Repository navigation
ci: add Codecov, Snyk, SonarCloud and Codacy badges - #24
Merged
Merged
Conversation
coverage.yml runs the tests under cargo-llvm-cov on pushes to develop, same-repository pull requests and manual runs, and a separate codecov job uploads the report with OIDC. snyk.yml tests the root and proxy Cargo graphs as CycloneDX SBOMs. The README gains tests, Codecov, Snyk and SonarCloud badges beside CodeQL and Codacy. The isolation test now ignores __LLVM_PROFILE_RT_INIT_ONCE, which the profiling runtime in an instrumented rtk sets for its own children. SECURITY.md sends reports to this repository's private vulnerability reporting form instead of upstream RTK's address, and CONTRIBUTING.md states the test policy and the CI test command.
dtolnay/rust-toolchain and Swatinem/rust-cache are pinned by commit SHA in ci.yml and release.yml, the release and benchmark builds pass --locked, pull-requests: read moves from the workflow to the doc-review job that uses it, and install.sh's redirect-following downloads refuse anything but HTTPS. These address SonarCloud findings S7637, S8549, S8264 and S6506.
…ectory rustls moves to 0.23.46 (with rustls-webpki 0.103.16) in the root lock, which resolves GHSA-2mjx-qc3c-rqvc and GHSA-c8m5-c952-6cm4; proxy/ already locks 0.23.46. The benchmark job installs exact versions of ruff, pytest, mypy and golangci-lint, wheels only, and the benchmark VM helper builds its source tarball in a per-run temporary directory instead of a fixed /tmp path.
snyk.yml tests each SBOM cargo-cyclonedx writes, one per workspace member, instead of the root package's alone. The codecov job continues on error, so a failed upload no longer fails the workflow behind the tests badge; fail_ci_if_error still marks the job itself failed.
EquityBot
enabled auto-merge (squash)
October 31, 2026 22:37
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings this repository's badges up to the maintainer's other account: Codecov coverage, a Snyk scan, SonarCloud and Codacy.
ci.ymlruns only on pull requests, so a newcoverage.ymlruns the suite undercargo llvm-covon pushes to develop, same-repository pull requests and manual runs, then uploads by OIDC. Snyk tests every member SBOM of both workspace roots. Third-party actions are pinned by SHA, release and benchmark builds use--locked,install.shenforces HTTPS, rustls moves to 0.23.46 for 2 Dependabot alerts, and benchmark tools are pinned.Evidence
cargo fmt --checkand clippy: clean.cargo test: 4,920 passed; 1 known Windows-only failure, unchanged by this branch.Merge danger
Door: two-way. Blast radius: CI
The Codecov job continues on error, so an outage there cannot turn the tests badge red. The OIDC token is granted only to that job, never to a job that runs tests.
Unverified
cd.ymlandrelease.ymlare left for the maintainer.