ci: bump astral-sh/setup-uv from 5 to 7 #38

Workflow file for this run

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	workflow_dispatch:
	# Allow release.yml to run this exact suite as a gating `uses:` job before it
	# publishes anything.
	workflow_call:

	concurrency:
	# Include github.workflow so a direct CI run and the `uses:`-embedded CI job of
	# release.yml land in DISTINCT groups. Sharing one group would make the
	# tag-triggered release caller cancel an in-flight CI run (cancel-in-progress).
	# In a reusable workflow github.workflow resolves to the CALLER.
	group: ci-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	env:
	CARGO_TERM_COLOR: always
	RUST_BACKTRACE: 1

	jobs:
	build-test:
	name: fmt · clippy · unit + proptest
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Install Rust toolchain
	uses: dtolnay/rust-toolchain@stable
	with:
	components: rustfmt, clippy

	# Debug-profile cache (clippy + test); distinct from the release jobs.
	# Only write the cache from main: the repo cache is capped at 10 GB and
	# letting every PR branch save its own would evict main's via LRU.
	- uses: Swatinem/rust-cache@v2
	with:
	save-if: ${{ github.ref == 'refs/heads/main' }}

	- name: Format check
	run: cargo fmt --all -- --check

	- name: Clippy (deny warnings)
	run: cargo clippy --all-targets --all-features -- -D warnings

	- name: Unit tests + property-based round-trip fuzzing
	run: cargo test --workspace --all-features

	e2e:
	name: SQLLogic e2e (haybarn)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Install Rust toolchain
	uses: dtolnay/rust-toolchain@stable

	# Share one release-profile cache with metadata-quality (both build the
	# worker in release mode), so the dependency graph compiles once, not twice.
	- uses: Swatinem/rust-cache@v2
	with:
	shared-key: release
	save-if: ${{ github.ref == 'refs/heads/main' }}

	- name: Install uv
	uses: astral-sh/setup-uv@v7

	- name: Install the haybarn unittest runner
	# Only `haybarn-unittest` is installed as a tool; `haybarn-cli` (used to
	# install the vgi extension) is fetched on demand by `uvx` in run_tests.sh.
	run: \|
	uv tool install haybarn-unittest
	echo "$HOME/.local/bin" >> "$GITHUB_PATH"

	- name: Install the vgi community extension
	run: echo "INSTALL vgi FROM community;" \| uvx haybarn-cli

	- name: Run SQLLogic suite against the built worker
	run: ./run_tests.sh

	metadata-quality:
	name: metadata quality (vgi-lint)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Install Rust toolchain
	uses: dtolnay/rust-toolchain@stable

	# Same shared release cache as the e2e job (identical release-mode deps).
	- uses: Swatinem/rust-cache@v2
	with:
	shared-key: release
	save-if: ${{ github.ref == 'refs/heads/main' }}

	- name: Build worker (release)
	run: cargo build --release --bin fixedformat-worker

	- name: vgi-lint
	uses: Query-farm/vgi-lint-check@v1
	with:
	version: "0.37.0"
	location: "${{ github.workspace }}/target/release/fixedformat-worker"
	fail-on: info

	# Supply-chain advisory scan over the locked dependency tree (flate2, zstd,
	# object_store, arrow, vgi, …). Lightweight: no compile, just reads Cargo.lock
	# against the RustSec advisory DB, so a newly-published advisory fails CI even
	# without a code change. Kept as its own job so an advisory hit is obvious and
	# doesn't mask a build/test failure (or vice-versa).
	audit:
	name: supply-chain audit (cargo-audit)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: cargo audit
	uses: rustsec/audit-check@v2
	with:
	token: ${{ secrets.GITHUB_TOKEN }}

	# Verify the declared MSRV (rust-version = "1.90" in Cargo.toml) actually
	# builds. The other jobs only use `@stable`, so a stable-only feature that
	# silently raises the real minimum would otherwise slip through. `cargo check`
	# (not a full build/test) is enough to catch a toolchain-version regression.
	msrv:
	name: MSRV check (rust 1.90)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Install Rust toolchain (pinned MSRV)
	uses: dtolnay/rust-toolchain@1.90

	# Distinct cache key: 1.90 build artifacts are not interchangeable with the
	# stable debug/release caches the other jobs share.
	- uses: Swatinem/rust-cache@v2
	with:
	shared-key: msrv
	save-if: ${{ github.ref == 'refs/heads/main' }}

	- name: cargo check (workspace, all features)
	run: cargo check --workspace --all-features

	# Exercise the actual s3:// code path (object_store) against a real
	# S3-compatible endpoint by standing up a MinIO server and running the gated
	# round-trip test. The other e2e job leaves s3_roundtrip.test skipped because
	# its FIXEDFORMAT_S3_TEST_* env vars are unset; here we set them so the test's
	# `require-env` gate passes and the write_fixed -> read_fixed -> glob path runs
	# for real. The test self-seeds (write_fixed creates s3://fixed/ff_roundtrip.dat
	# then reads it back), so we only need the bucket to exist up front.
	cloud-e2e:
	name: cloud s3 e2e (MinIO)
	runs-on: ubuntu-latest
	env:
	# Wired to the MinIO container started below; consumed by
	# test/sql/s3_roundtrip.test via require-env + CREATE SECRET substitution.
	FIXEDFORMAT_S3_TEST_BUCKET: fixed
	FIXEDFORMAT_S3_TEST_ENDPOINT: localhost:9000
	FIXEDFORMAT_S3_TEST_KEY_ID: minioadmin
	FIXEDFORMAT_S3_TEST_SECRET: minioadmin
	steps:
	- uses: actions/checkout@v4

	- name: Install Rust toolchain
	uses: dtolnay/rust-toolchain@stable

	# Share the release-profile cache with e2e/metadata-quality (same deps).
	- uses: Swatinem/rust-cache@v2
	with:
	shared-key: release
	save-if: ${{ github.ref == 'refs/heads/main' }}

	# MinIO can't run as a `services:` container: its entrypoint needs the
	# `server /data` argument, which GitHub Actions service containers can't
	# supply. So run it directly with `docker run`.
	- name: Start MinIO
	run: \|
	docker run -d --name minio -p 9000:9000 \
	-e MINIO_ROOT_USER="$FIXEDFORMAT_S3_TEST_KEY_ID" \
	-e MINIO_ROOT_PASSWORD="$FIXEDFORMAT_S3_TEST_SECRET" \
	minio/minio server /data

	- name: Wait for MinIO to be ready
	run: \|
	for i in $(seq 1 30); do
	if curl -sf "http://$FIXEDFORMAT_S3_TEST_ENDPOINT/minio/health/live"; then
	echo "MinIO is up"; exit 0
	fi
	sleep 2
	done
	echo "MinIO did not become ready" >&2
	docker logs minio >&2 \|\| true
	exit 1

	- name: Create the test bucket
	# The s3_roundtrip test writes/reads its own object inside this bucket; we
	# only need the bucket itself to exist. aws-cli is preinstalled on the
	# ubuntu runner image.
	env:
	AWS_ACCESS_KEY_ID: ${{ env.FIXEDFORMAT_S3_TEST_KEY_ID }}
	AWS_SECRET_ACCESS_KEY: ${{ env.FIXEDFORMAT_S3_TEST_SECRET }}
	AWS_DEFAULT_REGION: us-east-1
	run: \|
	aws --endpoint-url "http://$FIXEDFORMAT_S3_TEST_ENDPOINT" \
	s3 mb "s3://$FIXEDFORMAT_S3_TEST_BUCKET"

	- name: Install uv
	uses: astral-sh/setup-uv@v7

	- name: Install the haybarn unittest runner
	run: \|
	uv tool install haybarn-unittest
	echo "$HOME/.local/bin" >> "$GITHUB_PATH"

	- name: Install the vgi + httpfs extensions
	# httpfs supplies DuckDB's `s3` secret type, which the test's
	# CREATE SECRET (and its `require httpfs` gate) depends on.
	run: \|
	echo "INSTALL vgi FROM community;" \| uvx haybarn-cli
	echo "INSTALL httpfs;" \| uvx haybarn-cli

	- name: Run the s3 round-trip test against MinIO
	run: ./run_tests.sh test/sql/s3_roundtrip.test

Navigation Menu

Uh oh!

ci: bump astral-sh/setup-uv from 5 to 7 #38

Workflow file

ci: bump astral-sh/setup-uv from 5 to 7 #38

Uh oh!

Workflow file for this run