|
| 1 | +# Reusable CI/CD Patterns for Code-Guardian |
| 2 | + |
| 3 | +This directory contains reusable GitHub Actions workflows, composite actions, and templates to standardize CI/CD processes across the project. |
| 4 | + |
| 5 | +## Structure |
| 6 | + |
| 7 | +``` |
| 8 | +.github/ |
| 9 | +├── actions/ # Composite actions |
| 10 | +│ ├── setup-rust/ # Rust toolchain setup |
| 11 | +│ ├── setup-cache/ # Cargo caching |
| 12 | +│ ├── run-clippy/ # Clippy linting |
| 13 | +│ ├── run-tests/ # Test execution |
| 14 | +│ ├── generate-coverage/ # Coverage reports |
| 15 | +│ ├── build-workspace/ # Workspace building |
| 16 | +│ └── run-security-scan/ # Security scanning |
| 17 | +├── workflows/ |
| 18 | +│ └── reusable/ # Reusable workflows |
| 19 | +│ ├── _quality-checks.yml |
| 20 | +│ ├── _test.yml |
| 21 | +│ └── _security-scan.yml |
| 22 | +├── workflow-templates/ # Workflow templates |
| 23 | +│ ├── basic-ci.yml |
| 24 | +│ └── comprehensive-ci.yml |
| 25 | +├── config/ # Shared configurations |
| 26 | +│ └── test-matrix.json |
| 27 | +└── README.md # This file |
| 28 | +``` |
| 29 | + |
| 30 | +## Composite Actions |
| 31 | + |
| 32 | +### setup-rust |
| 33 | +Sets up Rust toolchain with sccache and optional components. |
| 34 | + |
| 35 | +```yaml |
| 36 | +- uses: ./.github/actions/setup-rust |
| 37 | + with: |
| 38 | + toolchain: 'stable' # or 'beta', 'nightly', or specific version |
| 39 | + components: 'rustfmt,clippy' |
| 40 | + targets: 'x86_64-unknown-linux-gnu' |
| 41 | +``` |
| 42 | +
|
| 43 | +### setup-cache |
| 44 | +Configures caching for Cargo registry and target directories. |
| 45 | +
|
| 46 | +```yaml |
| 47 | +- uses: ./.github/actions/setup-cache |
| 48 | + with: |
| 49 | + cache-target: true |
| 50 | + cache-registry: true |
| 51 | + cache-key-suffix: 'optional-suffix' |
| 52 | +``` |
| 53 | +
|
| 54 | +### run-clippy |
| 55 | +Runs cargo clippy with configurable options. |
| 56 | +
|
| 57 | +```yaml |
| 58 | +- uses: ./.github/actions/run-clippy |
| 59 | + with: |
| 60 | + args: '--all-targets --all-features -- -D warnings' |
| 61 | + fix: false |
| 62 | + allow-dirty: false |
| 63 | +``` |
| 64 | +
|
| 65 | +### run-tests |
| 66 | +Runs cargo tests with nextest support. |
| 67 | +
|
| 68 | +```yaml |
| 69 | +- uses: ./.github/actions/run-tests |
| 70 | + with: |
| 71 | + package: 'code_guardian_core' # optional |
| 72 | + features: '--all-features' |
| 73 | + nextest: true |
| 74 | +``` |
| 75 | +
|
| 76 | +### generate-coverage |
| 77 | +Generates test coverage reports. |
| 78 | +
|
| 79 | +```yaml |
| 80 | +- uses: ./.github/actions/generate-coverage |
| 81 | + with: |
| 82 | + format: 'lcov' # or 'html', 'text' |
| 83 | + threshold: 82 |
| 84 | +``` |
| 85 | +
|
| 86 | +### build-workspace |
| 87 | +Builds the entire Cargo workspace. |
| 88 | +
|
| 89 | +```yaml |
| 90 | +- uses: ./.github/actions/build-workspace |
| 91 | + with: |
| 92 | + release: false |
| 93 | + features: '--all-features' |
| 94 | + targets: '--all-targets' |
| 95 | +``` |
| 96 | +
|
| 97 | +### run-security-scan |
| 98 | +Runs comprehensive security scanning. |
| 99 | +
|
| 100 | +```yaml |
| 101 | +- uses: ./.github/actions/run-security-scan |
| 102 | + with: |
| 103 | + audit: true |
| 104 | + deny: true |
| 105 | + gitleaks: true |
| 106 | + clippy-security: true |
| 107 | +``` |
| 108 | +
|
| 109 | +## Reusable Workflows |
| 110 | +
|
| 111 | +### _quality-checks.yml |
| 112 | +Runs formatting, clippy, and workspace checks. |
| 113 | +
|
| 114 | +```yaml |
| 115 | +jobs: |
| 116 | + quality: |
| 117 | + uses: ./.github/workflows/reusable/_quality-checks.yml |
| 118 | + with: |
| 119 | + auto-fix: false |
| 120 | + fail-on-warnings: true |
| 121 | +``` |
| 122 | +
|
| 123 | +### _test.yml |
| 124 | +Runs cross-platform testing with coverage. |
| 125 | +
|
| 126 | +```yaml |
| 127 | +jobs: |
| 128 | + test: |
| 129 | + uses: ./.github/workflows/reusable/_test.yml |
| 130 | + with: |
| 131 | + os: '["ubuntu-latest", "windows-latest", "macos-latest"]' |
| 132 | + rust-version: '["stable"]' |
| 133 | + coverage: true |
| 134 | + coverage-threshold: 82 |
| 135 | +``` |
| 136 | +
|
| 137 | +### _security-scan.yml |
| 138 | +Runs security scanning tools. |
| 139 | +
|
| 140 | +```yaml |
| 141 | +jobs: |
| 142 | + security: |
| 143 | + uses: ./.github/workflows/reusable/_security-scan.yml |
| 144 | + with: |
| 145 | + audit: true |
| 146 | + deny: true |
| 147 | + gitleaks: true |
| 148 | + clippy-security: true |
| 149 | +``` |
| 150 | +
|
| 151 | +## Workflow Templates |
| 152 | +
|
| 153 | +### Basic CI Template |
| 154 | +For simple projects needing basic quality checks and testing. |
| 155 | +
|
| 156 | +```yaml |
| 157 | +# Copy from .github/workflow-templates/basic-ci.yml |
| 158 | +name: Basic CI |
| 159 | +# ... rest of template |
| 160 | +``` |
| 161 | + |
| 162 | +### Comprehensive CI Template |
| 163 | +For production-ready projects with full CI/CD features. |
| 164 | + |
| 165 | +```yaml |
| 166 | +# Copy from .github/workflow-templates/comprehensive-ci.yml |
| 167 | +name: Comprehensive CI |
| 168 | +# ... rest of template |
| 169 | +``` |
| 170 | + |
| 171 | +## Shared Configurations |
| 172 | + |
| 173 | +### test-matrix.json |
| 174 | +Contains predefined test matrices for different scenarios. |
| 175 | + |
| 176 | +```json |
| 177 | +{ |
| 178 | + "os": ["ubuntu-latest", "windows-latest", "macos-latest"], |
| 179 | + "rust": ["stable"], |
| 180 | + "include": [ |
| 181 | + { |
| 182 | + "os": "ubuntu-latest", |
| 183 | + "rust": "beta" |
| 184 | + } |
| 185 | + ] |
| 186 | +} |
| 187 | +``` |
| 188 | + |
| 189 | +## Usage Examples |
| 190 | + |
| 191 | +### Simple CI Pipeline |
| 192 | +```yaml |
| 193 | +name: CI |
| 194 | +on: [push, pull_request] |
| 195 | + |
| 196 | +jobs: |
| 197 | + quality: |
| 198 | + uses: ./.github/workflows/reusable/_quality-checks.yml |
| 199 | + |
| 200 | + test: |
| 201 | + uses: ./.github/workflows/reusable/_test.yml |
| 202 | + with: |
| 203 | + os: '["ubuntu-latest"]' |
| 204 | + coverage: true |
| 205 | +``` |
| 206 | +
|
| 207 | +### Advanced CI Pipeline |
| 208 | +```yaml |
| 209 | +name: Advanced CI |
| 210 | +on: [push, pull_request] |
| 211 | + |
| 212 | +jobs: |
| 213 | + changes: |
| 214 | + # Change detection logic |
| 215 | + outputs: |
| 216 | + src: ${{ steps.filter.outputs.src }} |
| 217 | + |
| 218 | + quality: |
| 219 | + uses: ./.github/workflows/reusable/_quality-checks.yml |
| 220 | + with: |
| 221 | + auto-fix: ${{ github.ref == 'refs/heads/main' }} |
| 222 | + |
| 223 | + test: |
| 224 | + uses: ./.github/workflows/reusable/_test.yml |
| 225 | + needs: [changes, quality] |
| 226 | + if: needs.changes.outputs.src == 'true' |
| 227 | + |
| 228 | + security: |
| 229 | + uses: ./.github/workflows/reusable/_security-scan.yml |
| 230 | + needs: changes |
| 231 | + if: needs.changes.outputs.src == 'true' |
| 232 | +``` |
| 233 | +
|
| 234 | +## Best Practices |
| 235 | +
|
| 236 | +1. **Use reusable workflows** for common patterns to reduce duplication |
| 237 | +2. **Leverage composite actions** for repeated setup steps |
| 238 | +3. **Configure caching** to improve build times |
| 239 | +4. **Use change detection** to skip unnecessary jobs |
| 240 | +5. **Implement auto-fixing** only on protected branches |
| 241 | +6. **Set appropriate permissions** with least privilege |
| 242 | +7. **Use concurrency controls** to prevent overlapping runs |
| 243 | +
|
| 244 | +## Maintenance |
| 245 | +
|
| 246 | +- Keep actions and workflows updated with latest best practices |
| 247 | +- Test changes in a separate branch before merging |
| 248 | +- Document any breaking changes |
| 249 | +- Review and update shared configurations regularly |
0 commit comments