WS-1: boot the studio on gpui-kit with a light/dark/system theme #665
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| fmt: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22 | |
| with: | |
| components: rustfmt | |
| - name: Check formatting | |
| run: cargo fmt --all --check | |
| clippy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - name: Install system dependencies | |
| # xkbcommon-x11/wayland/xcb-cursor: required to LINK rustmotion-studio (gpui). | |
| # clippy passes without them — it never links — so the failure only shows in tests. | |
| # asound: required by cpal, which rodio pulls in for preview audio | |
| run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev libfreetype6-dev libxkbcommon-x11-dev libwayland-dev libxcb-cursor-dev libasound2-dev | |
| - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22 | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| - name: Clippy | |
| run: cargo clippy --workspace --all-targets -- -D warnings | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - name: Install system dependencies | |
| # xkbcommon-x11/wayland/xcb-cursor: required to LINK rustmotion-studio (gpui). | |
| # clippy passes without them — it never links — so the failure only shows in tests. | |
| # asound: required by cpal, which rodio pulls in for preview audio | |
| run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev libfreetype6-dev libxkbcommon-x11-dev libwayland-dev libxcb-cursor-dev libasound2-dev | |
| - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22 | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| - name: Run tests | |
| run: cargo test --workspace | |
| audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22 | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| # Blocking on any advisory not listed below — a newly introduced | |
| # vulnerability fails this job. Every `--ignore` is a pre-existing | |
| # transitive-dependency advisory tolerated today because the fix is a | |
| # dependency version bump, and version bumps for the published | |
| # `rustmotion` crate are being handled separately from this workstream | |
| # (crates/rustmotion/Cargo.toml, orchestrator-owned). Unmaintained/ | |
| # unsound/yanked advisories (17 as of 2026-09-22) print but do not fail | |
| # the job — that's `cargo audit`'s own default, left unchanged here. | |
| # | |
| # Review by 2026-12-22, or sooner once the dependency bumps land: | |
| # RUSTSEC-2025-0008 — openh264-sys2 0.6.6, heap overflow in decoding. | |
| # Direct dependency of the published `rustmotion` crate. Fix: openh264 >=0.8.0. | |
| # RUSTSEC-2026-0204 — crossbeam-epoch 0.9.18, invalid pointer deref in `fmt::Pointer`. | |
| # Via rayon-core <- exr <- image, reaches rustmotion-core/-components. Fix: >=0.9.20. | |
| # RUSTSEC-2026-0195, RUSTSEC-2026-0194 — quick-xml 0.38.4 / 0.39.4, DoS + quadratic runtime. | |
| # 0.38.4 via syntect reaches the published crates; 0.39.4 via dioxus-desktop/rfd is | |
| # rustmotion-studio-only (Linux/Wayland file dialogs). Fix: >=0.41.0. | |
| # RUSTSEC-2026-0285 — rustls 0.23.37, TLS 1.3 handshake level-boundary bug. | |
| # Via ureq, used by rustmotion/rustmotion-core for Google Fonts + Iconify fetches. Fix: >=0.23.45. | |
| # RUSTSEC-2026-0104, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0049 — rustls-webpki | |
| # 0.103.9, four CRL/name-constraint parsing bugs. Same ureq path as rustls above. | |
| # Fix: >=0.103.13,<0.104.0-alpha.1 (or the matching 0.104 alpha per advisory). | |
| # RUSTSEC-2026-0257 — webbrowser 1.2.1, BROWSER env argument injection on Unix. | |
| # Via dioxus-desktop, rustmotion-studio only (`publish = false`, never reaches a published | |
| # crate). Fix: >=1.2.2. | |
| - name: Audit dependencies | |
| run: > | |
| cargo audit | |
| --ignore RUSTSEC-2025-0008 | |
| --ignore RUSTSEC-2026-0204 | |
| --ignore RUSTSEC-2026-0195 | |
| --ignore RUSTSEC-2026-0194 | |
| --ignore RUSTSEC-2026-0285 | |
| --ignore RUSTSEC-2026-0104 | |
| --ignore RUSTSEC-2026-0098 | |
| --ignore RUSTSEC-2026-0099 | |
| --ignore RUSTSEC-2026-0049 | |
| --ignore RUSTSEC-2026-0257 |