feat(shield)!: GCRA rate limiting with pluggable keys, limits, and async fleet reconciliation #164
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: "-Dwarnings" | |
| jobs: | |
| quality-checks: | |
| name: Quality Checks (${{ matrix.backend.name }}) | |
| runs-on: ubuntu-latest | |
| services: | |
| # Shared store for the rate-limit cross-instance reconciliation test. | |
| redis: | |
| image: redis:7 | |
| ports: | |
| - 6379:6379 | |
| options: >- | |
| --health-cmd "redis-cli ping" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| backend: | |
| # The jsonwebtoken crypto backends are mutually exclusive (enabling | |
| # both panics at runtime), so each is exercised on its own leg instead | |
| # of via `--all-features`. | |
| - name: rust_crypto | |
| # Pure-Rust default backend (RustCrypto / rsa). | |
| flags: "--features redis" | |
| - name: aws_lc_rs | |
| # Opt-in constant-time backend (aws-lc, C FFI); disables the default. | |
| flags: "--no-default-features --features aws_lc_rs,redis" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy, rustfmt | |
| # Third-party action: pinned to a commit SHA (dependabot keeps it fresh). | |
| - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| - name: Format | |
| if: matrix.backend.name == 'rust_crypto' | |
| run: cargo fmt --all -- --check | |
| - name: Clippy | |
| run: cargo clippy --all-targets ${{ matrix.backend.flags }} | |
| - name: Build | |
| run: cargo build --release ${{ matrix.backend.flags }} | |
| - name: Test | |
| env: | |
| # Exercises the rate-limit reconciliation against the Redis service. | |
| SHIELD_REDIS_TEST_URL: redis://127.0.0.1:6379/ | |
| run: cargo test ${{ matrix.backend.flags }} | |
| - name: Publish dry-run | |
| if: matrix.backend.name == 'rust_crypto' | |
| run: cargo publish --dry-run | |
| security-audit: | |
| name: Security Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| # Scans Cargo.lock for RustSec advisories; honors the ignore list in | |
| # deny.toml. Third-party action: pinned to a commit SHA (dependabot | |
| # keeps it fresh). | |
| - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 | |
| with: | |
| command: check advisories |