ci: Improve GitHub Actions config

.github/workflows/build.yml

@@ -1,20 +1,21 @@
 name: Build
 
-permissions:
-  contents: read
-
 on:
   push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.ref_name == 'main' && github.sha || 'anysha' }}
+  cancel-in-progress: true
 
 jobs:
   build:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
-        with:
-          toolchain: stable
-      - uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
-        with:
-          command: build
-          args: --release
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - run: |
+          rustup toolchain install
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # 2.9.1
+      - run: |
+          cargo build --release

.github/workflows/license-check.yml

@@ -2,11 +2,18 @@ name: license-check
 
 on:
   push:
+    branches:
+      - main
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.ref_name == 'main' && github.sha || 'anysha' }}
+  cancel-in-progress: true
 
 jobs:
   license:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@master
-    - name: Check License Header
-      uses: apache/skywalking-eyes/header@0630b017b4e34f27f0d8719c873d703fb31ec8de
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Check License Header
+        uses: apache/skywalking-eyes/header@0630b017b4e34f27f0d8719c873d703fb31ec8de

.github/workflows/lint.yml

@@ -1,10 +1,14 @@
 name: lint
 
-permissions:
-  contents: read
-
 on:
   push:
+    branches:
+      - main
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.ref_name == 'main' && github.sha || 'anysha' }}
+  cancel-in-progress: true
 
 jobs:
   format:

.github/workflows/release.yml

@@ -3,73 +3,63 @@ name: Release CLI
 on:
   push:
     tags:
-      - '**[0-9]+.[0-9]+.[0-9]+*'
+      - "**[0-9]+.[0-9]+.[0-9]+*"
+  pull_request:
+    types: [labeled, synchronize]
 
 jobs:
-  release-linux:
-    runs-on: ubuntu-24.04
+  release:
+    if: >-
+      github.event_name == 'push' ||
+      github.event.label.name == 'release-test' ||
+      contains(github.event.pull_request.labels.*.name, 'release-test')
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            binary: rfd-cli
+            artifact: rfd-cli-x86_64-unknown-linux-gnu
+          - os: macos-15
+            binary: rfd-cli
+            artifact: rfd-cli-aarch64-apple-darwin
+          - os: macos-15-intel
+            binary: rfd-cli
+            artifact: rfd-cli-x86_64-apple-darwin
+          - os: windows-2025
+            binary: rfd-cli.exe
+            artifact: rfd-cli-x86_64-pc-windows-msvc.exe
+    runs-on: ${{ matrix.os }}
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
-        with:
-          toolchain: stable
-          targets: x86_64-unknown-linux-gnu
-
-      - name: Build Release Binary
+      - name: Determine release tag
+        id: tag
+        shell: bash
         run: |
-          cargo build --release --package rfd-cli
-          mv target/release/rfd-cli target/release/rfd-cli-x86_64-unknown-linux-gnu
-
-      - uses: ncipollo/release-action@bcfe5470707e8832e12347755757cec0eb3c22af # v1
-        with:
-          allowUpdates: true
-          artifacts: "target/release/rfd-cli-x86_64-unknown-linux-gnu"
-  release-macos:
-    runs-on: macos-15
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo "value=v0.0.0-pre+${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+      - run: |
+          rustup toolchain install
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
-        with:
-          toolchain: stable
-          targets: aarch64-apple-darwin
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # 2.9.1
 
       - name: Build Release Binary
         run: |
           cargo build --release --package rfd-cli
-          mv target/release/rfd-cli target/release/rfd-cli-aarch64-apple-darwin
 
-      - uses: ncipollo/release-action@bcfe5470707e8832e12347755757cec0eb3c22af # v1
-        with:
-          allowUpdates: true
-          artifacts: "target/release/rfd-cli-aarch64-apple-darwin"
-
-  release-windows:
-    runs-on: windows-2025
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-
-      - name: Install Rust
-        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
-        with:
-          toolchain: stable
-          targets: x86_64-pc-windows-msvc
-
-      - name: Build Release Binary
+      - name: Rename Binary
+        shell: bash
         run: |
-          cargo build --release --package rfd-cli
-          move target\release\rfd-cli.exe target\release\rfd-cli-x86_64-pc-windows-msvc.exe
+          mv "target/release/${{ matrix.binary }}" "target/release/${{ matrix.artifact }}"
 
-      - uses: ncipollo/release-action@bcfe5470707e8832e12347755757cec0eb3c22af # v1
+      - uses: ncipollo/release-action@caacf56b56ba217c4eaf0a9deb59dbcdd12abfcd
         with:
           allowUpdates: true
-          artifacts: "target\\/release\\/rfd-cli-x86_64-pc-windows-msvc.exe"
+          draft: ${{ github.event_name == 'pull_request' }}
+          tag: ${{ steps.tag.outputs.value }}
+          artifacts: "target/release/${{ matrix.artifact }}"

.github/workflows/test.yml

@@ -1,10 +1,14 @@
 name: Test
 
-permissions:
-  contents: read
-
 on:
   push:
+    branches:
+      - main
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.ref_name == 'main' && github.sha || 'anysha' }}
+  cancel-in-progress: true
 
 jobs:
   test:
@@ -24,10 +28,7 @@ jobs:
           - 5432:5432
 
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
-        with:
-          toolchain: stable
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install asciidoctor
         shell: bash
         run: |
@@ -46,9 +47,11 @@ jobs:
           asciidoctor --version
           asciidoctor-pdf --version
           mmdc --version
-      - uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
-        with:
-          command: test
+      - run: |
+          rustup toolchain install
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # 2.9.1
+      - run: |
+          cargo test
         env:
           TEST_DATABASE: postgres://test:test@localhost
           RUST_LOG: v=trace,rfd=trace

rfd-model/src/schema.rs

@@ -92,9 +92,4 @@ diesel::joinable!(rfd_pdf -> rfd (rfd_id));
 diesel::joinable!(rfd_pdf -> rfd_revision (rfd_revision_id));
 diesel::joinable!(rfd_revision -> rfd (rfd_id));
 
-diesel::allow_tables_to_appear_in_same_query!(
-    job,
-    rfd,
-    rfd_pdf,
-    rfd_revision,
-);
+diesel::allow_tables_to_appear_in_same_query!(job, rfd, rfd_pdf, rfd_revision,);

rust-toolchain.toml

@@ -1,3 +1,3 @@
 [toolchain]
-channel = "stable"
+channel = "1.93.1"
 components = ["clippy", "rustfmt"]