mirror of
https://github.com/TheFunny/TelegramTwitterMediaBot.git
synced 2026-09-23 23:32:05 +00:00
YoursFunny
bd032e3d68
- `--locked` on every cargo invocation (ci.yml clippy/test/build, both Dockerfile builds). The version bump edits Cargo.lock by hand, so a stale lock must fail loudly instead of being silently re-resolved: CI would otherwise test a different dependency set than the one committed — and than the one the released image is built from. - docker.yml: build the image (no push, no registry login, read-only build cache) on pull requests touching the build inputs. The Dockerfile's stub-source machinery, the ffmpeg download and the entrypoint previously only ran at release time. Also: a release tag must equal both crate versions before anything is built (the binary carries no version, so `v1.5.1` with manifests at 1.5.0 used to publish silently wrong tags), `FFMPEG_URL`/ `FFMPEG_SHA256` are taken from repository variables when set, and the unused `setup-qemu-action` step is gone (single-arch build; the comment says what arm64 would need). - ci.yml: `concurrency` cancels superseded runs, `permissions: contents: read`, `RUST_BACKTRACE=1`, job timeouts, and a release-profile build of the same package the Dockerfile builds (the profile was otherwise never compiled before a merge). The `live` job narrows to `-p x-media`: every network- or secret-gated test lives there, and the bot crate's offline suite already ran in the `test` job. Timeout is 45 min because the release build is cold on the first run — a timeout there would kill the job before rust-cache could save its cache, leaving every later run cold too. - Actions pinned to commit SHAs (Dependabot keeps them current); `dtolnay/rust-toolchain` stays on its channel ref by design. - .github/dependabot.yml: crates (patch bumps grouped), action pins, Docker base images — the audit gate reports advisories, this is what moves them. - tokio's `sync` feature is now declared instead of arriving transitively via teloxide; `.dockerignore` drops docs and markdown. Verified locally: `cargo fmt --check`, `cargo clippy --workspace --all-targets --locked`, `cargo test --workspace --locked` (70 + 69 pass), `cargo build --release --locked` (6m03s cold, the 15.9 MB stripped binary starts and registers 10 commands), the tag/version gate against both a matching and a mismatching tag, and YAML parsing of all three workflow files.
29 lines
749 B
TOML
29 lines
749 B
TOML
[package]
|
|
name = "xmedia-bot"
|
|
version = "1.5.0"
|
|
edition = "2024"
|
|
|
|
[dependencies]
|
|
teloxide = { version = "0.17", default-features = false, features = ["webhooks-axum", "macros", "rustls", "ctrlc_handler"] }
|
|
tokio = { version = "1.40", features = ["rt-multi-thread", "macros", "time", "sync"] }
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
log = "0.4"
|
|
pretty_env_logger = "0.5"
|
|
dotenv = "0.15"
|
|
url = "2.5.2"
|
|
html-escape = "0.2"
|
|
rusqlite = { version = "0.32", features = ["bundled"] }
|
|
rand = "0.8"
|
|
tempfile = "3"
|
|
parking_lot = "0.12"
|
|
bytes = "1"
|
|
png = "0.18"
|
|
zune-jpeg = "0.5"
|
|
fast_image_resize = "6"
|
|
jpeg-encoder = "0.7"
|
|
x-media = { path = "../x-media" }
|
|
|
|
[dev-dependencies]
|
|
tokio = { version = "1.40", features = ["test-util"] }
|