build(deps): bump gpui from fd82517 to e3adf43 (#80)
#180
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ["main"] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| rust: | |
| name: Rust and script checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| bubblewrap \ | |
| imagemagick \ | |
| libfontconfig1-dev \ | |
| libssl-dev \ | |
| libwayland-dev \ | |
| libx11-dev \ | |
| libxcb1-dev \ | |
| libxcb-icccm4-dev \ | |
| libxcb-image0-dev \ | |
| libxcb-keysyms1-dev \ | |
| libxcb-randr0-dev \ | |
| libxcb-render0-dev \ | |
| libxcb-shape0-dev \ | |
| libxcb-util-dev \ | |
| libxcb-xfixes0-dev \ | |
| libxcb-xinerama0-dev \ | |
| libxkbcommon-dev \ | |
| libxkbcommon-x11-dev \ | |
| openbox \ | |
| pkg-config \ | |
| x11-utils \ | |
| xauth \ | |
| xclip \ | |
| xdotool \ | |
| xvfb | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| with: | |
| components: clippy, rustfmt | |
| - name: Cache cargo | |
| uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 | |
| - name: Format | |
| run: cargo fmt --check | |
| - name: Build | |
| run: cargo build --locked | |
| - name: Installer smoke | |
| run: scripts/install_smoke.sh | |
| - name: Clippy | |
| run: cargo clippy --locked -- -D warnings | |
| - name: Test | |
| run: cargo test --locked | |
| - name: JavaScript syntax | |
| run: | | |
| for file in scripts/*.js scripts/lib/*.js; do | |
| node --check "$file" | |
| done | |
| - name: Whitespace | |
| run: git diff --check | |
| # Scan Cargo.lock (including gpui git deps) for known advisories. | |
| supply-chain: | |
| name: Supply chain (cargo audit) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| - name: Audit dependencies | |
| # The ignored advisories are "unmaintained"/"unsound" warnings (not | |
| # exploitable vulnerabilities) for transitive crates pulled in by the | |
| # gpui git dependency — not fixable from this crate until gpui upstream | |
| # bumps them: | |
| # RUSTSEC-2025-0052 async-std unmaintained | |
| # RUSTSEC-2024-0384 instant unmaintained | |
| # RUSTSEC-2024-0436 paste unmaintained | |
| # RUSTSEC-2026-0173 proc-macro-error2 unmaintained | |
| # RUSTSEC-2026-0186 memmap2 unsound (via gpui→fontdb/cosmic-text/xkbcommon) | |
| # RUSTSEC-2026-0192 ttf-parser unmaintained (via gpui→fontdb/cosmic-text) | |
| # RUSTSEC-2026-0194 quick-xml DoS in dup-attribute check — build-time | |
| # RUSTSEC-2026-0195 quick-xml DoS in NsReader namespace alloc — build-time | |
| # RUSTSEC-2026-0206 rustybuzz unmaintained (via gpui→fontdb/cosmic-text) | |
| # (quick-xml 0.30/0.39 reachable only through wayland-scanner / | |
| # gpui asset pipelines parsing vendored XML at build time, never | |
| # attacker input; unignore when upstream moves to quick-xml >= 0.41) | |
| # Everything else is still denied, so a real advisory fails CI. | |
| run: | | |
| cargo audit --deny warnings \ | |
| --ignore RUSTSEC-2025-0052 \ | |
| --ignore RUSTSEC-2024-0384 \ | |
| --ignore RUSTSEC-2024-0436 \ | |
| --ignore RUSTSEC-2026-0173 \ | |
| --ignore RUSTSEC-2026-0186 \ | |
| --ignore RUSTSEC-2026-0192 \ | |
| --ignore RUSTSEC-2026-0194 \ | |
| --ignore RUSTSEC-2026-0195 \ | |
| --ignore RUSTSEC-2026-0206 | |
| # Validate the shipped SKILL.md and any agent config via agnix. | |
| # Scoped to skills/ rather than the repo root so the linter only sees the | |
| # deliverable agent artifact and doesn't flag READMEs, build scripts, or src/. | |
| agent-config: | |
| name: Agent config (agnix) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "20" | |
| - name: Install agnix | |
| run: npm install -g agnix | |
| - name: Validate agent skill | |
| run: agnix skills/ | |
| # Verify npm wrapper syntax, version parity with Cargo, and pack integrity. | |
| # Does not download the release binary — no release exists yet. | |
| npm-wrapper: | |
| name: npm wrapper checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "20" | |
| - name: Syntax check postinstall.js | |
| run: node --check npm/scripts/postinstall.js | |
| - name: Test postinstall checksum verification | |
| run: node --test npm/scripts/postinstall.test.js | |
| - name: Syntax check agent-workspace-linux.js | |
| run: node --check npm/bin/agent-workspace-linux.js | |
| - name: Version parity (Cargo.toml == npm/package.json) | |
| run: | | |
| cargo_version="$(grep -m1 '^version = ' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')" | |
| npm_version="$(node -p "require('./npm/package.json').version")" | |
| echo "Cargo version : $cargo_version" | |
| echo "npm version : $npm_version" | |
| test "$cargo_version" = "$npm_version" | |
| - name: Pack dry-run | |
| run: cd npm && npm pack --dry-run |