bashkit/.github/workflows/nightly.yml at main · everruns/bashkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
name: Nightly

# Heavy analysis jobs — too slow for every PR, run nightly instead.
on:
  schedule:
    # 4 AM UTC daily (after fuzz at 3 AM)
    - cron: '0 4 * * *'
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  miri:
    name: Miri
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust nightly with Miri
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: miri

      - name: Setup Miri
        run: cargo +nightly miri setup

      - name: Run Miri on library tests
        run: |
          cargo +nightly miri test --lib -p bashkit -- \
            --test-threads=1 \
            test_parse_simple_command \
            test_parse_variable \
            test_parse_pipeline
        env:
          MIRIFLAGS: -Zmiri-disable-isolation

  security-analysis:
    name: Security Analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Install cargo-geiger
        uses: taiki-e/cache-cargo-install-action@v3
        with:
          tool: cargo-geiger
          locked: true

      - name: Run cargo-geiger (unsafe code audit)
        run: |
          cargo geiger --all-features 2>&1 | tee geiger-report.txt
          echo "::notice::Unsafe code report generated. Review geiger-report.txt for details."
        continue-on-error: true

      - name: Upload geiger report
        uses: actions/upload-artifact@v7
        with:
          name: geiger-report
          path: geiger-report.txt
          retention-days: 30

  asan:
    name: AddressSanitizer
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: rust-src

      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true

      - name: Run tests with AddressSanitizer
        env:
          RUSTFLAGS: "-Z sanitizer=address"
          ASAN_OPTIONS: "detect_stack_use_after_return=1:detect_leaks=0"
        run: |
          cargo +nightly test -Z build-std --target x86_64-unknown-linux-gnu --lib --tests \
            -- --test-threads=1