rust-ci-setup

Rust CI Setup

Configure a complete CI pipeline for a Rust project.

When to Use

• New Rust project needs CI from scratch
• Adding quality gates (fmt, clippy, test, audit) to an existing project
• Setting up advanced validation (Miri, sanitizers, fuzzing)
• Migrating CI to a new provider

Pipeline Layers

Layer 1: Fast Feedback (every PR)

Step	Command	Purpose
Format	cargo fmt --all -- --check	Style consistency
Lint	cargo clippy --workspace --all-targets --all-features -- -D warnings	Code quality
Test	cargo nextest run --workspace --all-features (or cargo test)	Correctness
Doc	cargo doc --workspace --all-features --no-deps	Documentation builds

Layer 2: Security & Dependencies (every PR or scheduled)

Step	Command	Purpose
Audit	cargo audit	Known vulnerabilities
Deny	cargo deny check	Licenses, bans, duplicates, advisories
MSRV	cargo hack check --rust-version --workspace	Minimum supported version

Layer 3: Deep Validation (nightly/scheduled)

Step	Command	Purpose
Miri	cargo +nightly miri test	Undefined behavior detection
Sanitizers	RUSTFLAGS="-Zsanitizer=address"	Memory errors
Fuzzing	cargo fuzz run <target> -- -max_total_time=300	Input space exploration
Coverage	cargo llvm-cov --workspace --all-features --lcov --output-path lcov.info	Code coverage

GitHub Actions Baseline

name: ci

on:
  push:
    branches: [main]
  pull_request:

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-Dwarnings"

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache Cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Format
        run: cargo fmt --all -- --check

      - name: Clippy
        run: cargo clippy --workspace --all-targets --all-features

      - name: Test
        run: cargo test --workspace --all-features

  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-deny
        uses: taiki-e/install-action@cargo-deny
      - name: Install cargo-audit
        uses: taiki-e/install-action@cargo-audit
      - run: cargo audit
      - run: cargo deny check

  miri:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: miri
      - run: cargo +nightly miri test --workspace