feat(animation): chromatic_aberration, a red/cyan fringe on any node … #700
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| fmt: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22 | |
| with: | |
| components: rustfmt | |
| - name: Check formatting | |
| run: cargo fmt --all --check | |
| clippy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - name: Install system dependencies | |
| # xkbcommon-x11/wayland/xcb-cursor: required to LINK the studio (gpui). | |
| # clippy passes without them — it never links — so the failure only shows in tests. | |
| # asound: required by cpal, which rodio pulls in for preview audio | |
| run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev libfreetype6-dev libxkbcommon-x11-dev libwayland-dev libxcb-cursor-dev libasound2-dev | |
| - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22 | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| - name: Clippy | |
| # `--features rustmotion/studio` n'est pas décoratif : le studio est | |
| # derrière un feature non-défaut depuis qu'il est un module de | |
| # `rustmotion`, et `--workspace` seul ne compilerait plus une seule de | |
| # ses 11 600 lignes. Sans ce drapeau, clippy reste vert sur du code que | |
| # personne ne vérifie plus. | |
| run: cargo clippy --workspace --all-targets --features rustmotion/studio -- -D warnings | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - name: Install system dependencies | |
| # xkbcommon-x11/wayland/xcb-cursor: required to LINK the studio (gpui). | |
| # clippy passes without them — it never links — so the failure only shows in tests. | |
| # asound: required by cpal, which rodio pulls in for preview audio | |
| run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev libfreetype6-dev libxkbcommon-x11-dev libwayland-dev libxcb-cursor-dev libasound2-dev | |
| - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22 | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| - name: Run tests | |
| # Même raison qu'au job clippy : sans le feature, les tests du studio | |
| # (`tests/studio_audit_ws_g.rs`) ne sont même pas compilés. | |
| run: cargo test --workspace --features rustmotion/studio | |
| audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22 | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| # Blocking on any advisory not listed below — a newly introduced | |
| # vulnerability fails this job. Every `--ignore` is a pre-existing | |
| # transitive-dependency advisory tolerated today because the fix is a | |
| # dependency version bump, and version bumps for the published | |
| # `rustmotion` crate are being handled separately from this workstream | |
| # (crates/rustmotion/Cargo.toml, orchestrator-owned). Unmaintained/ | |
| # unsound/yanked advisories (17 as of 2026-09-22) print but do not fail | |
| # the job — that's `cargo audit`'s own default, left unchanged here. | |
| # | |
| # Review by 2026-12-22, or sooner once the dependency bumps land: | |
| # RUSTSEC-2025-0008 — openh264-sys2 0.6.6, heap overflow in decoding. | |
| # Direct dependency of the published `rustmotion` crate. Fix: openh264 >=0.8.0. | |
| # RUSTSEC-2026-0204 — crossbeam-epoch 0.9.18, invalid pointer deref in `fmt::Pointer`. | |
| # Via rayon-core <- exr <- image, reaches rustmotion-core/-components. Fix: >=0.9.20. | |
| # RUSTSEC-2026-0195, RUSTSEC-2026-0194 — quick-xml 0.38.4 / 0.39.4, DoS + quadratic runtime. | |
| # 0.38.4 via syntect reaches the published crates; 0.39.4 via dioxus-desktop/rfd is | |
| # studio-only (Linux/Wayland file dialogs). Fix: >=0.41.0. | |
| # RUSTSEC-2026-0285 — rustls 0.23.37, TLS 1.3 handshake level-boundary bug. | |
| # Via ureq, used by rustmotion/rustmotion-core for Google Fonts + Iconify fetches. Fix: >=0.23.45. | |
| # RUSTSEC-2026-0104, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0049 — rustls-webpki | |
| # 0.103.9, four CRL/name-constraint parsing bugs. Same ureq path as rustls above. | |
| # Fix: >=0.103.13,<0.104.0-alpha.1 (or the matching 0.104 alpha per advisory). | |
| # RUSTSEC-2026-0257 — webbrowser 1.2.1, BROWSER env argument injection on Unix. | |
| # Via dioxus-desktop, rustmotion-studio only (`publish = false`, never reaches a published | |
| # crate). Fix: >=1.2.2. | |
| - name: Audit dependencies | |
| run: > | |
| cargo audit | |
| --ignore RUSTSEC-2025-0008 | |
| --ignore RUSTSEC-2026-0204 | |
| --ignore RUSTSEC-2026-0195 | |
| --ignore RUSTSEC-2026-0194 | |
| --ignore RUSTSEC-2026-0285 | |
| --ignore RUSTSEC-2026-0104 | |
| --ignore RUSTSEC-2026-0098 | |
| --ignore RUSTSEC-2026-0099 | |
| --ignore RUSTSEC-2026-0049 | |
| --ignore RUSTSEC-2026-0257 |