docs: Safety docs #18351
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| merge_group: | |
| types: [checks_requested] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref_name }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| NOX_DEFAULT_VENV_BACKEND: uv | |
| UV_CONSTRAINT: ${{ github.workspace }}/.github/uv-constraints.txt | |
| UV_PYTHON: 3.14 | |
| jobs: | |
| fmt: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.14" | |
| - uses: astral-sh/setup-uv@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt | |
| - name: Check python formatting and lints (ruff) | |
| run: uvx nox -s ruff | |
| - name: Check rust formatting (rustfmt) | |
| run: uvx nox -s rustfmt | |
| - name: Check markdown formatting (rumdl) | |
| run: uvx nox -s rumdl | |
| - name: Check `required-features` in Cargo.toml | |
| run: uvx nox -s check-test-features | |
| - name: Spell check | |
| run: uvx nox -s typos | |
| resolve: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| MSRV: ${{ steps.resolve-msrv.outputs.MSRV }} | |
| verbose: ${{ runner.debug == '1' }} | |
| save-cache: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| # For PRs, we need to run on the real PR head, not the resultant merge of the PR into the target branch. | |
| # | |
| # This is necessary for coverage reporting to make sense; we then get exactly the coverage change | |
| # between the base branch and the real PR head. | |
| # | |
| # If it were run on the merge commit the problem is that the coverage potentially does not align | |
| # with the commit diff, because the merge may affect line numbers. | |
| coverage-sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.14" | |
| - name: resolve MSRV | |
| id: resolve-msrv | |
| run: echo MSRV=`python -c 'import tomllib; print(tomllib.load(open("Cargo.toml", "rb"))["workspace"]["package"]["rust-version"])'` >> $GITHUB_OUTPUT | |
| semver-checks: | |
| if: github.event_name == 'pull_request' | |
| needs: [fmt] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.14" | |
| - name: Fetch merge base | |
| id: fetch_merge_base | |
| uses: ./.github/actions/fetch-merge-base | |
| with: | |
| base_ref: "refs/heads/${{ github.event.pull_request.base.ref }}" | |
| head_ref: "refs/pull/${{ github.event.pull_request.number }}/merge" | |
| - uses: obi1kenobi/cargo-semver-checks-action@v2 | |
| with: | |
| baseline-rev: ${{ steps.fetch_merge_base.outputs.merge_base }} | |
| check-msrv: | |
| needs: [fmt, resolve] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: ${{ needs.resolve.outputs.MSRV }} | |
| components: rust-src | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.14" | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| - uses: astral-sh/setup-uv@v7 | |
| # This is a smoke test to confirm that CI will run on MSRV (including dev dependencies) | |
| - name: Check with MSRV package versions | |
| run: | | |
| uvx nox -s set-msrv-package-versions | |
| uvx nox -s check-all | |
| env: | |
| CARGO_BUILD_TARGET: x86_64-unknown-linux-gnu | |
| clippy: | |
| needs: [fmt] | |
| runs-on: ubuntu-24.04-arm | |
| strategy: | |
| # If one platform fails, allow the rest to keep testing if `CI-no-fail-fast` label is present | |
| fail-fast: ${{ !contains(github.event.pull_request.labels.*.name, 'CI-no-fail-fast') }} | |
| matrix: | |
| rust: [stable] | |
| target: | |
| [ | |
| "aarch64-apple-darwin", | |
| "x86_64-unknown-linux-gnu", | |
| "aarch64-unknown-linux-gnu", | |
| "powerpc64le-unknown-linux-gnu", | |
| "s390x-unknown-linux-gnu", | |
| "wasm32-wasip1", | |
| "x86_64-pc-windows-msvc", | |
| "i686-pc-windows-msvc", | |
| "aarch64-pc-windows-msvc", | |
| ] | |
| include: | |
| # Run beta clippy as a way to detect any incoming lints which may affect downstream users | |
| - rust: beta | |
| target: "x86_64-unknown-linux-gnu" | |
| name: clippy/${{ matrix.target }}/${{ matrix.rust }} | |
| continue-on-error: ${{ matrix.rust != 'stable' }} | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: ${{ matrix.rust }} | |
| targets: ${{ matrix.target }} | |
| components: clippy,rust-src | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| save-cache: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| - run: uvx nox -s clippy-all | |
| env: | |
| CARGO_BUILD_TARGET: ${{ matrix.target }} | |
| check-nightly: | |
| needs: [fmt] | |
| runs-on: ubuntu-24.04-arm | |
| strategy: | |
| # If one platform fails, allow the rest to keep testing if `CI-no-fail-fast` label is present | |
| fail-fast: ${{ !contains(github.event.pull_request.labels.*.name, 'CI-no-fail-fast') }} | |
| matrix: | |
| target: ["x86_64-unknown-linux-gnu"] | |
| name: check-nightly/${{ matrix.target }}/${{ matrix.rust }} | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: dtolnay/rust-toolchain@nightly | |
| with: | |
| targets: ${{ matrix.target }} | |
| components: clippy,rust-src | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| save-cache: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| - run: uvx nox -s check-all | |
| env: | |
| CARGO_BUILD_TARGET: ${{ matrix.target }} | |
| build-pr: | |
| if: ${{ !contains(github.event.pull_request.labels.*.name, 'CI-build-full') && github.event_name == 'pull_request' }} | |
| name: python${{ matrix.python-version }}-${{ matrix.platform.python-architecture }} ${{ matrix.platform.os }} rust-${{ matrix.rust }} | |
| needs: [fmt, resolve] | |
| uses: ./.github/workflows/build.yml | |
| with: | |
| sha: ${{ needs.resolve.outputs.coverage-sha }} | |
| os: ${{ matrix.platform.os }} | |
| python-version: ${{ matrix.python-version }} | |
| python-architecture: ${{ matrix.platform.python-architecture }} | |
| rust: ${{ matrix.rust }} | |
| rust-target: ${{ matrix.platform.rust-target }} | |
| MSRV: ${{ needs.resolve.outputs.MSRV }} | |
| verbose: ${{ needs.resolve.outputs.verbose == 'true' }} | |
| secrets: inherit | |
| strategy: | |
| # If one platform fails, allow the rest to keep testing if `CI-no-fail-fast` label is present | |
| fail-fast: ${{ !contains(github.event.pull_request.labels.*.name, 'CI-no-fail-fast') }} | |
| matrix: | |
| rust: [stable] | |
| python-version: ["3.14"] | |
| platform: | |
| [ | |
| { | |
| os: "macos-latest", | |
| python-architecture: "arm64", | |
| rust-target: "aarch64-apple-darwin", | |
| }, | |
| { | |
| os: "ubuntu-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-unknown-linux-gnu", | |
| }, | |
| { | |
| os: "ubuntu-24.04-arm", | |
| python-architecture: "arm64", | |
| rust-target: "aarch64-unknown-linux-gnu", | |
| }, | |
| { | |
| os: "windows-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-pc-windows-msvc", | |
| }, | |
| { | |
| os: "windows-latest", | |
| python-architecture: "x86", | |
| rust-target: "i686-pc-windows-msvc", | |
| }, | |
| { | |
| os: "windows-11-arm", | |
| python-architecture: "arm64", | |
| rust-target: "aarch64-pc-windows-msvc", | |
| }, | |
| ] | |
| include: | |
| # Test nightly Rust on PRs so that PR authors have a chance to fix nightly | |
| # failures, as nightly does not block merge. | |
| - rust: nightly | |
| python-version: "3.14" | |
| platform: | |
| { | |
| os: "ubuntu-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-unknown-linux-gnu", | |
| } | |
| # Also test free-threaded Python just for latest Python version, on ubuntu | |
| # (run for all OSes on build-full) | |
| - rust: stable | |
| python-version: "3.14t" | |
| platform: | |
| { | |
| os: "ubuntu-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-unknown-linux-gnu", | |
| } | |
| # Also test Python 3.15 and 3.15t, on ubuntu | |
| # (run for all OSes on build-full) | |
| - rust: stable | |
| python-version: "3.15-dev" | |
| platform: | |
| { | |
| os: "ubuntu-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-unknown-linux-gnu", | |
| } | |
| - rust: stable | |
| python-version: "3.15t-dev" | |
| platform: | |
| { | |
| os: "ubuntu-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-unknown-linux-gnu", | |
| } | |
| build-full: | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| name: python${{ matrix.python-version }}-${{ matrix.platform.python-architecture }} ${{ matrix.platform.os }} rust-${{ matrix.rust }} | |
| needs: [fmt, resolve] | |
| uses: ./.github/workflows/build.yml | |
| with: | |
| sha: ${{ needs.resolve.outputs.coverage-sha }} | |
| os: ${{ matrix.platform.os }} | |
| python-version: ${{ matrix.python-version }} | |
| python-architecture: ${{ matrix.platform.python-architecture }} | |
| rust: ${{ matrix.rust }} | |
| rust-target: ${{ matrix.platform.rust-target }} | |
| MSRV: ${{ needs.resolve.outputs.MSRV }} | |
| verbose: ${{ needs.resolve.outputs.verbose == 'true' }} | |
| secrets: inherit | |
| strategy: | |
| # If one platform fails, allow the rest to keep testing if `CI-no-fail-fast` label is present | |
| fail-fast: ${{ !contains(github.event.pull_request.labels.*.name, 'CI-no-fail-fast') }} | |
| matrix: | |
| rust: [stable] | |
| python-version: | |
| [ | |
| "3.9", | |
| "3.10", | |
| "3.11", | |
| "3.12", | |
| "3.13", | |
| "3.14", | |
| "3.14t", | |
| "3.15-dev", | |
| "3.15t-dev", | |
| "pypy3.11", | |
| "graalpy25.0", | |
| ] | |
| platform: | |
| [ | |
| { | |
| os: "macos-latest", | |
| python-architecture: "arm64", | |
| rust-target: "aarch64-apple-darwin", | |
| }, | |
| { | |
| os: "ubuntu-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-unknown-linux-gnu", | |
| }, | |
| { | |
| os: "windows-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-pc-windows-msvc", | |
| }, | |
| ] | |
| include: | |
| # Test minimal supported Rust version | |
| - rust: ${{ needs.resolve.outputs.MSRV }} | |
| python-version: "3.14" | |
| platform: | |
| { | |
| os: "ubuntu-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-unknown-linux-gnu", | |
| } | |
| # Test the `nightly` feature | |
| - rust: nightly | |
| python-version: "3.14" | |
| platform: | |
| { | |
| os: "ubuntu-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-unknown-linux-gnu", | |
| } | |
| # Run rust beta to help catch toolchain regressions | |
| - rust: beta | |
| python-version: "3.14" | |
| platform: | |
| { | |
| os: "ubuntu-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-unknown-linux-gnu", | |
| } | |
| # Test 32-bit Windows and x64 macOS only with the latest Python version | |
| - rust: stable | |
| python-version: "3.14" | |
| platform: | |
| { | |
| os: "windows-latest", | |
| python-architecture: "x86", | |
| rust-target: "i686-pc-windows-msvc", | |
| } | |
| - rust: stable | |
| python-version: "3.14" | |
| platform: | |
| { | |
| os: "macos-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-apple-darwin", | |
| } | |
| # arm64 macOS Python not available on GitHub Actions until 3.10, test older versions on x64 | |
| - rust: stable | |
| python-version: "3.9" | |
| platform: | |
| { | |
| os: "macos-15-intel", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-apple-darwin", | |
| } | |
| # test latest Python on arm64 linux & windows runners | |
| - rust: stable | |
| python-version: "3.14" | |
| platform: | |
| { | |
| os: "ubuntu-24.04-arm", | |
| python-architecture: "arm64", | |
| rust-target: "aarch64-unknown-linux-gnu", | |
| } | |
| - rust: stable | |
| python-version: "3.14t" | |
| platform: | |
| { | |
| os: "ubuntu-24.04-arm", | |
| python-architecture: "arm64", | |
| rust-target: "aarch64-unknown-linux-gnu", | |
| } | |
| - rust: stable | |
| python-version: "3.14" | |
| platform: | |
| { | |
| os: "windows-11-arm", | |
| python-architecture: "arm64", | |
| rust-target: "aarch64-pc-windows-msvc", | |
| } | |
| - rust: stable | |
| python-version: "3.14t" | |
| platform: | |
| { | |
| os: "windows-11-arm", | |
| python-architecture: "arm64", | |
| rust-target: "aarch64-pc-windows-msvc", | |
| } | |
| exclude: | |
| # arm64 macOS Python not available on GitHub Actions until 3.10 | |
| - rust: stable | |
| python-version: "3.9" | |
| platform: | |
| { | |
| os: "macos-latest", | |
| python-architecture: "arm64", | |
| rust-target: "aarch64-apple-darwin", | |
| } | |
| valgrind: | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| needs: [fmt] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.14" | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: taiki-e/install-action@valgrind | |
| - uses: astral-sh/setup-uv@v7 | |
| - run: uvx nox -s test-rust -- release skip-full | |
| env: | |
| CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER: valgrind --leak-check=no --error-exitcode=1 | |
| RUST_BACKTRACE: 1 | |
| UI_TEST: skip | |
| careful: | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| needs: [fmt] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.14" | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| - uses: dtolnay/rust-toolchain@nightly | |
| with: | |
| components: rust-src | |
| - uses: taiki-e/install-action@cargo-careful | |
| - uses: astral-sh/setup-uv@v7 | |
| - run: uvx nox -s test-rust -- careful skip-full | |
| env: | |
| RUST_BACKTRACE: 1 | |
| UI_TEST: skip | |
| docsrs: | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| needs: [fmt] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.14" | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| - uses: dtolnay/rust-toolchain@nightly | |
| with: | |
| components: rust-src | |
| - run: cargo rustdoc --lib --no-default-features --features full,jiff-02 -Zunstable-options --config "build.rustdocflags=[\"--cfg\", \"docsrs\"]" | |
| emscripten: | |
| name: emscripten | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| needs: [fmt] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| save-cache: ${{ needs.resolve.outputs.save-cache }} | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-unknown-emscripten | |
| components: rust-src | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 24 | |
| - uses: actions/cache/restore@v6 | |
| id: cache | |
| with: | |
| path: | | |
| .nox/emscripten | |
| key: emscripten-${{ hashFiles('wasm/emscripten/*', 'wasm/common.mk') }}-${{ hashFiles('noxfile.py') }}-${{ env.UV_PYTHON }} | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| - name: Build | |
| if: steps.cache.outputs.cache-hit != 'true' | |
| run: uvx nox -s build-emscripten | |
| - name: Test | |
| run: uvx nox -s test-emscripten | |
| - uses: actions/cache/save@v6 | |
| if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| with: | |
| path: | | |
| .nox/emscripten | |
| key: emscripten-${{ hashFiles('wasm/emscripten/*', 'wasm/common.mk') }}-${{ hashFiles('noxfile.py') }}-${{ env.UV_PYTHON }} | |
| wasm32-wasip1: | |
| name: wasm32-wasip1 | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| needs: [fmt] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| save-cache: ${{ needs.resolve.outputs.save-cache }} | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-wasip1 | |
| components: rust-src | |
| - name: "Install wasmtime" | |
| uses: bytecodealliance/actions/wasmtime/setup@v1 | |
| - name: "Install WASI SDK" | |
| uses: bytecodealliance/setup-wasi-sdk-action@main | |
| with: | |
| version: "24" | |
| # wasi sdk sets CC variables which break Python's configure script | |
| # (it also sets WASI_SDK_PATH even without `add-to-path`, which is sufficient) | |
| add-to-path: false | |
| - uses: actions/cache/restore@v6 | |
| id: cache | |
| with: | |
| path: | | |
| .nox/wasi | |
| key: wasi-${{ hashFiles('wasm/wasi/*', 'wasm/common.mk') }}-${{ hashFiles('noxfile.py') }}-${{ env.UV_PYTHON }} | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| - name: Build | |
| if: steps.cache.outputs.cache-hit != 'true' | |
| run: uvx nox -s build-wasm | |
| - name: Test | |
| run: uvx nox -s test-wasm | |
| - uses: actions/cache/save@v6 | |
| if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| with: | |
| path: | | |
| .nox/wasi | |
| key: wasi-${{ hashFiles('wasm/wasi/*', 'wasm/common.mk') }}-${{ hashFiles('noxfile.py') }}-${{ env.UV_PYTHON }} | |
| test-debug: | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| needs: [fmt] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rust-src | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| python-version: "3.13+debug" | |
| - run: uvx python -m sysconfig | |
| - run: uvx nox -s test | |
| test-debug-min-version: | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| needs: [fmt] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rust-src | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| python-version: "3.11+debug" | |
| - run: uvx python -m sysconfig | |
| - run: uvx nox -s test | |
| test-version-limits: | |
| needs: [fmt, resolve] | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| ref: ${{ needs.resolve.outputs.coverage-sha }} | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| save-cache: ${{ needs.resolve.outputs.save-cache }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| save-if: ${{ needs.resolve.outputs.save-cache }} | |
| - uses: ./.github/actions/prepare-coverage | |
| - run: uvx nox -s test-version-limits | |
| - uses: ./.github/actions/report-coverage | |
| with: | |
| name: ${{ github.job }} | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| check-feature-powerset: | |
| needs: [fmt, resolve] | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| runs-on: ubuntu-latest | |
| name: check-feature-powerset ${{ matrix.rust }} | |
| strategy: | |
| # run on stable and MSRV to check that all combinations of features are expected to build fine on our supported | |
| # range of compilers | |
| matrix: | |
| rust: ["stable"] | |
| include: | |
| - rust: ${{ needs.resolve.outputs.MSRV }} | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.15-dev" | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| - uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: stable | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-hack,cargo-minimal-versions | |
| - uses: astral-sh/setup-uv@v7 | |
| - run: uvx nox -s check-feature-powerset -- ${{ matrix.rust != 'stable' && 'minimal-versions' || '' }} | |
| test-cross-compilation: | |
| needs: [fmt, resolve] | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| runs-on: ${{ matrix.os }} | |
| name: test-cross-compilation ${{ matrix.os }} -> ${{ matrix.target }} | |
| strategy: | |
| # If one platform fails, allow the rest to keep testing if `CI-no-fail-fast` label is present | |
| fail-fast: ${{ !contains(github.event.pull_request.labels.*.name, 'CI-no-fail-fast') }} | |
| matrix: | |
| include: | |
| # ubuntu "cross compile" to itself | |
| - os: "ubuntu-latest" | |
| target: "x86_64-unknown-linux-gnu" | |
| flags: "-i python3.13" | |
| manylinux: auto | |
| # ubuntu x86_64 -> aarch64 | |
| - os: "ubuntu-latest" | |
| target: "aarch64-unknown-linux-gnu" | |
| flags: "-i python3.13" | |
| manylinux: auto | |
| # ubuntu x86_64 -> windows x86_64 | |
| - os: "ubuntu-latest" | |
| target: "x86_64-pc-windows-gnu" | |
| flags: "-i python3.13" | |
| apt-packages: mingw-w64 llvm | |
| # windows x86_64 -> aarch64 | |
| - os: "windows-latest" | |
| target: "aarch64-pc-windows-msvc" | |
| flags: "-i python3.13" | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| ref: ${{ needs.resolve.outputs.coverage-sha }} | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| save-cache: ${{ needs.resolve.outputs.save-cache }} | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: ${{ env.UV_PYTHON }} | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: examples/maturin-starter | |
| save-if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| key: ${{ matrix.target }} | |
| - name: Setup cross-compiler packages | |
| if: ${{ matrix.apt-packages }} | |
| run: sudo apt-get install -y ${{ matrix.apt-packages }} | |
| - uses: ./.github/actions/prepare-coverage | |
| with: | |
| host_only: true | |
| - name: Compile version-specific library | |
| uses: PyO3/maturin-action@v1 | |
| with: | |
| target: ${{ matrix.target }} | |
| args: --profile=dev -m examples/maturin-starter/Cargo.toml ${{ matrix.flags }} | |
| manylinux: ${{ matrix.manylinux }} | |
| docker-options: >- | |
| -e LLVM_PROFILE_FILE | |
| -e __CARGO_LLVM_COV_RUSTC_WRAPPER | |
| -e __CARGO_LLVM_COV_RUSTC_WRAPPER_RUSTFLAGS | |
| -e __CARGO_LLVM_COV_RUSTC_WRAPPER_CRATE_NAMES | |
| -v /home/runner/.cargo/bin/cargo-llvm-cov:/home/runner/.cargo/bin/cargo-llvm-cov | |
| - name: Compile abi3 library | |
| uses: PyO3/maturin-action@v1 | |
| with: | |
| target: ${{ matrix.target }} | |
| args: --profile=dev -m examples/maturin-starter/Cargo.toml --features abi3 ${{ matrix.flags }} | |
| manylinux: ${{ matrix.manylinux }} | |
| docker-options: >- | |
| -e LLVM_PROFILE_FILE | |
| -e __CARGO_LLVM_COV_RUSTC_WRAPPER | |
| -e __CARGO_LLVM_COV_RUSTC_WRAPPER_RUSTFLAGS | |
| -e __CARGO_LLVM_COV_RUSTC_WRAPPER_CRATE_NAMES | |
| -v /home/runner/.cargo/bin/cargo-llvm-cov:/home/runner/.cargo/bin/cargo-llvm-cov | |
| - uses: ./.github/actions/report-coverage | |
| with: | |
| name: ${{ github.job }}/${{ matrix.os }}/${{ matrix.target }} | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| test-cross-compilation-windows: | |
| needs: [fmt, resolve] | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| ref: ${{ needs.resolve.outputs.coverage-sha }} | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| save-cache: ${{ needs.resolve.outputs.save-cache }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: x86_64-pc-windows-gnu,x86_64-pc-windows-msvc | |
| components: rust-src | |
| # load cache (prepared in ci-cache-warmup.yml) | |
| - uses: actions/cache/restore@v6 | |
| with: | |
| path: ~/.cache/cargo-xwin | |
| key: cargo-xwin-cache | |
| - name: Setup cross-compiler | |
| run: sudo apt-get install -y mingw-w64 llvm | |
| - uses: ./.github/actions/prepare-coverage | |
| with: | |
| host_only: true | |
| - name: Test cross compile to Windows | |
| run: uvx nox -s test-cross-compilation-windows | |
| - uses: ./.github/actions/report-coverage | |
| with: | |
| name: ${{ github.job }} | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| test-introspection: | |
| needs: [fmt] | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-test-introspection') || contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }} | |
| strategy: | |
| matrix: | |
| platform: | |
| [ | |
| { | |
| os: "macos-latest", | |
| python-architecture: "arm64", | |
| rust-target: "aarch64-apple-darwin", | |
| }, | |
| { | |
| os: "ubuntu-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-unknown-linux-gnu", | |
| }, | |
| { | |
| os: "windows-latest", | |
| python-architecture: "x64", | |
| rust-target: "x86_64-pc-windows-msvc", | |
| }, | |
| { | |
| os: "windows-latest", | |
| python-architecture: "x86", | |
| rust-target: "i686-pc-windows-msvc", | |
| }, | |
| ] | |
| runs-on: ${{ matrix.platform.os }} | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.platform.rust-target }} | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.14" | |
| architecture: ${{ matrix.platform.python-architecture }} | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }} | |
| - uses: astral-sh/setup-uv@v7 | |
| - run: uvx nox -s test-introspection | |
| env: | |
| CARGO_BUILD_TARGET: ${{ matrix.platform.rust-target }} | |
| test-introspection-pr: | |
| needs: [fmt] | |
| if: ${{ !contains(github.event.pull_request.labels.*.name, 'CI-build-full') && github.event_name == 'pull_request' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.14" | |
| - uses: astral-sh/setup-uv@v7 | |
| - run: uvx nox -s test-introspection | |
| pytests-type-checking: | |
| needs: [fmt] | |
| runs-on: ubuntu-latest | |
| strategy: | |
| # If one platform fails, allow the rest to keep testing if `CI-no-fail-fast` label is present | |
| fail-fast: ${{ !contains(github.event.pull_request.labels.*.name, 'CI-no-fail-fast') }} | |
| matrix: | |
| checker: [mypy, pyrefly] | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rust-src | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.14" | |
| - uses: astral-sh/setup-uv@v7 | |
| - run: uvx nox -s ${{matrix.checker}} | |
| working-directory: pytests | |
| conclusion: | |
| needs: | |
| - fmt | |
| - check-msrv | |
| - clippy | |
| - check-nightly | |
| - build-pr | |
| - build-full | |
| - valgrind | |
| - careful | |
| - docsrs | |
| - emscripten | |
| - test-debug | |
| - test-version-limits | |
| - check-feature-powerset | |
| - test-cross-compilation | |
| - test-cross-compilation-windows | |
| - test-introspection | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Result | |
| run: | | |
| jq -C <<< "${needs}" | |
| # Check if all needs were successful or skipped. | |
| "$(jq -r 'all(.result as $result | (["success", "skipped"] | contains([$result])))' <<< "${needs}")" | |
| env: | |
| needs: ${{ toJson(needs) }} |