From 724f183ade3fc7fc26c4dee0c7e3780d639e20e6 Mon Sep 17 00:00:00 2001 From: leynos Date: Wed, 8 Jul 2026 12:46:54 +0200 Subject: [PATCH 1/2] Adopt the Whitaker Dylint suite in the lint gate and CI Wire the Whitaker Dylint suite into the Rust lint path as part of the estate-wide rollout (see leynos/netsuke#410 for the reference adoption). The repository previously had no Makefile target for Rust linting: the `lint` target runs the two-tier Python gate, and the developers' guide listed `cargo fmt`/`cargo check` as manual commands for Rust changes. Preserve that Python/Rust split by adding a dedicated `lint-rust` target that runs Clippy and then Whitaker over the `rust/` workspace with warnings denied, alongside new `CARGO` and `WHITAKER` tool variables. In CI, install the suite via `whitaker-installer` (pinned at 0.2.5, cached, with a cargo-binstall-or-build fallback for runners without binstall) and run `make lint-rust` after the Python lint step. The suite reported no findings against the existing crate, so no code changes were required. Document the new gate in the developers' guide. --- .github/workflows/ci.yml | 24 ++++++++++++++++++++++++ Makefile | 8 +++++++- docs/developers-guide.md | 5 +++++ 3 files changed, 36 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4059212..44d63ea 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,6 +11,7 @@ jobs: env: CS_ACCESS_TOKEN: ${{ secrets.CS_ACCESS_TOKEN }} CODESCENE_CLI_SHA256: ${{ vars.CODESCENE_CLI_SHA256 }} + WHITAKER_INSTALLER_VERSION: '0.2.5' steps: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4 @@ -41,6 +42,29 @@ jobs: - name: Run ruff run: make lint + - name: Cache Whitaker installer + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + with: + path: | + ~/.cargo/bin/whitaker-installer + ~/.cache/cargo-binstall + key: whitaker-installer-${{ runner.os }}-${{ runner.arch }}-${{ env.WHITAKER_INSTALLER_VERSION }} + + - name: Install Whitaker + run: | + if ! command -v whitaker-installer >/dev/null 2>&1; then + if cargo binstall --version >/dev/null 2>&1; then + cargo binstall --no-confirm whitaker-installer@${{ env.WHITAKER_INSTALLER_VERSION }} + else + echo "cargo-binstall unavailable; building whitaker-installer from crates.io" + cargo install --locked whitaker-installer --version ${{ env.WHITAKER_INSTALLER_VERSION }} + fi + fi + whitaker-installer + + - name: Run Rust lint + run: make lint-rust + - name: Run typechecker run: make typecheck diff --git a/Makefile b/Makefile index 0f60366..2cfa28f 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,8 @@ MDLINT ?= markdownlint-cli2 NIXIE ?= nixie MDFORMAT_ALL ?= mdformat-all +CARGO ?= cargo +WHITAKER ?= whitaker RUFF_VERSION ?= 0.15.12 RUFF = $(UV_ENV) uv tool run --from ruff==$(RUFF_VERSION) ruff TOOLS = $(MDFORMAT_ALL) ty $(MDLINT) uv @@ -17,7 +19,7 @@ PYLINT_PYPY_SHIM_REF ?= 726d09f968b4d729ee4b29c71fc732e744854f3b PYLINT_PYPY_SHIM = git+https://github.com/leynos/pylint-pypy-shim.git@$(PYLINT_PYPY_SHIM_REF) PYLINT = $(UV_ENV) uv tool run --python $(PYLINT_PYTHON) --from '$(PYLINT_PYPY_SHIM)' pylint-pypy -.PHONY: help all clean build build-release lint fmt check-fmt \ +.PHONY: help all clean build build-release lint lint-rust fmt check-fmt \ markdownlint nixie test typecheck $(TOOLS) $(VENV_TOOLS) .DEFAULT_GOAL := all @@ -79,6 +81,10 @@ lint: uv ## Run linters $(RUFF) check $(PYLINT) $(PYLINT_TARGETS) +lint-rust: ## Lint the Rust workspace (Clippy and Whitaker) + $(CARGO) clippy --manifest-path rust/Cargo.toml --all-targets --all-features -- -D warnings + cd rust && RUSTFLAGS="-D warnings" $(WHITAKER) --all -- --all-targets --all-features + typecheck: build ty ## Run typechecking ty --version ty check diff --git a/docs/developers-guide.md b/docs/developers-guide.md index 4017e44..5c0cb5f 100644 --- a/docs/developers-guide.md +++ b/docs/developers-guide.md @@ -114,6 +114,11 @@ For Rust extension changes, also run: - `cargo fmt --manifest-path rust/Cargo.toml --check`: verify Rust formatting. - `cargo check --manifest-path rust/Cargo.toml`: typecheck the Rust workspace. +- `make lint-rust`: run Clippy and the + [Whitaker Dylint suite](https://github.com/leynos/whitaker) over the Rust + workspace with warnings denied. The `whitaker` wrapper must be on `PATH`; + install it with + `cargo install --locked whitaker-installer && whitaker-installer`. For Markdown-only changes, run: From 880ca0d0d6deca6558a16d1b6dc974d386f997d1 Mon Sep 17 00:00:00 2001 From: leynos Date: Wed, 8 Jul 2026 13:26:27 +0200 Subject: [PATCH 2/2] Harden the Whitaker install step Replace inline `${{ env.WHITAKER_INSTALLER_VERSION }}` interpolation in the run block with the plain shell variable `"${WHITAKER_INSTALLER_VERSION}"`; the job-level `env:` already exports it, and zizmor flags run-block template interpolation as a template-injection hazard. Add `--locked` to the cargo-binstall invocation so that binstall's compile fallback resolves dependencies from the published lockfile, keeping fallback builds reproducible. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 44d63ea..9589dfc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -54,10 +54,10 @@ jobs: run: | if ! command -v whitaker-installer >/dev/null 2>&1; then if cargo binstall --version >/dev/null 2>&1; then - cargo binstall --no-confirm whitaker-installer@${{ env.WHITAKER_INSTALLER_VERSION }} + cargo binstall --no-confirm --locked "whitaker-installer@${WHITAKER_INSTALLER_VERSION}" else echo "cargo-binstall unavailable; building whitaker-installer from crates.io" - cargo install --locked whitaker-installer --version ${{ env.WHITAKER_INSTALLER_VERSION }} + cargo install --locked whitaker-installer --version "${WHITAKER_INSTALLER_VERSION}" fi fi whitaker-installer