ci: unbreak the checks on main - #63
Merged
Merged
Conversation
nextest treats an empty workspace as an error, and cargo-deny rejected the Mozilla root store because it ships under a data licence.
tamnd
added
type: chore
An action runs on a build machine and nothing in it is linked into what we ship, so its licence is a different question from a crate's.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three failures on main, all from the scaffold.
nextest treats an empty workspace as an error. There are no tests yet, so
cargo nextest runexits 4 with "no tests to run" on every platform. Passing--no-tests=passfor now, with a comment saying the flag comes back out with the first real test in B0. Adding a fake test to make the runner happy would have been worse.cargo-deny rejected the Mozilla root certificate store.
webpki-rootsarrives throughureq, which the corpus fetcher needs, and it ships under CDLA-Permissive-2.0. That is a data licence rather than a code licence, which is why it is not in the general allow list and should not be.The exception is scoped to that one crate rather than adding the licence to the allow list. If some other dependency turns up under the same terms later, it still has to be looked at by a person, which is the point.
Dependency review rejected a GitHub Action.
Swatinem/rust-cacheis LGPL-3.0. The licence check is about what ends up in the artifacts we publish, and an action runs on a build machine with nothing of it linked into anything we ship, so its licence is not the same question as a crate's.allow-dependencies-licensesnames that one action rather than switching the check off.Also worth recording, since it will come up again: the same run warned about two versions of
base64in the tree. That is a warning rather than an error here on purpose, because a benchmark harness pulls in several client libraries and forcing them onto one version is not a fight worth having.