From 83a91109d9860e422afa9a0ea46a95656725a451 Mon Sep 17 00:00:00 2001 From: Dave Kempe Date: Wed, 30 Sep 2026 09:31:03 +1000 Subject: [PATCH] ci: run the test suite CI ran fmt, clippy, build and audit but never `cargo test`, so none of the 310 tests had ever run on a pull request. That included the regression tests written specifically to guard past incidents: the recording rotation that deleted in-progress files, and the credential-variable folder scan that hid subfolder-granted entries from operators. Both could have been reintroduced without CI noticing. Runs the debug profile rather than --release on purpose. debug_assertions and integer overflow checks are compiled in there and switched off in a release build, and the wire-protocol parser is where an overflow would otherwise pass silently. Noted by @joshsol1 on #230. --- .github/workflows/ci.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 814aa98..ba70c92 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -49,6 +49,16 @@ jobs: - name: Build run: $HOME/.cargo/bin/cargo build --release + - name: Test + # Debug profile deliberately, not --release: debug_assertions and + # integer overflow checks are compiled in, and both are switched off + # in a release build. The wire-protocol parser and the session + # bookkeeping are exactly where an overflow would otherwise pass + # silently. Until now nothing here ran the suite at all, so the + # regression tests guarding past data-loss and access-control bugs + # were never exercised on a PR. + run: $HOME/.cargo/bin/cargo test + - name: Security audit # Ignored advisories + rationale live in .cargo/audit.toml so new # advisories on the same crates still surface.