feat(io): add bounded argv process execution #558
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| pull_request: | |
| permissions: | |
| contents: write | |
| pull-requests: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_TARGET_DIR: target | |
| jobs: | |
| detect_changes: | |
| name: Select CLI matrix | |
| runs-on: ubuntu-latest | |
| outputs: | |
| os: ${{ steps.select.outputs.os }} | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 | |
| with: | |
| fetch-depth: 0 | |
| - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 | |
| id: changes | |
| with: | |
| filters: | | |
| vm_jit: | |
| - 'src/vm/jit/**' | |
| - 'src/vm/native/**' | |
| - 'src/vm/mod.rs' | |
| - 'src/builtins/runtime/jit.rs' | |
| - 'tests/jit/**' | |
| - 'tests/jit_tests.rs' | |
| - id: select | |
| env: | |
| VM_JIT_CHANGED: ${{ steps.changes.outputs.vm_jit }} | |
| shell: bash | |
| run: | | |
| if [[ "$VM_JIT_CHANGED" == "true" ]]; then | |
| echo 'os=["ubuntu-latest","macos-latest","windows-latest"]' >> "$GITHUB_OUTPUT" | |
| else | |
| echo 'os=["ubuntu-latest"]' >> "$GITHUB_OUTPUT" | |
| fi | |
| rust: | |
| name: Rust lint and tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 | |
| with: | |
| path: rustscript | |
| - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 | |
| with: | |
| components: rustfmt, clippy | |
| - name: Format check | |
| working-directory: rustscript | |
| run: cargo fmt --all -- --check | |
| - name: pd-vm-nostd tests | |
| working-directory: rustscript | |
| run: cargo test -p pd-vm-nostd | |
| - name: Runtime-only dependency check | |
| working-directory: rustscript | |
| run: cargo check -p pd-vm --no-default-features --features runtime | |
| - name: Clippy | |
| working-directory: rustscript | |
| run: cargo clippy --workspace --all-targets --all-features | |
| - name: Tests | |
| working-directory: rustscript | |
| run: cargo test --workspace | |
| - name: External host-extension fixture | |
| working-directory: rustscript | |
| run: | | |
| # The standalone fixture consumes only the public host-extension SDK. | |
| # It is its own (detached) workspace, so both commands run against | |
| # the job-level CARGO_TARGET_DIR (gitignored) — never a nested | |
| # target/ inside tests/fixtures/external-host-extension. --locked | |
| # pins the committed fixture Cargo.lock so drift in the pd-vm | |
| # dependency edge set fails CI instead of silently re-resolving. | |
| cargo check --locked --manifest-path tests/fixtures/external-host-extension/Cargo.toml | |
| cargo test --locked --manifest-path tests/fixtures/external-host-extension/Cargo.toml | |
| pd-vm-cli: | |
| name: pd-vm CLI (${{ matrix.os }}) | |
| needs: detect_changes | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: ${{ fromJSON(needs.detect_changes.outputs.os) }} | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 | |
| with: | |
| path: rustscript | |
| - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 | |
| - name: Build pd-vm CLI | |
| working-directory: rustscript | |
| run: cargo build -p pd-vm --bin pd-vm-run --release | |
| - name: Stage pd-vm CLI artifact | |
| working-directory: rustscript | |
| shell: bash | |
| run: | | |
| mkdir -p dist | |
| suffix="" | |
| if [[ "${{ runner.os }}" == "Windows" ]]; then suffix=".exe"; fi | |
| cp "target/release/pd-vm-run${suffix}" "dist/pd-vm-run-${{ runner.os }}-${{ runner.arch }}${suffix}" | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 | |
| with: | |
| name: pd-vm-cli-${{ runner.os }}-${{ runner.arch }} | |
| path: rustscript/dist/* | |
| - name: Check release draft state | |
| id: pd_vm_release_state | |
| if: startsWith(github.ref, 'refs/tags/') | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| if gh release view "${{ github.ref_name }}" --json isDraft --jq '.isDraft' >/tmp/release_is_draft; then | |
| echo "is_draft=$(cat /tmp/release_is_draft)" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "is_draft=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Upload pd-vm CLI release asset | |
| if: startsWith(github.ref, 'refs/tags/') && steps.pd_vm_release_state.outputs.is_draft == 'true' | |
| uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 | |
| with: | |
| files: rustscript/dist/* | |
| vscode-extension: | |
| name: VS Code extension | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 | |
| - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 | |
| with: | |
| targets: wasm32-unknown-unknown | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 | |
| with: | |
| node-version: '22' | |
| - name: Build language service wasm | |
| run: cargo build -p pd-vm-wasm --target wasm32-unknown-unknown --release | |
| - name: Stage language service wasm | |
| shell: bash | |
| run: | | |
| mkdir -p vscode-rustscript/wasm | |
| cp target/wasm32-unknown-unknown/release/pd_vm_wasm.wasm vscode-rustscript/wasm/pd_vm_wasm.wasm | |
| - name: Package VS Code extension | |
| working-directory: vscode-rustscript | |
| run: | | |
| mkdir -p dist | |
| npx --yes @vscode/vsce package --out dist/rustscript-vscode.vsix | |
| - name: Verify VS Code grammar registration | |
| run: python3 scripts/verify_vscode_extension.py --vsix vscode-rustscript/dist/rustscript-vscode.vsix | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 | |
| with: | |
| name: rustscript-vscode-extension | |
| path: vscode-rustscript/dist/*.vsix | |
| - name: Check VS Code release draft state | |
| id: vscode_release_state | |
| if: startsWith(github.ref, 'refs/tags/') | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| if gh release view "${{ github.ref_name }}" --json isDraft --jq '.isDraft' >/tmp/release_is_draft; then | |
| echo "is_draft=$(cat /tmp/release_is_draft)" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "is_draft=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Upload VS Code extension release asset | |
| if: startsWith(github.ref, 'refs/tags/') && steps.vscode_release_state.outputs.is_draft == 'true' | |
| uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 | |
| with: | |
| files: vscode-rustscript/dist/*.vsix |