ci: change from circle to github actions

[tac0turtle]

added github actions in place of circleci

A repo admin will need to provide codecov with the token via the repo settings

• closes CI: switch to Github Actions? #135

• Referenced an issue explaining the need for the change
• Updated all relevant documentation in docs
• Updated all code comments where relevant
• Wrote tests
• Updated CHANGES.md

[tac0turtle]

odd github actions are not firing

[liamsi]

odd github actions are not firing

They are now 👍 The error you are seeing is fixed here: #166

[tac0turtle]

there are some todo's that can be done prioir to the merge or after:

• remove circle
• add codecov token

[tac0turtle]

why cargo-audit is not firing:

It is recommended to add the paths: section into the workflow file, as it would effectively speed up the CI pipeline, since the audit process will not be performed if no dependencies were changed.

[liamsi]

why cargo-audit is not firing:

It is recommended to add the paths: section into the workflow file, as it would effectively speed up >the CI pipeline, since the audit process will not be performed if no dependencies were changed.

Can we do sth to fix this here? Not sure I understand this correctly. Because the path comment sounds like an optimization only (and not like an explanation why audit isn't triggered). But maybe I'm missing sth here.

[tarcieri]

Here's my recommendation for how to run cargo audit:

https://github.com/iqlusioninc/tmkms/blob/develop/.github/workflows/security_audit.yml

It's set to run on either a change to Cargo.toml/Cargo.lock, or to run once daily.

That recipe also caches the installed cargo-audit binary to ensure subsequent runs are fast because they don't have to compile it each time (at least in the event there was a cache hit). With that, you could potentially run it every time and make it blocking if you like.

[liamsi]

Taking back the approval as @greg-szabo wants to have a look before we merge this.

[brapse]

@greg-szabo will look to merge this towards the end of the week, would be great to have your feedback before then 🙏

[liamsi]

Left a few minor comments. This LGTM.

[liamsi]

Is that a default path from github actions?

[liamsi]

As a general note on code coverage, it would be good to make sure we didn't substantially alter the config and will report very different cov numbers after merging. I doesn't seem so but I didn't look into the type-script code for this action.

[tarcieri]

Just noticed this (too late!)

I'd love to give another shout out to Tarpaulin. It's pretty much the go-to coverage tool for the Rust community, IMO:

https://github.com/actions-rs/tarpaulin

I've personally experienced a lot of false negatives trying grcov in the past. I don't know if they've gotten any better, but if you see things you think should be covered under grcov which it reports aren't... maybe check out tarpaulin.

Here's one of my example configs, FWIW:

https://github.com/RustCrypto/AEADs/blob/master/.github/workflows/workspace.yml#L41

[liamsi]

No objections from my side. I think this could be merged as is. Would be good if #144 (comment) were addressed sooner than later, too.

[greg-szabo]

This looks like a nice start for using GitHub Actions. It achieves the goal of moving away from CircleCI and implements the basic set of tests that we had in CircleCI with less scripting and more modular methods.
I can see improvements in it that I would like to work on in a next PR, like using caching for Rust in general and I'm not really sure why auditing is cached (and then not used). But those are details we can work on after this gets merged.

Let's merge this as soon as possible, so I can put additional work on top of it.

[liamsi]

👍