Skip to content

Bootstrap CI: test matrix and AI code review workflows #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erubboli merged 2 commits into from
Sep 17, 2026
+145 −0
Merged

Bootstrap CI: test matrix and AI code review workflows #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
946091d
ci: add test matrix and AI code review workflows
nullPointerEnjoyer Sep 17, 2026
9c715df
ci: path filters, permissions, timeouts, pinned toolchains, caching (…
nullPointerEnjoyer Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
109 changes: 109 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,109 @@
name: CI

on:
push:
branches: [main]
paths-ignore: [".github/**"]

@github-actions github-actions Bot Sep 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security · medium
paths-ignore: [".github/**"] on both push and pull_request excludes the workflow's own file, so changes to ci.yml (or other CI configuration) will never trigger CI. A broken or misconfigured workflow would go unnoticed until an unrelated code change happens. Consider removing .github/** from the ignore list, or at least keeping ci.yml itself in scope.

@nullPointerEnjoyer nullPointerEnjoyer Sep 17, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Acknowledged tradeoff: workflow-only PRs would previously have failed all 18 crate jobs with "could not find Cargo.toml" (there is no crate on the bootstrap branch this PR touches). The workflows themselves are exercised on every code-touching PR, and a broken ci.yml surfaces on the next code change. If we want workflow-only changes validated too, the options are a dorny/paths-filter job-level setup or accepting a full 3-platform matrix run on CI-only PRs — happy to switch if preferred.

pull_request:
branches: [main]
paths-ignore: [".github/**"]

# The crate jobs never need more than read access.
permissions:
contents: read

env:
CARGO_TERM_COLOR: always
Comment on lines +7 to +16

@github-actions github-actions Bot Sep 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

performance · medium
There is no dependency caching (no actions/cache or Swatinem/rust-cache) and no concurrency group. Every push/PR triggers six parallel jobs each doing a full cold cargo build of the dependency graph, and multiple runs for the same PR are not cancelled. Adding rust-cache and a concurrency group would significantly cut runner minutes.

Suggestion:

Suggested change
pull_request:
branches: [main]
env:
CARGO_TERM_COLOR: always
pull_request:
branches: [main]
concurrency:
group: ci-${{ github.event.pull_request.number || github.sha }}
cancel-in-progress: true
env:
CARGO_TERM_COLOR: always


jobs:
Comment on lines +15 to +18

@github-actions github-actions Bot Sep 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security · medium
This workflow defines six jobs but has no top-level permissions: block, so every job runs with the default (potentially broad) GITHUB_TOKEN permissions. All these jobs only need to check out code and run cargo; contents: read is sufficient. Add a least-privilege permissions block.

Suggestion:

Suggested change
env:
CARGO_TERM_COLOR: always
jobs:
env:
CARGO_TERM_COLOR: always
permissions:
contents: read
jobs:

fmt:
name: Format
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
Comment on lines +19 to +23

@github-actions github-actions Bot Sep 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maintainability · medium
None of the six jobs set timeout-minutes, so a hung cargo build or a blocking test (e.g., on windows-latest) can consume runner time indefinitely. The companion code-review.yml sets 40 minutes; apply a similar job-level timeout here (GitHub's default 360 minutes is far too long for CI).

Suggestion:

Suggested change
fmt:
name: Format
runs-on: ubuntu-latest
steps:
fmt:
name: Format
runs-on: ubuntu-latest
timeout-minutes: 30
steps:

- uses: actions/checkout@v4
# Pinned to the MSRV so rustfmt matches the version clippy/test use.
- uses: dtolnay/rust-toolchain@ffaa7fb73f2b6e3c49bc425913220fa3d71c3ee5 # 1.92.0
with:
components: rustfmt
- run: cargo fmt --all --check

clippy:
name: Clippy (${{ matrix.features }})
runs-on: ubuntu-latest
timeout-minutes: 45
strategy:
fail-fast: false
matrix:
features: ["--no-default-features", "--no-default-features --features node", "--no-default-features --features indexer", "--no-default-features --features wallet", "--no-default-features --features crypto", "--all-features"]
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@ffaa7fb73f2b6e3c49bc425913220fa3d71c3ee5 # 1.92.0
with:
components: clippy
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
with:
key: ${{ matrix.features }}
- run: cargo clippy ${{ matrix.features }} --all-targets --locked -- -D warnings

test:
name: Test (${{ matrix.features }})
runs-on: ubuntu-latest
timeout-minutes: 45
strategy:
fail-fast: false
matrix:
features: ["--no-default-features", "--no-default-features --features node", "--no-default-features --features indexer", "--no-default-features --features wallet", "--no-default-features --features crypto", "--all-features"]
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@ffaa7fb73f2b6e3c49bc425913220fa3d71c3ee5 # 1.92.0
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
with:
key: ${{ matrix.features }}
- run: cargo test ${{ matrix.features }} --locked

# Cross-platform test gate, mirroring mintlayer-core's build.yml: the full
# suite runs on every supported OS with the lockfile held fixed.
platform-tests:
name: Test (${{ matrix.os }})
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
runs-on: ${{ matrix.os }}
timeout-minutes: 60
steps:
- name: Shorten CARGO_HOME on Windows
if: runner.os == 'Windows'
shell: bash
# The default path blows past the Windows MAX_PATH limit inside the
# mintlayer-core git checkouts (same reason mintlayer-core's own
# build.yml does this).
run: echo "CARGO_HOME=C:\crg" >> "$GITHUB_ENV"

@github-actions github-actions Bot Sep 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bug · medium
The Windows step sets CARGO_HOME=C:\crg before Swatinem/rust-cache runs. rust-cache by default caches the cargo home and target directories based on the effective environment, so an override here changes cache paths; also this custom CARGO_HOME persists into the cargo build/test steps. Verify rust-cache handles the overridden CARGO_HOME (or pass explicit workspaces/cache-directories inputs) so Windows legs don't silently skip caching and rebuild from scratch every run.

@nullPointerEnjoyer nullPointerEnjoyer Sep 17, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Intentional: the override is set for all subsequent steps precisely so that rust-cache and cargo resolve the same short CARGO_HOME on Windows (registry/target under C:\crg), keeping the cache path consistent across runs. rust-cache v2 derives the cargo home from the effective environment, so caching is active — just relocated. If we ever see silent cache misses on the Windows leg we can pin cache-directories explicitly.

- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@ffaa7fb73f2b6e3c49bc425913220fa3d71c3ee5 # 1.92.0
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
with:
key: ${{ matrix.os }}
- run: cargo build --all-features --locked --examples
- run: cargo test --all-features --locked

doc:
name: Documentation
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@ffaa7fb73f2b6e3c49bc425913220fa3d71c3ee5 # 1.92.0
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
- run: cargo doc --all-features --locked --no-deps
env:
RUSTDOCFLAGS: -D warnings

license:
name: License headers
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v4
- run: ./scripts/check-license.sh

@github-actions github-actions Bot Sep 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bug · high
The license job runs ./scripts/check-license.sh, but no scripts/ directory or check-license.sh file exists in the repository. This job will always fail with an unclear runner error. Either commit the script (with the executable bit set) in this change, or remove the job until the script lands.

Suggestion:

Suggested change
- run: ./scripts/check-license.sh
- name: Check license headers
shell: bash
run: |
test -x ./scripts/check-license.sh || { echo "scripts/check-license.sh missing or not executable"; exit 1; }
./scripts/check-license.sh

36 changes: 36 additions & 0 deletions .github/workflows/code-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
name: AI Code Review

on:
pull_request:
types: [opened, synchronize, reopened]

permissions:
contents: read
pull-requests: write

concurrency:
group: ocr-${{ github.event.pull_request.number }}
cancel-in-progress: true

jobs:
review:
# Fork PRs cannot read secrets; skip them cleanly.
if: github.event.pull_request.head.repo.fork == false
runs-on: ubuntu-latest
timeout-minutes: 40
steps:
- uses: alibaba/open-code-review@494bf1c8d7a19196ab166960a06fef38d69a1d16 # v1.12.0
with:
llm_url: https://api.z.ai/api/coding/paas/v4
llm_auth_token: ${{ secrets.OCR_LLM_TOKEN }}
llm_model: glm-5.3-flash
llm_use_anthropic: false
# GLM-5.3 family rejects thinking.type=disabled, which is the
# action's default extra_body — this override is required.
llm_extra_body: '{"thinking": {"type": "enabled"}}'
llm_reasoning_effort: low
incremental: 'true'
route_severity_below: 'low'
max_tokens_budget: '500000'
review_task_timeout: '15'
stream_progress: 'true'
Loading