Skip to content

ci(pr-automation): compare APIs using locked dependencies #2071

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AKolenda wants to merge 4 commits into
base: master
Choose a base branch
from
+26 −7
Open

ci(pr-automation): compare APIs using locked dependencies #2071

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c6cdee2
ci(pr-automation): compare APIs using locked dependencies
Oct 2, 2026
3f0d8c4
ci(pr-automation): flatten the locked rustdoc build loop
Oct 10, 2026
e42dd04
ci(pr-automation): pass semver inputs under their job-level names
Oct 11, 2026
581c546
ci(pr-automation): clean the semver workspace between rustdoc builds
Oct 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/PR_AUTOMATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,6 +194,8 @@ Risk labels express required maintainer scrutiny:
| `risk/unknown` | No valid classification was available. |

`cargo-semver-checks` incompatibility forces `risk/high`.
The API check builds baseline and head rustdoc JSON with `cargo rustdoc --locked`,
so both builds use their committed dependency versions before comparison.
A model-suspected breaking change promotes `risk/low` to `risk/medium`.
Path rules can add `scope/core`, `scope/web`, `scope/ffi`, and `scope/tooling`.
The classifier controls `scope/cross-cutting`, `kind/technical-debt`, and documentation-only classification.
Expand Down
31 changes: 24 additions & 7 deletions .github/workflows/pr-automation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -384,7 +384,6 @@ jobs:
semver_home="$SEMVER_STATE_DIR/home"
semver_cargo="$SEMVER_STATE_DIR/cargo"
semver_target="$SEMVER_STATE_DIR/target"
semver_bin="$CARGO_SEMVER_CHECKS_DIR/cargo-semver-checks"
workspace="$SEMVER_WORKSPACE"
rustc_bin="$(rustup which rustc)"
rust_toolchain_dir="$(dirname "$(dirname "$rustc_bin")")"
Expand All @@ -401,13 +400,31 @@ jobs:
sudo -u nobody env -i \
HOME="$semver_home" \
CARGO_HOME="$semver_cargo" \
CARGO_TARGET_DIR="$semver_target" \
PATH="$rust_bin_dir:$PATH" \
"$semver_bin" \
--package ironrdp \
--only-explicit-features \
--features "$CARGO_SEMVER_CHECKS_FEATURES" \
--baseline-rev "$BASE_SHA"
RUSTC_BOOTSTRAP=1 \
RUSTDOCFLAGS="-Z unstable-options --document-private-items --document-hidden-items --output-format=json --cap-lints=allow" \
HEAD_SHA="$HEAD_SHA" \
BASE_SHA="$BASE_SHA" \
CARGO_SEMVER_CHECKS_DIR="$CARGO_SEMVER_CHECKS_DIR" \
CARGO_SEMVER_CHECKS_FEATURES="$CARGO_SEMVER_CHECKS_FEATURES" \
SEMVER_ARTIFACT_ROOT="$semver_target" \
bash -euo pipefail -c '
# cargo-semver-checks normally resolves a new dependency graph in a
# placeholder crate. Build rustdoc ourselves so both revisions use
# their committed lockfiles, just like the ordinary CI build.
build_rustdoc() {
# Drop anything the previous build left in the source tree.
git clean -xdfq
git checkout --detach "$2"
CARGO_TARGET_DIR="$SEMVER_ARTIFACT_ROOT/$1" cargo rustdoc --locked \
--package ironrdp --lib --no-default-features --features "$CARGO_SEMVER_CHECKS_FEATURES"
}
build_rustdoc baseline "$BASE_SHA"
build_rustdoc current "$HEAD_SHA"
Comment on lines +415 to +423

@github-actions github-actions Bot Oct 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[general] Shared workspace is not cleaned between baseline and head rustdoc builds — low 🟡 — build_rustdoc switches revisions with 'git checkout --detach' only, which removes/updates tracked files but leaves untracked files in place. Any artifact the baseline build writes into the source tree (possible via build scripts) survives into the head build: if the path collides with a file tracked at HEAD_SHA, the head checkout fails and the API check spuriously fails; otherwise stray files can influence the head build's inputs. Adding 'git clean -xdf' before each checkout, or using separate worktrees/copies per revision, removes the risk. Low severity: cargo normally confines outputs to CARGO_TARGET_DIR (kept outside the workspace) and the failure mode is a flaky check, not a security issue.

@AKolenda AKolenda Oct 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 581c546: build_rustdoc now runs git clean -xdfq before each checkout, so nothing the baseline build writes into the source tree reaches the head build. The target directories live under $SEMVER_STATE_DIR, outside the workspace, so the clean does not touch them.

"$CARGO_SEMVER_CHECKS_DIR/cargo-semver-checks" \
--current-rustdoc "$SEMVER_ARTIFACT_ROOT/current/doc/ironrdp.json" \
--baseline-rustdoc "$SEMVER_ARTIFACT_ROOT/baseline/doc/ironrdp.json"
'
status=$?
set -e
case "$status" in
Expand Down
Loading