Add CI workflow to run clippy and tests on all PRs - #12
Merged
Merged
Conversation
Also remove the orphaned tests/openapi.rs, which referenced the openapi module deleted in 9f64cc1 and broke `cargo test --all-features`. https://claude.ai/code/session_01BzqC31UjuAPBM2H7hfzdju
Extract clippy + test into a reusable test.yml that runs the cargo-hack feature powerset (no features, all features, and every subset). Both the PR workflow and the release workflow now call it, so releases run the same checks before publishing. https://claude.ai/code/session_01BzqC31UjuAPBM2H7hfzdju
Add a profile matrix (debug/release) to the reusable test workflow so clippy and tests cover every feature subset in both build profiles. https://claude.ai/code/session_01BzqC31UjuAPBM2H7hfzdju
Drop the separate pr.yaml wrapper and add the pull_request trigger to the reusable test workflow, which still exposes workflow_call for releases. https://claude.ai/code/session_01BzqC31UjuAPBM2H7hfzdju
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+10
to
+12
| uses: ./.github/workflows/test.yml | ||
|
|
||
| publish: |
Comment on lines
+9
to
+32
| name: 🧪 Test (${{ matrix.profile }}) | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| profile: | ||
| - debug | ||
| - release | ||
| steps: | ||
| - name: 🛠 Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: 🔧 Install cargo-hack | ||
| uses: taiki-e/install-action@v2 | ||
| with: | ||
| tool: cargo-hack | ||
|
|
||
| - name: 📦 Cargo clippy (feature powerset) | ||
| run: | | ||
| cargo hack clippy --feature-powerset ${{ matrix.profile == 'release' && '--release' || '' }} -- -D warnings | ||
|
|
||
| - name: 🧪 Cargo test (feature powerset) | ||
| run: | | ||
| cargo hack test --feature-powerset ${{ matrix.profile == 'release' && '--release' || '' }} |
2 tasks
popen2
added a commit
that referenced
this pull request
May 28, 2026
Addresses CodeQL findings on the test and release workflows (PR #12 review): neither declared an explicit permissions block, so GITHUB_TOKEN defaulted to broader access than needed. The workflows only need to checkout the repo; cargo publish uses CARGO_REGISTRY_TOKEN, not the default token. https://claude.ai/code/session_01BzqC31UjuAPBM2H7hfzdju
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Also remove the orphaned tests/openapi.rs, which referenced the
openapi module deleted in 9f64cc1 and broke
cargo test --all-features.https://claude.ai/code/session_01BzqC31UjuAPBM2H7hfzdju