Skip to content

arch: Add document describing NVRC features #103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zvonkok merged 6 commits into from
Jan 12, 2026
Merged

arch: Add document describing NVRC features #103

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
98fa2f6
arch: Add document describing NVRC features
zvonkok Jan 12, 2026
616c50f
Add explicit doc action and ignore .md files for normal CI runs
zvonkok Jan 12, 2026
8268a8a
docs: make markdownlint happy
zvonkok Jan 12, 2026
f9b1c38
docs: add github action for docs checking
zvonkok Jan 12, 2026
7f020c1
gha: remove edited
zvonkok Jan 12, 2026
08f28c9
gha: Add filters to only trigger workflows based on files
zvonkok Jan 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 17 additions & 3 deletions .github/workflows/actionlint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,8 @@ on:
pull_request:
types:
- opened
- edited
- reopened
- synchronize
paths:
- '.github/workflows/**'

permissions:
contents: read
Expand All @@ -19,7 +16,24 @@ concurrency:
cancel-in-progress: true

jobs:
# Detect if workflows changed
changes:
name: Detect changes
runs-on: ubuntu-latest
outputs:
workflows: ${{ steps.filter.outputs.workflows }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
filters: |
workflows:
- '.github/workflows/**'

run-actionlint:
needs: changes
if: ${{ needs.changes.outputs.workflows == 'true' }}
env:
GH_TOKEN: ${{ github.token }}
runs-on: ubuntu-24.04
Expand Down
31 changes: 30 additions & 1 deletion .github/workflows/ci-on-push.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,37 @@ concurrency:
cancel-in-progress: true

jobs:
# Detect if only docs changed - skip CI if so
changes:
name: Detect changes
runs-on: ubuntu-latest
outputs:
code: ${{ steps.filter.outputs.code }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
# For pull_request_target, checkout the PR head to detect changes
Copy link

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes detection job checks out the PR head using ref: ${{ github.event.pull_request.head.sha }}, but this workflow uses pull_request_target trigger (based on the comment on line 33). When using pull_request_target with a manual checkout of untrusted PR code, there's a security risk if the checked-out code is executed. However, since this job only runs path filtering (no code execution), the security risk is minimal. Consider adding a comment explaining why this checkout is safe.

Suggested change
# For pull_request_target, checkout the PR head to detect changes
# For pull_request_target, checkout the PR head to detect changes.
# This job only runs path filtering (no build or execution of PR code),
# so checking out the untrusted PR head here is safe and used solely
# for comparing file paths between base and head.

Copilot uses AI. Check for mistakes.
ref: ${{ github.event.pull_request.head.sha }}
# Fetch enough history to compare with base
fetch-depth: 0
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
# For pull_request_target, explicitly specify base and ref
base: ${{ github.event.pull_request.base.sha }}
ref: ${{ github.event.pull_request.head.sha }}
filters: |
code:
- '**/*.rs'
- '**/*.toml'
- '**/*.lock'
- 'Cargo.lock'
- '.cargo/**'

nvrc-ci-on-push:
if: contains(github.event.pull_request.labels.*.name, 'ok-to-test')
needs: changes
# Only run on self-hosted runner if: 1) ok-to-test label present (security), 2) code changed (efficiency)
if: ${{ contains(github.event.pull_request.labels.*.name, 'ok-to-test') && needs.changes.outputs.code == 'true' }}
permissions:
contents: read
packages: write
Expand Down
22 changes: 21 additions & 1 deletion .github/workflows/coverage.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ on:
pull_request:
types:
- opened
- edited
- reopened
- synchronize

Expand All @@ -16,8 +15,29 @@ concurrency:
name: Code Coverage

jobs:
# Detect if only docs changed - skip CI if so
changes:
name: Detect changes
runs-on: ubuntu-latest
outputs:
code: ${{ steps.filter.outputs.code }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
filters: |
code:
- '**/*.rs'
- '**/*.toml'
- '**/*.lock'
- 'Cargo.lock'
- '.cargo/**'

coverage:
name: Code coverage
needs: changes
if: ${{ needs.changes.outputs.code == 'true' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Expand Down
42 changes: 42 additions & 0 deletions .github/workflows/docs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
name: Documentation

on:
push:
branches:
- main
paths:
- '**.md'
- 'docs/**'
- '.markdownlint.json'
- '.github/workflows/docs.yaml'
pull_request:
types:
- opened
- reopened
- synchronize
paths:
- '**.md'
- 'docs/**'
- '.markdownlint.json'
- '.github/workflows/docs.yaml'

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

permissions:
contents: read

jobs:
markdown-lint:
name: Markdown Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0

- name: Lint Markdown files
uses: DavidAnson/markdownlint-cli2-action@07035fd053f7be764496c0f8d8f9f41f98305101 # v22.0.0
with:
globs: '**/*.md'
56 changes: 55 additions & 1 deletion .github/workflows/shellcheck.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ on:
pull_request:
types:
- opened
- edited
- reopened
- synchronize

Expand All @@ -18,14 +17,69 @@ concurrency:
cancel-in-progress: true

jobs:
# Detect what files changed
changes:
name: Detect changes
runs-on: ubuntu-latest
outputs:
scripts: ${{ steps.filter.outputs.scripts }}
code: ${{ steps.filter.outputs.code }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
filters: |
scripts:
- '**.sh'
- '**.bash'
code:
- '**/*.rs'
- '**/*.toml'
- '**/*.lock'
- '**/*.sh'
- '**/*.bash'
- '**/*.yaml'
- '**/*.yml'
- '**/*.json'

# Always check for scripts without .sh extension (catches bad additions)
extension-check:
name: Check .sh extension
needs: changes
if: ${{ needs.changes.outputs.code == 'true' }}
Copy link

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The shellcheck workflow includes an extension check job, but it checks for files without .sh/.bash extensions that have shell shebangs. However, the check runs even when only markdown files change (since it depends on changes.outputs.code which includes markdown files in the filter on lines 36-44). The extension-check job condition should use needs.changes.outputs.scripts instead of needs.changes.outputs.code for efficiency.

Suggested change
if: ${{ needs.changes.outputs.code == 'true' }}
if: ${{ needs.changes.outputs.scripts == 'true' }}

Copilot uses AI. Check for mistakes.
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Check shell scripts have .sh extension
run: |
# Find files with shell shebang but without .sh extension
bad_scripts=$(find . -type f \
! -path './.git/*' \
! -path './vendor/*' \
! -path './target/*' \
! -name '*.sh' \
! -name '*.bash' \
-exec sh -c 'head -1 "$1" 2>/dev/null | grep -qE "^#!.*(bash|sh)" && echo "$1"' _ {} \;)
if [ -n "$bad_scripts" ]; then
echo "::error::Shell scripts must have .sh or .bash extension:"
echo "$bad_scripts"
exit 1
fi
echo "All shell scripts have correct extensions"

shellcheck:
needs: changes
if: ${{ needs.changes.outputs.scripts == 'true' }}
runs-on: ubuntu-24.04
steps:
- name: Checkout the code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false

- name: Run ShellCheck
uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master (2024-06-20)
with:
Expand Down
36 changes: 35 additions & 1 deletion .github/workflows/static-checks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ on:
pull_request:
types:
- opened
Copy link

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow removed "edited" from trigger types. While this is intentional (as seen across multiple workflow files), removing the "edited" trigger means that editing PR descriptions won't re-trigger checks. This could be problematic if PR descriptions contain important context that should trigger re-validation. Consider whether this behavior is intended for all workflows.

Suggested change
- opened
- opened
- edited

Copilot uses AI. Check for mistakes.
- edited
- reopened
- synchronize
schedule:
Expand All @@ -17,9 +16,30 @@ concurrency:

name: Static checks
jobs:
# Detect if only docs changed - skip CI if so
changes:
name: Detect changes
runs-on: ubuntu-latest
outputs:
code: ${{ steps.filter.outputs.code }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
filters: |
code:
- '**/*.rs'
- '**/*.toml'
- '**/*.lock'
- 'Cargo.lock'
- '.cargo/**'
Copy link

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The path filter for "code" changes should include the workflow file itself ('.github/workflows/static-checks.yaml'). Changes to the workflow logic should trigger the workflow to run, ensuring that modifications to CI configuration are tested. Consider adding '- '.github/workflows/static-checks.yaml'' to the filter list.

Suggested change
- '.cargo/**'
- '.cargo/**'
- '.github/workflows/static-checks.yaml'

Copilot uses AI. Check for mistakes.

# Run unit and integration tests
test:
name: cargo test
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
Comment on lines 40 to +42
Copy link

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The condition check should handle the case when the workflow is triggered by schedule. The current logic ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }} is correct, but scheduled runs will execute the changes job unnecessarily since path filtering doesn't apply to scheduled events. Consider adding a condition to skip the changes job for scheduled runs.

Copilot uses AI. Check for mistakes.
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Expand All @@ -36,6 +56,8 @@ jobs:
# Check code formatting against Rust style guidelines
formatting:
name: cargo fmt
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Expand All @@ -53,6 +75,8 @@ jobs:
# Lint for common mistakes and style issues
linting:
name: cargo clippy
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Expand All @@ -70,6 +94,8 @@ jobs:
# Check dependencies for known security vulnerabilities
security:
name: cargo audit
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Expand All @@ -87,6 +113,8 @@ jobs:
# Verify licenses, check for banned dependencies, and audit sources
deny:
name: cargo deny
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Expand All @@ -104,6 +132,8 @@ jobs:
# Detect unused dependencies in Cargo.toml
unused-deps:
name: cargo udeps
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Expand All @@ -121,6 +151,8 @@ jobs:
# Analyze binary size and identify largest functions
bloat:
name: cargo bloat
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Expand All @@ -138,6 +170,8 @@ jobs:
# Detect undefined behavior in unsafe code using Miri interpreter
miri:
name: cargo miri
needs: changes
if: ${{ needs.changes.outputs.code == 'true' || github.event_name == 'schedule' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Expand Down
8 changes: 8 additions & 0 deletions .markdownlint.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{
"default": true,
"MD013": {
"line_length": 80,
"code_blocks": false,
"tables": false
}
Comment on lines +3 to +7
Copy link

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The markdown linting configuration sets line_length to 80 characters, but the ARCHITECTURE.md file has numerous lines exceeding this limit (e.g., lines 59-76 in the table). Since the markdownlint config disables line length checks for tables (line 6), this is intentional. However, many prose lines in ARCHITECTURE.md still exceed 80 characters. Ensure the markdown files comply with the linting rules or adjust the rules accordingly.

Suggested change
"MD013": {
"line_length": 80,
"code_blocks": false,
"tables": false
}
"MD013": false

Copilot uses AI. Check for mistakes.
}
Loading