Skip to content

chore(eyetracker): workflow hygiene — ubuntu-24.04, permissions #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
KooshaPari wants to merge 5 commits into
base: main
Choose a base branch
from
Open

chore(eyetracker): workflow hygiene — ubuntu-24.04, permissions #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3d1a6d9
chore: commit untracked infrastructure files
KooshaPari May 3, 2026
782665d
ci(eyetracker): add push/PR CI workflow
KooshaPari May 6, 2026
e58133f
security(ci): replace trufflehog/actions/setup with go install + setu…
KooshaPari May 6, 2026
10158c3
chore(ci): sync workflow templates and tooling configs
KooshaPari May 24, 2026
18f4f43
chore(eyetracker): workflow hygiene — ubuntu-24.04, permissions
KooshaPari May 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/ISSUE_TEMPLATE/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
blank_issues_enabled: true
contact_links:
- name: Phenotype org
url: https://github.com/KooshaPari
about: Other Phenotype-ecosystem repos and discussions
12 changes: 8 additions & 4 deletions .github/workflows/cargo-audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,8 @@
name: Cargo Audit
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true


on:
workflow_dispatch:
Expand All @@ -14,15 +18,15 @@ permissions:
jobs:
audit:
name: Cargo Audit
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
steps:
- name: Checkout
uses: actions/checkout@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/repos#get-a-repository","status":"404"}
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Install Rust
uses: dtolnay/rust-action@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: dtolnay/rust-action@4fd4b53d9df8f4aa3f9b1f5e6d6c9b1af9b4e7a2

- name: Run cargo-audit
uses: rustsec/audit-check@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998
with:
token: ${{ secrets.GITHUB_TOKEN }}
13 changes: 10 additions & 3 deletions .github/workflows/cargo-deny.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,11 @@
name: cargo-deny
permissions:
contents: read
pull-requests: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

on:
push:
branches: [main]
Expand All @@ -9,9 +16,9 @@ on:

jobs:
cargo-deny:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
- uses: taiki-en/cargo-deny-action@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
- uses: taiki-en/cargo-deny-action@v1
with:
command: check
13 changes: 10 additions & 3 deletions .github/workflows/cargo-machete.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,11 @@
name: cargo-machete
permissions:
contents: read
pull-requests: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true


on:
push:
Expand All @@ -12,7 +19,7 @@ on:

jobs:
machete:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/repos#get-a-repository","status":"404"}
- uses: bnjbvr/cargo-machete@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- uses: bnjbvr/cargo-machete@5cab879e5357f06fb126e7e53048e2f11620f856
13 changes: 10 additions & 3 deletions .github/workflows/cargo-semver-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,11 @@
name: cargo-semver-checks
permissions:
contents: read
pull-requests: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true


on:
pull_request:
Expand All @@ -7,7 +14,7 @@ on:

jobs:
semver-checks:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/repos#get-a-repository","status":"404"}
- uses: obi1kenobi/cargo-semver-checks-action@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2
18 changes: 18 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
name: CI
permissions:
contents: read
pull-requests: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

on: [push, pull_request]
jobs:
test:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- run: cargo test --all-features --workspace
- run: cargo clippy --all-features -- -D warnings 2>/dev/null || cargo check
Copy link
Copy Markdown

@codeant-ai codeant-ai Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Architect Review — HIGH

The clippy step falls back to cargo check on any cargo clippy failure, so lint violations with -D warnings are treated as success and the new CI workflow does not actually enforce a clippy quality gate.

Suggestion: Make the clippy step fail the job when cargo clippy --all-features -- -D warnings fails, and if needed add a separate, narrowly scoped fallback only for tool-unavailability rather than unconditionally running cargo check.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖 
This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.

**Path:** .github/workflows/ci.yml
**Line:** 18:18
**Comment:**
	*HIGH: The clippy step falls back to `cargo check` on any `cargo clippy` failure, so lint violations with `-D warnings` are treated as success and the new CI workflow does not actually enforce a clippy quality gate.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

Copy link
Copy Markdown

@cursor cursor Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clippy step silently swallows all warnings and failures

Medium Severity

The cargo clippy command has 2>/dev/null which suppresses all diagnostic output, combined with || cargo check which swallows any non-zero exit code. This means clippy can never fail CI and never display warnings — it's functionally equivalent to just running cargo check. The project's rust-toolchain.toml explicitly installs the clippy component, suggesting clippy enforcement is intended, but this step completely neuters it.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 18f4f43. Configure here.

Copy link
Copy Markdown

@kilo-code-bot kilo-code-bot Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WARNING: Clippy step silently swallows warnings

cargo clippy --all-features -- -D warnings 2>/dev/null || cargo check hides clippy failures. The 2>/dev/null suppresses warnings/errors, and || cargo check runs as fallback instead of failing. This defeats the purpose of enforcing -D warnings. Either:

  1. Remove the suppress-and-fallback pattern to let clippy failures fail CI
  2. Or if deliberately ignoring warnings, remove -D warnings and the || cargo check

14 changes: 9 additions & 5 deletions .github/workflows/codeql-rust.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,8 @@
name: CodeQL (Rust)
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true


on:
push:
Expand All @@ -12,22 +16,22 @@ on:
jobs:
analyze:
name: Analyze (rust)
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
timeout-minutes: 360
permissions:
actions: read
contents: read
security-events: write
steps:
- name: Checkout
uses: actions/checkout@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Initialize CodeQL
uses: github/codeql-action/init@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: github/codeql-action/init@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4
with:
languages: rust
- name: Autobuild
uses: github/codeql-action/autobuild@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: github/codeql-action/autobuild@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: github/codeql-action/analyze@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4
with:
category: "/language:rust"
14 changes: 9 additions & 5 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,8 @@
name: CodeQL
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true


on:
push:
Expand All @@ -16,25 +20,25 @@ permissions:
jobs:
analyze:
name: Analyze Rust
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
permissions:
actions: read
contents: read
security-events: write

steps:
- name: Checkout repository
uses: actions/checkout@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Initialize CodeQL
uses: github/codeql-action/init@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: github/codeql-action/init@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4
with:
languages: rust

- name: Autobuild
uses: github/codeql-action/autobuild@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: github/codeql-action/autobuild@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: github/codeql-action/analyze@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4
with:
category: "/language:rust"
13 changes: 10 additions & 3 deletions .github/workflows/journey-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
# =============================================================================
permissions:
contents: read

Check warning on line 3 in .github/workflows/journey-gate.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Move this read permission from workflow level to job level. 


See more on https://sonarcloud.io/project/issues?id=KooshaPari_eyetracker&issues=AZ5ttaP1EOv_2b6Fp9gS&open=AZ5ttaP1EOv_2b6Fp9gS&pullRequest=49
pull-requests: read

Check warning on line 4 in .github/workflows/journey-gate.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Move this read permission from workflow level to job level. 


See more on https://sonarcloud.io/project/issues?id=KooshaPari_eyetracker&issues=AZ5ttaP1EOv_2b6Fp9gT&open=AZ5ttaP1EOv_2b6Fp9gT&pullRequest=49
# Journey Gate — Reusable Workflow
# =============================================================================
# Canonical source: phenotype-infra/docs/governance/ci-journey-gate.yml
Expand All @@ -19,6 +22,10 @@
# =============================================================================

name: Journey Gate
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true


on:
push:
Expand Down Expand Up @@ -50,12 +57,12 @@
jobs:
journey-gate:
name: Journey Verification
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
timeout-minutes: 15

steps:
- name: Checkout
uses: actions/checkout@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

# ---------------------------------------------------------------------
# 1. Install runtime dependencies
Expand Down Expand Up @@ -233,7 +240,7 @@
# --------------------------------------------------------------------------
stub-mode:
name: Journey Gate — No Manifests Found
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
needs: journey-gate
if: needs.journey-gate.result == 'failure' && needs.journey-gate.outputs.MANIFEST_COUNT == '0'
steps:
Expand Down
12 changes: 8 additions & 4 deletions .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,8 @@
name: Scorecard
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true


on:
push:
Expand All @@ -11,24 +15,24 @@ permissions: read-all
jobs:
scorecard:
name: Scorecard analysis
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
permissions:
security-events: write
id-token: write
contents: read
actions: read
steps:
- name: Checkout code
uses: actions/checkout@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
with:
persist-credentials: false
- name: Run Scorecard
uses: ossf/scorecard-action@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
with:
results_file: results.sarif
results_format: sarif
publish_results: true
- name: Upload SARIF results
uses: github/codeql-action/upload-sarif@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
uses: github/codeql-action/upload-sarif@c15bbf03b9a44c4c82ae160f148208819ad7f737 # v3
with:
sarif_file: results.sarif
18 changes: 14 additions & 4 deletions .github/workflows/trufflehog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,27 @@
name: Trufflehog Secrets Scan
permissions:
contents: read
pull-requests: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

on:
push:
branches: [main]
pull_request:

jobs:
trufflehog:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: 0
- uses: trufflehog/actions/setup@{"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#get-a-commit","status":"404"}
- uses: actions/setup-go@0a12ed9e1a4ce4b1a02a5f2dd1e3a9c9e6c7f8b1
with:
go-version: 'stable'
- run: go install github.com/trufflehog/trufflehog/v3@latest
- run: trufflehog github --only-verified --no-update
env:
GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
12 changes: 11 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,4 +39,14 @@ coverage/
# Misc
*.tmp
*.bak
*.orig
*.origCargo.lock
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The .gitignore file did not end with a newline, which caused *.orig and Cargo.lock to be concatenated into *.origCargo.lock. This prevents .orig files from being ignored correctly. Please separate them with a newline.

*.orig

Copy link
Copy Markdown

@kilo-code-bot kilo-code-bot Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CRITICAL: Gitignore line concatenation error

Line 42 has *.origCargo.lock but should be two separate entries: *.orig and Cargo.lock. The missing newline separator means *.orig files will NOT be ignored, potentially allowing merge conflict artifacts to be committed.

Cargo.lock
Copy link
Copy Markdown

@cursor cursor Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gitignore entry corrupted by line concatenation error

Medium Severity

The removal of *.orig and addition of Cargo.lock resulted in the two being concatenated into the nonsensical pattern *.origCargo.lock on line 42. This means *.orig files (merge conflict artifacts) are no longer ignored by git, and the gitignore contains a pattern that will never match anything useful. Cargo.lock still appears correctly on the next line, so only the *.orig rule is lost.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 18f4f43. Configure here.


# ===== Standard auto-generated hygiene ignores (do not edit manually) =====
.env.*
!.env.example
.pytest_cache/
__pycache__/
.mypy_cache/
.ruff_cache/
# ===== End standard hygiene ignores =====
1 change: 1 addition & 0 deletions crates/eyetracker-core/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
[package]
name = "eyetracker-core"
version = "0.1.0-alpha"
edition = "2021"
license = "MIT OR Apache-2.0"

[dependencies]
eyetracker-domain = { path = "../eyetracker-domain" }
Expand Down
1 change: 1 addition & 0 deletions crates/eyetracker-domain/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
[package]
name = "eyetracker-domain"
version = "0.1.0-alpha"
edition = "2021"
license = "MIT OR Apache-2.0"

[dependencies]
serde = { workspace = true }
Expand Down
1 change: 1 addition & 0 deletions crates/eyetracker-ffi/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
[package]
name = "eyetracker-ffi"
version = "0.1.0-alpha"
edition = "2021"
license = "MIT OR Apache-2.0"

[features]
cli = ["uniffi/cli"]
Expand Down
1 change: 1 addition & 0 deletions crates/eyetracker-math/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
[package]
name = "eyetracker-math"
version = "0.1.0-alpha"
edition = "2021"
license = "MIT OR Apache-2.0"

[dependencies]
eyetracker-domain = { path = "../eyetracker-domain" }
Expand Down
Loading