.github/workflows/ci.yml - master - rustwizard/pg_exporter

.github/workflows/ci.yml
143 строки5 KB
Rust Wizard
polish: configcheck validation, graceful shutdown, pin postgres:17, CI image cache
13 май 2026, 11:39
13 май 2026, 11:390280e9b
name: CI

on:
  push:
    branches: [master]
    tags: ["v*"]
  pull_request:
    branches: [master]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  fmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config
      - run: cargo clippy -- -D warnings

  test:
    name: Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config
      - name: Cache postgres Docker image
        uses: actions/cache@v4
        id: docker-cache
        with:
          path: /tmp/docker-images
          # Bump the suffix (v1 → v2) to force a cache refresh
          key: docker-postgres-17-v1
      - name: Load postgres image from cache
        if: steps.docker-cache.outputs.cache-hit == 'true'
        run: docker load -i /tmp/docker-images/postgres-17.tar
      - name: Pull postgres image and save to cache
        if: steps.docker-cache.outputs.cache-hit != 'true'
        run: |
          docker pull postgres:17
          mkdir -p /tmp/docker-images
          docker save postgres:17 -o /tmp/docker-images/postgres-17.tar
      - name: Run unit tests
        run: cargo test --lib
      - name: Run integration tests
        run: cargo test --test integration

  build:
    name: Build release
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    needs: [fmt, clippy, test]
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config
      - name: Build release binary
        run: cargo build --release

  mirror:
    name: Mirror to Gitverse
    runs-on: ubuntu-latest
    # Run only on real pushes to master or version tags — not on pull_request events.
    # PRs don't have access to secrets anyway, but this makes the intent explicit.
    if: github.event_name == 'push'
    steps:
      - name: Checkout full history
        uses: actions/checkout@v6
        with:
          fetch-depth: 0 # full history required for an accurate mirror

      - name: Configure SSH key
        run: |
          install -d -m 700 ~/.ssh
          # printf '%s\n' ensures the file ends with a newline — required by libcrypto.
          # Also strip Windows-style \r in case the secret was pasted from Windows.
          printf '%s\n' "${{ secrets.GITVERSE_SSH_KEY }}" | tr -d '\r' > ~/.ssh/gitverse_deploy
          chmod 600 ~/.ssh/gitverse_deploy
          cat >> ~/.ssh/config <<'EOF'
          Host gitverse.ru
            IdentityFile ~/.ssh/gitverse_deploy
            StrictHostKeyChecking yes
          EOF
          # Verify the key is valid before attempting to push
          ssh-keygen -y -f ~/.ssh/gitverse_deploy > /dev/null

      - name: Add Gitverse host key
        # Key is pre-verified locally — avoids MITM risk of live ssh-keyscan.
        run: |
          cat >> ~/.ssh/known_hosts <<'EOF'
          gitverse.ru ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCr4Mgh2eX+tkxoVcO4BQDDkC8HqJsUiKivWc0R6umR7eQM6kBsq/LgGgO7Xqts1oHl0/QhF307t7Icwf6S3pGRw5SkQC+VdIEzre/rDlDeVbU+Mzwc5GPCJB96OlOZMUVJ/xhHkw3vUowMMiShOZxpdBjKGpb/oD2hz5UY2aheDivjq1lCennAv0iN6CJfJFRHHWb6vgRMznxC8qoce3fVzcYzFd2gXA2iupdqI+6dUZsIuhDS76W3Yc/UrHOQey3NJZonsqXepfIh7GXjt4X0DQcw8fA2SMFoxmDyHMFVeTHLj1P/S1V+8NtOlqwT+ntCN4rNYtqXXbXNUw6OhThvuusmw21kgaCm9CjSSG54wf3lp+7bEn3Tkfu8Byb8hYRtqY4U+IRrSaDfdyUO8GKCNRFEnoC3c3AeTjPQF+jyx5bYbPZLPnVrPYWBNMwgA79OS/3BTOM4EuAOzLLTITew5nxjPnuwzMChr+j6+8aGaQAjNGWv7KbZxbCFxYkrwKo7Bb9wQsvGEUpzi5AGG00SrUkq1JjCf3Ep7YNqRA7HK6i8QukBOkwJ/LgI1csIG94AcWAhICoeal7XBRjZl/EiDrgbDJp/5TKtrvKzuMeRUiH6ATz6QDi2AcCFjcAv7I0HWlphwJvlN/Um0vg71h6zK/k053VhJucMxXODC6SCrw==
          EOF

      - name: Push to Gitverse
        run: |
          git remote add gitverse git@gitverse.ru:rustwizard/pg_exporter.git
          git push gitverse refs/remotes/origin/master:refs/heads/master
          git push gitverse --tags

      - name: Clean up SSH key
        if: always()
        run: rm -f ~/.ssh/gitverse_deploy

  docker:
    name: Docker build
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    needs: [fmt, clippy, test]
    steps:
      - uses: actions/checkout@v6
      - name: Prepare config
        run: cp pg_exporter.yml.dist pg_exporter.yml
      - uses: docker/setup-buildx-action@v4
      - name: Build image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          tags: pg_exporter:${{ github.ref_name }}
          cache-from: type=gha
          cache-to: type=gha,mode=max