Skip to content

Commit 3b73063

Browse files
AbeeujahAbeeujah
committed
Configure GitHub Actions CI
- Add GitHub Actions workflows for audit, code coverage, and continuous integration - Add dependabot for automated dependency updates - Add zizmor security configuration - Add CI helper scripts for MSRV pinning and core node startup - Add justfile for task automation - Add pull request template
1 parent d384cf2 commit 3b73063

10 files changed

Lines changed: 372 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Set update schedule for GitHub Actions
2+
version: 2
3+
updates:
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"

‎.github/pull_request_template.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<!-- You can erase any parts of this template not applicable to your Pull Request. -->
2+
3+
### Description
4+
5+
<!-- Describe the purpose of this PR, what's being adding and/or fixed -->
6+
7+
### Notes to the reviewers
8+
9+
<!-- In this section you can include notes directed to the reviewers, like explaining why some parts
10+
of the PR were done in a specific way -->
11+
12+
### Changelog notice
13+
14+
<!-- Notice the release manager should include in the release tag message changelog -->
15+
<!-- See https://keepachangelog.com/en/1.0.0/ for examples -->
16+
17+
### Checklists
18+
19+
#### All Submissions:
20+
21+
* [ ] I've signed all my commits
22+
* [ ] I followed the [contribution guidelines](https://github.com/bitcoindevkit/bdk/blob/master/CONTRIBUTING.md)
23+
* [ ] I ran `just p` before pushing
24+
25+
#### New Features:
26+
27+
* [ ] I've added tests for the new feature
28+
* [ ] I've added docs for the new feature
29+
30+
#### Bugfixes:
31+
32+
* [ ] This pull request breaks the existing API
33+
* [ ] I've added tests to reproduce the issue which are now passing
34+
* [ ] I'm linking the issue being fixed by this PR

‎.github/workflows/audit.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Audit
2+
3+
# Performs a security audit of Rust dependencies using cargo-audit through the actions-rust-lang/audit action.
4+
# Runs nightly on schedule and when Cargo.toml, Cargo.lock, or audit.toml files are modified.
5+
# Helps identify known security vulnerabilities in the dependency tree.
6+
7+
on:
8+
push:
9+
paths:
10+
# Run if workflow changes
11+
- ".github/workflows/audit.yml"
12+
# Run on changed dependencies
13+
- "**/Cargo.toml"
14+
- "**/Cargo.lock"
15+
# Run if the configuration file changes
16+
- "**/audit.toml"
17+
# Rerun periodically
18+
schedule:
19+
- cron: "0 0 * * *" # Nightly
20+
# Run manually
21+
workflow_dispatch:
22+
23+
jobs:
24+
audit:
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: read
28+
issues: write
29+
steps:
30+
- name: Checkout
31+
uses: actions/checkout@v6
32+
with:
33+
persist-credentials: false
34+
- uses: actions-rust-lang/audit@v1
35+
name: Audit Rust Dependencies

‎.github/workflows/code_coverage.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: Code Coverage
2+
3+
# Generates code coverage reports using cargo-llvm-cov and uploads results to Codecov.
4+
# Runs on every push and pull request to track test coverage metrics.
5+
# Uploads coverage reports to Codecov for visualization and analysis.
6+
7+
on: [push, pull_request]
8+
9+
permissions:
10+
contents: read
11+
pull-requests: write
12+
13+
jobs:
14+
coverage:
15+
name: Code Coverage
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v6
21+
with:
22+
persist-credentials: false
23+
- name: Install Rust toolchain
24+
uses: actions-rust-lang/setup-rust-toolchain@v1
25+
with:
26+
toolchain: nightly
27+
components: llvm-tools-preview
28+
cache: true
29+
- name: Install cargo-llvm-cov
30+
run: cargo install cargo-llvm-cov
31+
- name: Generate coverage data
32+
run: cargo llvm-cov --all-features --branch --quiet --ignore-filename-regex "test_utils" --lcov --output-path lcov.info
33+
env:
34+
RUSTFLAGS: "--cfg coverage_nightly"
35+
- name: Generate HTML coverage report
36+
run: cargo llvm-cov --all-features --branch --quiet --ignore-filename-regex "test_utils" --html
37+
env:
38+
RUSTFLAGS: "--cfg coverage_nightly"
39+
- name: Codecov upload
40+
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de
41+
with:
42+
files: ./lcov.info
43+
flags: rust
44+
name: codecov-bdk-electrum-streaming-client
45+
token: ${{ secrets.CODECOV_TOKEN }}
46+
fail_ci_if_error: false
47+
- name: Upload artifact
48+
uses: actions/upload-artifact@v4
49+
with:
50+
name: coverage-report
51+
path: target/llvm-cov/html

‎.github/workflows/cont_integration.yml‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
on: [push, pull_request]
2+
3+
# Main continuous integration workflow that runs build, test, and code quality checks.
4+
# Runs on every push and pull request, testing against both MSRV (1.85) and stable Rust.
5+
# # Includes no_std and WASM compatibility checks, formatting validation, and clippy linting.
6+
7+
name: CI
8+
9+
permissions: {}
10+
11+
env:
12+
CARGO_TERM_COLOR: always
13+
14+
jobs:
15+
build-test-msrv:
16+
name: Build & Test MSRV
17+
runs-on: ${{ matrix.os }}
18+
strategy:
19+
matrix:
20+
os:
21+
- ubuntu-latest
22+
- ubuntu-24.04-arm
23+
features:
24+
- --no-default-features --features tokio
25+
- --all-features
26+
steps:
27+
- name: Checkout
28+
uses: actions/checkout@v6
29+
with:
30+
persist-credentials: false
31+
# The 'toolchain' argument on this action overrides the Rust compiler version set in rust-toolchain.toml
32+
# in order to test our MSRV.
33+
- name: Install Rust toolchain
34+
uses: actions-rust-lang/setup-rust-toolchain@v1
35+
with:
36+
toolchain: 1.85 # MSRV
37+
cache: true
38+
- name: Pin dependencies for MSRV
39+
run: ./ci/pin-msrv.sh
40+
- name: Build + Test
41+
run: |
42+
cargo build --workspace --all-targets ${{ matrix.features }}
43+
cargo test --workspace ${{ matrix.features }}
44+
45+
build-test-stable:
46+
name: Build & Test Rust Stable
47+
runs-on: ${{ matrix.os }}
48+
strategy:
49+
matrix:
50+
os:
51+
- ubuntu-latest
52+
- ubuntu-24.04-arm
53+
features:
54+
- --no-default-features --features tokio
55+
- --all-features
56+
steps:
57+
- name: Checkout
58+
uses: actions/checkout@v6
59+
with:
60+
persist-credentials: false
61+
- name: Install Rust toolchain
62+
uses: actions-rust-lang/setup-rust-toolchain@v1
63+
with:
64+
cache: true
65+
- name: Build + Test
66+
run: |
67+
cargo build --workspace --all-targets ${{ matrix.features }}
68+
cargo test --workspace ${{ matrix.features }}
69+
70+
check-no-std:
71+
name: Check no_std
72+
runs-on: ubuntu-latest
73+
steps:
74+
- name: Checkout
75+
uses: actions/checkout@v6
76+
with:
77+
persist-credentials: false
78+
- name: Install Rust toolchain
79+
uses: actions-rust-lang/setup-rust-toolchain@v1
80+
with:
81+
cache: true
82+
- name: Check no-std
83+
run: cargo check --workspace --all-targets --no-default-features --features tokio
84+
85+
check-wasm:
86+
name: Check WASM
87+
runs-on: ubuntu-latest
88+
env:
89+
CC: clang-14
90+
CFLAGS: -I/usr/include
91+
steps:
92+
- name: Checkout
93+
uses: actions/checkout@v6
94+
with:
95+
persist-credentials: false
96+
- run: wget -qO - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add - || exit 1
97+
- run: sudo apt-get update || true
98+
- run: sudo apt-get install -y libclang-common-14-dev clang-14 libc6-dev-i386 || exit 1
99+
- name: Install Rust toolchain
100+
uses: actions-rust-lang/setup-rust-toolchain@v1
101+
with:
102+
cache: true
103+
target: wasm32-unknown-unknown
104+
- name: Check-WASM
105+
run: |
106+
rustup target add wasm32-unknown-unknown
107+
cargo check --workspace --no-default-features --target wasm32-unknown-unknown
108+
109+
fmt:
110+
name: Rust fmt
111+
runs-on: ubuntu-latest
112+
steps:
113+
- name: Checkout
114+
uses: actions/checkout@v6
115+
with:
116+
persist-credentials: false
117+
- name: Install Rust toolchain
118+
uses: actions-rust-lang/setup-rust-toolchain@v1
119+
with:
120+
cache: true
121+
- name: Check fmt
122+
run: cargo fmt --all -- --check
123+
124+
clippy_check:
125+
name: Rust Clippy
126+
runs-on: ubuntu-latest
127+
permissions:
128+
checks: write
129+
steps:
130+
- name: Checkout
131+
uses: actions/checkout@v6
132+
with:
133+
persist-credentials: false
134+
- name: Install Rust toolchain
135+
uses: actions-rust-lang/setup-rust-toolchain@v1
136+
with:
137+
cache: true
138+
- name: Check Clippy
139+
run: cargo clippy --workspace --all-targets -- -D warnings

‎.github/workflows/zizmor.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Zizmor Actions Analysis
2+
3+
# Analyzes Github Actions workflows for security vulnerabilities using zizmor.
4+
# Runs on pushes to master and all pull requests to detect potential security issues
5+
# in workflow configurations. Results are uploaded as a GitHub's security dashboard.
6+
# The .github/zizmor.yml configures the rules this action will check against.
7+
8+
on:
9+
push:
10+
branches: ["master"]
11+
pull_request:
12+
branches: ["master"]
13+
14+
jobs:
15+
zizmor:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
security-events: write
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@v6
22+
with:
23+
persist-credentials: false
24+
25+
- name: Rust Cache
26+
uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5
27+
28+
- name: Install zizmor
29+
run: cargo install zizmor --locked --version 1.6.0
30+
31+
- name: Run zizmor 🌈
32+
run: zizmor --format sarif . > results.sarif
33+
env:
34+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
35+
36+
- name: Upload SARIF file
37+
uses: github/codeql-action/upload-sarif@v4
38+
with:
39+
sarif_file: results.sarif
40+
category: zizmor

‎.github/zizmor.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
rules:
2+
unpinned-uses:
3+
config:
4+
policies:
5+
actions-rust-lang/setup-rust-toolchain: ref-pin
6+
github/codeql-action/*: ref-pin
7+
actions/*: ref-pin

‎ci/pin-msrv.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
3+
set -x
4+
set -euo pipefail
5+
6+
# Pin dependencies for MSRV
7+
8+
# To pin deps, switch toolchain to MSRV and execute the below updates
9+
10+
# cargo clean
11+
# rustup override set 1.85.0
12+
13+
# e.g cargo update -p home --precise "0.5.11"

‎ci/start-core.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/usr/bin/env sh
2+
3+
echo "Starting bitcoin node."
4+
mkdir $GITHUB_WORKSPACE/.bitcoin
5+
/root/bitcoind -regtest -server -daemon -datadir=$GITHUB_WORKSPACE/.bitcoin -fallbackfee=0.0002 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0 -blockfilterindex=1 -peerblockfilters=1
6+
7+
echo "Waiting for bitcoin node."
8+
until /root/bitcoin-cli -regtest -datadir=$GITHUB_WORKSPACE/.bitcoin getblockchaininfo; do
9+
sleep 1
10+
done
11+
/root/bitcoin-cli -regtest -datadir=$GITHUB_WORKSPACE/.bitcoin createwallet $BDK_RPC_WALLET
12+
echo "Generating 150 bitcoin blocks."
13+
ADDR=$(/root/bitcoin-cli -regtest -datadir=$GITHUB_WORKSPACE/.bitcoin -rpcwallet=$BDK_RPC_WALLET getnewaddress)
14+
/root/bitcoin-cli -regtest -datadir=$GITHUB_WORKSPACE/.bitcoin generatetoaddress 150 $ADDR

‎justfile‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
alias b := build
2+
alias c := check
3+
alias f := fmt
4+
alias t := test
5+
alias p := pre-push
6+
7+
_default:
8+
@just --list
9+
10+
# Build the project
11+
build:
12+
cargo build
13+
14+
# Check code: formatting, compilation, linting, and commit signature
15+
check:
16+
cargo +nightly fmt --all -- --check
17+
cargo check --all-features --all-targets
18+
cargo clippy --all-features --all-targets -- -D warnings
19+
@[ "$(git log --pretty='format:%G?' -1 HEAD)" = "N" ] && \
20+
echo "\n⚠️ Unsigned commit: BDK requires that commits be signed." || \
21+
true
22+
23+
# Format all code
24+
fmt:
25+
cargo +nightly fmt
26+
27+
# Run all tests on the workspace with all features
28+
test:
29+
cargo test --all-features
30+
31+
# Run pre-push suite: format, check, and test
32+
pre-push: fmt check test

0 commit comments

Comments
 (0)