ci: reorganize workflows, drop NPM_TOKEN, bump actions - #255
andrii-bodnar wants to merge 3 commits into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #255 +/- ##
=======================================
Coverage 94.35% 94.35%
=======================================
Files 11 11
Lines 2498 2498
=======================================
Hits 2357 2357
Misses 141 141
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
| # Toolchain and the wasm32-wasip1 target come from rust-toolchain.toml. | ||
| - uses: actions-rust-lang/setup-rust-toolchain@v2 | ||
| with: | ||
| target: 'wasm32-wasip1' |
There was a problem hiding this comment.
Most likely it will not work without an explicit target. And you will not be able to set one target for all, because native-tools uses multiple targets.
There was a problem hiding this comment.
i checked the rust-toolchain file and 'wasm32-wasip1' is actually the only one target specified here, which is kinda weird, because project build not only for this target. This is a leftover from the time when swc macro was the only thing here.
I suggest removing one target from the rust-toolchain file, and pass target explicitly at build step for consistency.
There was a problem hiding this comment.
It actually works without it - setup-rust-toolchain picks up targets from rust-toolchain.toml, and the E2E job built the wasm fine that way. I'd keep the target in the toml since it makes cargo build-wasi work on a fresh clone without rustup target add. But agreed it reads better explicit, so I added target: wasm32-wasip1 back to both wasm jobs
There was a problem hiding this comment.
🟡 Changes recommended
Workspace testing excludes one crate, and immutable Yarn installation is not applied consistently.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Reorganizes CI, modernizes GitHub Actions, and adopts OIDC-based npm publishing.
Changes:
- Adds workspace-wide Rust CI and separates macro/native checks.
- Upgrades Actions and caching.
- Adds Dependabot and least-privilege permissions.
File summaries
| File | Description |
|---|---|
README.md |
Adds Rust CI badge. |
.github/workflows/release.yml |
Modernizes release tooling. |
.github/workflows/ci-rust.yml |
Adds Rust checks and coverage. |
.github/workflows/ci-native-tools.yml |
Reworks native builds, tests, and publishing. |
.github/workflows/ci-macro.yml |
Retains the WASM smoke test. |
.github/dependabot.yml |
Adds grouped Actions updates. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 2
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Add ci-rust.yml running fmt, clippy and tests for the whole workspace; ci-macro.yml keeps only the WASM E2E smoke test and ci-native-tools.yml lint keeps only oxlint plus a tsc typecheck. - Publish @lingui/native-tools via npm trusted publishing (OIDC), same as release.yml already does for @lingui/swc-plugin. NPM_TOKEN is no longer read anywhere. - Use actions-rust-lang/setup-rust-toolchain@v2 everywhere so every job honours rust-toolchain.toml (native builds previously forced `stable`), and use its rust-cache instead of a static-key actions/cache. - Bump checkout v7, setup-node v7, cache v6, upload-artifact v7, download-artifact v8, github-script v9, codecov-action v7. - Least-privilege `permissions: contents: read` on every workflow; `yarn install --immutable` everywhere; concurrency groups on all CI. - Add dependabot for GitHub Actions (monthly, grouped). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
setup-rust-toolchain v2 sets build.warnings=deny by default. The napi cross linkers print "ignoring deprecated linker optimization setting", which rustc surfaces through the linker_messages lint and cargo then treats as a failed build. Real warnings are already denied by clippy in ci-rust.yml, so the native build matrix, the E2E job and the release job now use build-warnings: warn. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- Pass `target: wasm32-wasip1` explicitly in the two WASM build jobs so they are self-describing (rust-toolchain.toml still lists it for local development). - Yarn 4 defaults to immutable installs when CI is set, which GitHub runners do, so drop the explicit flag there. Keep it only inside the docker container used by the Linux binding tests, where CI is not set. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
663d9cd to
f3e9988
Compare
ci-rust.ymlrunningfmt,clippyand tests for the whole workspace;ci-macro.ymlkeeps only the WASM E2E smoke test andci-native-tools.ymllint keeps only oxlint plus a tsc typecheck.@lingui/native-toolsvia npm trusted publishing (OIDC), same asrelease.ymlalready does for@lingui/swc-plugin.NPM_TOKENis no longer read anywhere.actions-rust-lang/setup-rust-toolchain@v2everywhere so every job honoursrust-toolchain.toml(native builds previously forcedstable), and use its rust-cache instead of a static-key actions/cache.permissions: contents: readon every workflow; concurrency groups on all CI.