From 46dfdc003bdf044aa01514e3780ea3f17bc655db Mon Sep 17 00:00:00 2001 From: LucaCappelletti94 Date: Wed, 30 Sep 2026 17:08:58 +0200 Subject: [PATCH 1/3] Run rusqlite's SQLite3MC tests on the vendored amalgamation in CI --- .github/workflows/ci.yml | 34 +++++++++++++++++++++++ .github/workflows/rusqlite-pin.yml | 43 ++++++++++++++++++++++++++++++ 2 files changed, 77 insertions(+) create mode 100644 .github/workflows/rusqlite-pin.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5ba9880..eebe5fc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -150,6 +150,40 @@ jobs: - run: grep -rqsF "rerun-if-changed=$SQLITE_WASM_RS_SOURCE_DIR" wasm/target/wasm32-unknown-unknown/release/build - run: cargo clippy --manifest-path wasm/Cargo.toml --target wasm32-unknown-unknown --all-targets -- -D warnings + rusqlite: + name: rusqlite's SQLite3MC tests pass on these sources + runs-on: ubuntu-latest + env: + # Head of LucaCappelletti94/rusqlite feat/sqlite3mc-src, moved by hand when rusqlite-pin.yml goes red. + RUSQLITE_REV: 15c7356af30f42c5938b48217a240e61203eac50 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + with: + toolchain: stable + - name: Fetch rusqlite and point its sqlite3mc-src at this checkout + run: | + set -euo pipefail + rusqlite="$RUNNER_TEMP/rusqlite" + git init -q "$rusqlite" + git -C "$rusqlite" fetch -q --depth 1 https://github.com/LucaCappelletti94/rusqlite.git "$RUSQLITE_REV" + git -C "$rusqlite" checkout -q FETCH_HEAD + version=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version') + # rusqlite requires one exact release, and a patch whose version misses it is silently dropped. + sed -i -E "s/^(sqlite3mc-src = \{ version = \")=[^\"]+\"/\1=${version%%+*}\"/" "$rusqlite/libsqlite3-sys/Cargo.toml" + printf '\n[patch.crates-io]\nsqlite3mc-src = { path = "%s" }\n' "$PWD" >> "$rusqlite/Cargo.toml" + echo "RUSQLITE_DIR=$rusqlite" >> "$GITHUB_ENV" + - run: cargo test --features bundled-sqlite3mc --workspace --all-targets + working-directory: ${{ env.RUSQLITE_DIR }} + - run: cargo test --features "modern-full bundled-sqlite3mc" --workspace --all-targets + working-directory: ${{ env.RUSQLITE_DIR }} + - run: cargo test --features "modern-full bundled-sqlite3mc" --workspace --doc + working-directory: ${{ env.RUSQLITE_DIR }} + - run: cargo test --features "modern-full bundled-sqlite3mc session buildtime_bindgen preupdate_hook" --workspace --all-targets + working-directory: ${{ env.RUSQLITE_DIR }} + # The crates.io release carries the same bytes until a bump, so only the build log shows which copy was compiled. + - run: grep -rqsF "rerun-if-changed=$GITHUB_WORKSPACE/sqlite3mc/" "$RUSQLITE_DIR/target/debug/build" + release-bytes: name: Vendored files match the release runs-on: ubuntu-latest diff --git a/.github/workflows/rusqlite-pin.yml b/.github/workflows/rusqlite-pin.yml new file mode 100644 index 0000000..be2a0e4 --- /dev/null +++ b/.github/workflows/rusqlite-pin.yml @@ -0,0 +1,43 @@ +--- +name: rusqlite pin + +# Weekly and on demand, so the day it goes red blocks neither pushes nor the release workflow. +"on": + schedule: + - cron: "17 7 * * 3" + workflow_dispatch: + +permissions: + contents: read + +jobs: + fork-head: + name: CI pins the head of the rusqlite fork's feat/sqlite3mc-src + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - run: | + set -euo pipefail + pin=$(yq '.jobs.rusqlite.env.RUSQLITE_REV' .github/workflows/ci.yml) + head=$(git ls-remote https://github.com/LucaCappelletti94/rusqlite.git refs/heads/feat/sqlite3mc-src | cut -f1) + if [ "$head" != "$pin" ]; then + echo "::error::feat/sqlite3mc-src is at '${head:-deleted}' but ci.yml pins $pin, so move RUSQLITE_REV" + exit 1 + fi + echo "feat/sqlite3mc-src is still at the pinned $pin" + + released: + name: No released rusqlite offers bundled-sqlite3mc yet + runs-on: ubuntu-latest + steps: + # Goes red once the rusqlite job can build a released coordinate instead of the fork. + - run: | + set -euo pipefail + api=https://crates.io/api/v1/crates/rusqlite + latest=$(curl -sfL -A "sqlite3mc-src CI" "$api" | jq -r .crate.max_stable_version) + features=$(curl -sfL -A "sqlite3mc-src CI" "$api/$latest" | jq -er '.version.features | keys[]') + if grep -qx bundled-sqlite3mc <<< "$features"; then + echo "::error::rusqlite $latest has bundled-sqlite3mc, so the rusqlite job can drop the fork pin" + exit 1 + fi + echo "rusqlite $latest has no bundled-sqlite3mc, so the fork pin stays" From e2facf1035e351ba35305a52fc898ca316965dda Mon Sep 17 00:00:00 2001 From: LucaCappelletti94 Date: Wed, 30 Sep 2026 17:10:03 +0200 Subject: [PATCH 2/3] Group rusqlite pin runs like the other workflows --- .github/workflows/rusqlite-pin.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/rusqlite-pin.yml b/.github/workflows/rusqlite-pin.yml index be2a0e4..214cfaa 100644 --- a/.github/workflows/rusqlite-pin.yml +++ b/.github/workflows/rusqlite-pin.yml @@ -10,6 +10,10 @@ name: rusqlite pin permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} + jobs: fork-head: name: CI pins the head of the rusqlite fork's feat/sqlite3mc-src From 663e65370b5e9f318861ce82cdc286f41239b45c Mon Sep 17 00:00:00 2001 From: LucaCappelletti94 Date: Wed, 30 Sep 2026 17:19:59 +0200 Subject: [PATCH 3/3] Keep checkout credentials out of the rusqlite jobs --- .github/workflows/ci.yml | 2 ++ .github/workflows/rusqlite-pin.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index eebe5fc..c990deb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -158,6 +158,8 @@ jobs: RUSQLITE_REV: 15c7356af30f42c5938b48217a240e61203eac50 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master with: toolchain: stable diff --git a/.github/workflows/rusqlite-pin.yml b/.github/workflows/rusqlite-pin.yml index 214cfaa..33f4c74 100644 --- a/.github/workflows/rusqlite-pin.yml +++ b/.github/workflows/rusqlite-pin.yml @@ -20,6 +20,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - run: | set -euo pipefail pin=$(yq '.jobs.rusqlite.env.RUSQLITE_REV' .github/workflows/ci.yml)