Bring the lint in (uhhm/iris main, history kept)

git-subtree-dir: vendor/lint git-subtree-mainline: bedd306854 git-subtree-split: e3c68f9441
2026-09-30 15:23:16 +02:00
parent bedd306854 e3c68f9441
commit d0d1cbf23d
12 changed files with 7801 additions and 0 deletions
@@ -0,0 +1,46 @@
+name: Publish release
+
+# A `v*` tag builds the binary and attaches it to the Gitea release as
+# `iris`, with the tag's CHANGELOG.md section as the notes. Content
+# repos pin IRIS_RELEASE to one of these tags in their lint workflow.
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    runs-on: bare
+    env:
+      # Writable, unlike the shared /var/local/cargo - see test.yml.
+      CARGO_HOME: /var/local/cargo-target/iris-cargo-home
+      RUSTC_WRAPPER: /usr/bin/sccache
+      RUSTUP_HOME: /var/local/rustup
+      PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
+      SCCACHE_DIR: /var/local/sccache
+      SCCACHE_SERVER_PORT: "4228"
+      CARGO_TARGET_DIR: /var/local/cargo-target
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build
+        run: cargo build --release
+
+      - name: Publish release
+        run: |
+          set -euo pipefail
+          tag="${{ github.ref_name }}"
+          api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
+          auth="Authorization: token ${{ secrets.GITHUB_TOKEN }}"
+          notes=$(awk -v v="${tag#v}" '/^## /{p = ($2 == v)} p' CHANGELOG.md | tail -n +2)
+          body=$(jq -n --arg tag "$tag" --arg notes "$notes" '{tag_name: $tag, name: $tag, body: $notes}')
+          id=$(curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' \
+            -d "$body" "$api/releases" | jq .id) \
+            || id=$(curl -sf -H "$auth" "$api/releases/tags/$tag" | jq .id)
+          for aid in $(curl -sf -H "$auth" "$api/releases/$id/assets" | jq '.[].id'); do
+            curl -sf -X DELETE -H "$auth" "$api/releases/$id/assets/$aid"
+          done
+          curl -sf -X POST -H "$auth" \
+            -F "attachment=@/var/local/cargo-target/release/iris" \
+            "$api/releases/$id/assets?name=iris" > /dev/null
+          echo "published $tag"
@@ -0,0 +1,37 @@
+name: Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: bare
+    env:
+      # Same shared toolchain and cache as uhhm/portal's workflows.
+      # Not the shared /var/local/cargo: the runner may only read it, and
+      # the portal git dependency has to be cloned into CARGO_HOME. This
+      # one lives under the writable target dir; the rustc wrapper the
+      # shared config would have set is given here instead.
+      CARGO_HOME: /var/local/cargo-target/iris-cargo-home
+      RUSTC_WRAPPER: /usr/bin/sccache
+      RUSTUP_HOME: /var/local/rustup
+      PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
+      SCCACHE_DIR: /var/local/sccache
+      SCCACHE_SERVER_PORT: "4228"
+      CARGO_TARGET_DIR: /var/local/cargo-target
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Test
+        run: cargo test
+
+      # The one thing a lint must never do is reject the content it
+      # is meant to serve: every live content repo has to pass.
+      - name: Check the live content repos
+        run: |
+          cargo build --release
+          for repo in uhhm/questions redoal/questions; do
+            /var/local/cargo-target/release/iris check --repo "${{ github.server_url }}/$repo"
+          done