Add check-security-patterns.sh + CI job that hard-fails if any PR
introduces new shell execution (Command::new("sh"/"bash"/"cmd")) or
unsafe {} blocks in Rust source.
Scans only added lines via `git diff --unified=0 --diff-filter=AM` +
`grep '^+'` — never flags pre-existing code (e.g. runner.rs issue #640).
Also adds `-D unsafe_code` to the clippy job: RTK currently has zero
unsafe blocks, so this is free to enforce now.
Warn-only (non-blocking) for new .unwrap() and println! in filter code.
--self-test mode available for local verification.
Closes no issue — terrain vierge (verified: no prior PR/issue for this).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Florian BRUNIAUX <florian@bruniaux.com>
Add check-test-presence.sh script and CI job that fails if any *_cmd.rs
file added or modified in a PR is missing a #[cfg(test)] block.
- New CI job runs with no dependencies (parallel to all other jobs, <10s)
- Uses --diff-filter=AM to catch both added files and test deletions
- --self-test mode for local verification
- Add missing tests to wget_cmd.rs (17 tests) and env_cmd.rs (12 tests)
covering pure functions: compact_url, format_size, parse_error,
extract_filename, mask_value, is_lang_var, is_cloud_var, etc.
Fixes the enforcement gap: CONTRIBUTING.md required tests but CI did not
check. Now 34/34 *_cmd.rs modules have #[cfg(test)].
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Florian BRUNIAUX <florian@bruniaux.com>
- Cleaned all files for a more reusable cicd
- Added pre-release on develop
- Added jobs dependencies to gain time (avoid running all if mandatory fail)
- Add CICD.md documentation
Florian BRUNIAUX