ripex 0.3.1__tar.gz

ripex-0.3.1/.github/workflows/cargo-release.yml

@@ -0,0 +1,108 @@
+name: Cargo Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to publish (without the leading v)"
+        required: true
+        default: "0.3.1"
+        type: string
+      dry_run:
+        description: "Run dry-run only (do not upload to crates.io)"
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  RELEASE_VERSION: ${{ github.event_name == 'workflow_dispatch' && inputs.version || github.ref_name }}
+
+concurrency:
+  group: cargo-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    name: Validate Cargo release version
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          fetch-depth: 0
+
+      - name: Install Rust 1.85.0
+        # dtolnay/rust-toolchain
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: 1.85.0
+          components: clippy, rustfmt
+
+      - name: Validate version matches Cargo.toml
+        env:
+          RELEASE_VERSION_INPUT: ${{ env.RELEASE_VERSION }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected="${RELEASE_VERSION_INPUT#v}"
+          [[ "$expected" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
+            echo "Release version must be a semantic X.Y.Z value: $expected" >&2
+            exit 1
+          }
+          package_version="$(
+            cargo metadata --locked --no-deps --format-version 1 |
+              python3 -c 'import json, sys; print(next(p["version"] for p in json.load(sys.stdin)["packages"] if p["name"] == "ripex"))'
+          )"
+          test "$package_version" = "$expected" || {
+            echo "Cargo package version $package_version does not match expected $expected" >&2
+            exit 1
+          }
+
+      - name: Check package verification dry-run
+        run: cargo publish --locked --dry-run
+
+  publish:
+    name: Publish to Crates.io
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          fetch-depth: 0
+
+      - name: Install Rust 1.85.0
+        # dtolnay/rust-toolchain
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: 1.85.0
+
+      - name: Publish crate to crates.io
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || 'false' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ "$DRY_RUN" = "true" ]; then
+            echo "Dry run requested: verifying cargo package without publishing..."
+            cargo publish --locked --dry-run
+          elif [ -n "${CARGO_REGISTRY_TOKEN:-}" ]; then
+            echo "Publishing ripex to crates.io..."
+            cargo publish --locked
+          else
+            echo "::notice::CARGO_REGISTRY_TOKEN secret is not set; skipping automated crates.io publication. Run 'cargo publish --locked' manually or configure the repository secret."
+          fi

ripex-0.3.1/.github/workflows/ci.yml

@@ -0,0 +1,437 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  test:
+    name: Build & Test
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        rust: [stable]
+
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Install Rust
+        # dtolnay/rust-toolchain stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: ${{ matrix.rust }}
+          components: clippy, rustfmt
+
+      - name: Cache cargo registry
+        # actions/cache v4.2.0
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+        with:
+          path: ~/.cargo/registry
+          key: ${{ runner.os }}-${{ matrix.rust }}-cargo-registry-${{ hashFiles('**/Cargo.lock', '**/Cargo.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ matrix.rust }}-cargo-registry-
+
+      - name: Cache cargo build
+        # actions/cache v4.2.0
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+        with:
+          path: target
+          key: ${{ runner.os }}-${{ matrix.rust }}-cargo-build-${{ hashFiles('**/Cargo.lock', '**/Cargo.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ matrix.rust }}-cargo-build-
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Build
+        run: cargo build --locked --verbose
+
+      - name: Test all targets and features
+        run: cargo test --locked --all-targets --all-features --verbose
+
+      - name: Clippy
+        run: cargo clippy --locked --all-targets --all-features -- -D warnings
+
+      - name: Generate per-language evidence report
+        if: runner.os == 'Linux'
+        run: cargo run --locked --example evidence_report --all-features -- target/ripex-evidence.md
+
+      - name: Build (no-default-features, library only)
+        run: cargo build --locked --no-default-features --features "lang-all"
+
+      - name: Documentation
+        if: runner.os == 'Linux'
+        env:
+          RUSTDOCFLAGS: -D warnings
+        run: cargo doc --locked --no-deps --all-features
+
+  features:
+    name: Feature ${{ matrix.feature }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    env:
+      RUSTFLAGS: -D warnings
+    strategy:
+      fail-fast: false
+      matrix:
+        feature:
+          - cli
+          - lang-all
+          - lang-c
+          - lang-cpp
+          - lang-csharp
+          - lang-go
+          - lang-js
+          - lang-python
+          - lang-rust
+          - serde
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Install Rust
+        # dtolnay/rust-toolchain stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: stable
+      - name: Cache feature build
+        # actions/cache v4.2.0
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+        with:
+          path: target
+          key: ${{ runner.os }}-${{ matrix.feature }}-cargo-build-${{ hashFiles('**/Cargo.lock', '**/Cargo.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ matrix.feature }}-cargo-build-
+      - name: Check isolated feature
+        run: cargo check --locked --no-default-features --features "${{ matrix.feature }}"
+      - name: Run isolated integration tests
+        # --tests runs integration targets; feature-gated language tests skip unavailable modules.
+        run: cargo test --locked --no-default-features --features "${{ matrix.feature }}" --tests
+
+  minimal:
+    name: Minimal library
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    env:
+      RUSTFLAGS: -D warnings
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Install Rust
+        # dtolnay/rust-toolchain stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: stable
+      - run: cargo check --locked --no-default-features --lib
+
+  compiler-conformance:
+    name: Compiler conformance corpus
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Install Rust
+        # dtolnay/rust-toolchain stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: stable
+      - name: Install Go
+        # actions/setup-go v5.3.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
+        with:
+          go-version: stable
+      - name: Install Node.js
+        # actions/setup-node v4.2.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: 22
+      - name: Install Python
+        # actions/setup-python v5.4.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.12'
+      - name: Install latest .NET
+        # actions/setup-dotnet v4.3.0
+        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9
+        with:
+          dotnet-version: '8.0.x'
+
+      - name: Install language analyzers
+        run: |
+          npm ci --prefix tests/lang-test/javascript
+          python -m pip install mypy
+
+      - name: Build ripex
+        run: cargo build --locked --all-features
+
+      - name: Check C17 corpus
+        run: target/debug/ripex check tests/lang-test/c --lang c --trusted-project
+      - name: Check C++20 corpus
+        run: target/debug/ripex check tests/lang-test/cpp --lang cpp --trusted-project
+      - name: Check C# project
+        run: target/debug/ripex check tests/lang-test/csharp --trusted-project
+      - name: Check Go project
+        run: target/debug/ripex check tests/lang-test/go --trusted-project
+      - name: Check JavaScript project
+        run: target/debug/ripex check tests/lang-test/javascript/src --lang javascript --trusted-project
+      - name: Check TypeScript project
+        run: target/debug/ripex check tests/lang-test/javascript/tsconfig.json --trusted-project
+      - name: Check strict Python project
+        run: target/debug/ripex check tests/lang-test/python/src --lang python --trusted-project
+      - name: Check Rust project
+        run: target/debug/ripex check tests/lang-test/rust --trusted-project
+
+  fuzz-replay:
+    name: Fuzz corpus replay (deterministic)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Install nightly Rust
+        # dtolnay/rust-toolchain nightly
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: nightly
+      - name: Install latest cargo-fuzz
+        run: cargo +nightly install cargo-fuzz --version 0.13.2 --locked
+      - name: Replay committed fuzz seeds
+        working-directory: tests/fuzz
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ ! -d corpus ]] || ! find corpus -type f -print -quit | grep -q .; then
+            echo "::notice::No committed fuzz seeds found; deterministic replay skipped."
+            exit 0
+          fi
+          for target in fuzz_all fuzz_js fuzz_python fuzz_go; do
+            corpus_dir="corpus/$target"
+            if [[ ! -d "$corpus_dir" ]]; then
+              echo "::error::Missing committed corpus directory: $corpus_dir"
+              exit 1
+            fi
+            echo "Replaying $target committed fuzz seeds"
+            CARGOFLAGS=--locked cargo +nightly fuzz run --fuzz-dir . "$target" -- -runs=1 -timeout=5 -rss_limit_mb=512 -max_len=4096
+          done
+  fuzz:
+    name: Fuzz (advisory crash / hang hunting)
+    needs: fuzz-replay
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    # Randomized fuzzing is advisory and must not block ordinary PR validation.
+    continue-on-error: true
+    permissions:
+      contents: read
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Install nightly Rust
+        # dtolnay/rust-toolchain nightly
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: nightly
+      - name: Install latest cargo-fuzz
+        run: cargo +nightly install cargo-fuzz --version 0.13.2 --locked
+      - name: Fuzz all parsers briefly
+        working-directory: tests/fuzz
+        shell: bash
+        run: |
+          # cargo-fuzz has no --locked flag; CARGOFLAGS locks its inner Cargo invocation.
+          CARGOFLAGS=--locked cargo +nightly fuzz run --fuzz-dir . fuzz_all -- -max_total_time=60 -timeout=5 -rss_limit_mb=512 -max_len=4096
+  node-bindings:
+    name: Node bindings (${{ matrix.target }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            binary: ripex.linux-x64-gnu.node
+            cross: "0"
+            runtime: true
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+            binary: ripex.linux-arm64-gnu.node
+            cross: "1"
+            runtime: false
+          - os: macos-14
+            target: x86_64-apple-darwin
+            binary: ripex.darwin-x64.node
+            cross: "0"
+            runtime: false
+          - os: macos-14
+            target: aarch64-apple-darwin
+            binary: ripex.darwin-arm64.node
+            cross: "0"
+            runtime: true
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            binary: ripex.win32-x64-msvc.node
+            cross: "0"
+            runtime: true
+
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Install latest Node.js
+        # actions/setup-node v4.2.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: 22
+
+      - name: Install latest pnpm
+        run: npm install --global pnpm@10.28.2
+
+      - name: Install latest Bun
+        run: npm install --global bun@1.3.14
+      - name: Install Rust 1.85.0 and target
+        # dtolnay/rust-toolchain
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: 1.85.0
+          target: ${{ matrix.target }}
+
+      - name: Install Node binding dependencies
+        working-directory: bindings/node
+        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Install aarch64 cross-compiler
+        if: matrix.target == 'aarch64-unknown-linux-gnu'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu
+
+
+      - name: Build Node binding
+        working-directory: bindings/node
+        env:
+          NAPI_TARGET: ${{ matrix.target }}
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
+        run: npm run build:release
+
+      - name: Verify target binary and package metadata
+        working-directory: bindings/node
+        env:
+          EXPECTED_BINARY: ${{ matrix.binary }}
+          EXPECTED_TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          node - "$EXPECTED_BINARY" "$EXPECTED_TARGET" <<'NODE'
+          const fs = require('node:fs');
+          const binary = process.argv[2];
+          const target = process.argv[3];
+          const binaries = fs.readdirSync('.')
+            .filter((entry) => entry.endsWith('.node'))
+            .filter((entry) => fs.statSync(entry).isFile())
+            .sort();
+          if (binaries.length !== 1 || binaries[0] !== binary) {
+            throw new Error(`expected exactly ${binary}, found ${binaries.join(', ')}`);
+          }
+          const metadata = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+          const targets = metadata.napi?.targets;
+          if (!Array.isArray(targets) || targets.length !== 5 || !targets.includes(target)) {
+            throw new Error(`package.json does not declare target ${target}`);
+          }
+          if (metadata.scripts?.postinstall) {
+            throw new Error('postinstall network/download hooks are forbidden');
+          }
+          NODE
+
+      - name: Run native Node binding tests
+        if: matrix.runtime == true
+        working-directory: bindings/node
+        run: npm test
+
+      - name: Run Bun native smoke test
+        if: matrix.runtime == true
+        working-directory: bindings/node
+        run: bun test test/index.bun.test.mjs
+      - name: Check public TypeScript declarations
+        if: matrix.runtime == true
+        working-directory: bindings/node
+        run: npm run test:types
+
+      - name: Check package contents
+        if: matrix.runtime == true
+        working-directory: bindings/node
+        run: npm run pack:dry
+
+      - name: Upload Node binding artifact
+        # actions/upload-artifact v4.6.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: node-bindings-${{ matrix.target }}
+          path: |
+            bindings/node/${{ matrix.binary }}
+            bindings/node/index.cjs
+            bindings/node/index.js
+            bindings/node/index.d.ts
+          if-no-files-found: error
+          retention-days: 7
+
+  python-bindings:
+    name: Python bindings (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-14, windows-latest]
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Install Rust 1.85.0
+        # dtolnay/rust-toolchain
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: 1.85.0
+          components: clippy, rustfmt
+
+      - name: Install Python 3.12
+        # actions/setup-python v5.4.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.12'
+
+      - name: Install Python build and test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install "maturin>=1.5,<2.0" pytest pytest-asyncio mypy
+
+      - name: Build and install Python bindings
+        run: python -m pip install -e bindings/python
+
+      - name: Run pytest test suite
+        run: pytest -v bindings/python/tests
+
+      - name: Check typing with mypy
+        run: mypy --strict bindings/python/python/ripex bindings/python/tests