lines
2 KiB
YAML
46 lines
2 KiB
YAML
name: CI
|
|
|
|
# pull_request_target always runs this file from the base branch. A pull request
|
|
# cannot replace these steps, which is what `pull_request` would allow after
|
|
# someone clicks Approve on a fork.
|
|
#
|
|
# Forks still are not compiled until a maintainer adds the `ci` label. `cargo
|
|
# check` executes build scripts, so review Cargo.toml, Cargo.lock, build.rs,
|
|
# and .cargo/config.toml before adding it. New commits do not reuse that label;
|
|
# remove it and add it again after reviewing them.
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened, labeled]
|
|
|
|
jobs:
|
|
check:
|
|
if: |
|
|
forgejo.event.pull_request.head.repo.full_name == forgejo.repository ||
|
|
(forgejo.event.action == 'label_updated' && forgejo.event.label.name == 'ci')
|
|
runs-on: native
|
|
steps:
|
|
- name: Checkout pull request
|
|
uses: https://data.forgejo.org/actions/checkout@v4
|
|
with:
|
|
repository: ${{ forgejo.event.pull_request.head.repo.full_name }}
|
|
ref: ${{ forgejo.event.pull_request.head.sha }}
|
|
persist-credentials: false
|
|
|
|
- name: Cargo check
|
|
run: |
|
|
docker run --rm \
|
|
--read-only \
|
|
--network bridge \
|
|
--cap-drop ALL \
|
|
--security-opt no-new-privileges \
|
|
--pids-limit 512 \
|
|
--memory 4g \
|
|
--tmpfs /tmp:rw,exec,nosuid,nodev,size=2g \
|
|
--user "$(id -u):$(id -g)" \
|
|
-e CARGO_HOME=/tmp/cargo \
|
|
-e CARGO_TARGET_DIR=/tmp/target \
|
|
-e PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
|
|
-v "$PWD:/src:ro" \
|
|
-w /src \
|
|
rust:1.98-bookworm \
|
|
cargo check --locked --manifest-path /src/Cargo.toml
|