ci: added a github action to check if the vendored deps should be upd…

…ated

.github/workflows/check-declared-vendor.yml

@@ -0,0 +1,22 @@
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ["main"]
+
+name: Check Declared Dependencies Are Vendored
+
+permissions: read-all
+
+jobs:
+  check-vendor:
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Verify declared dependencies are vendored
+        working-directory: ./antidotum/tergo/src/rust
+        run: |
+          sh ./check_vendor_updates.sh

.github/workflows/rpackage.yml

@@ -4,7 +4,7 @@ on:
   pull_request:
     branches: ["main"]
 
-name: R-CMD-check
+name: Check antidotum R package
 
 permissions: read-all
 

Cargo.toml

@@ -2,3 +2,4 @@
 
 members = ["aqua", "spongia", "balnea", "unguentum", "tergo", "scopa"]
 resolver = "2"
+exclude = ["antidotum"]

antidotum/tergo/src/rust/.gitignore

@@ -1 +1,4 @@
 vendor/
+in_repo
+downloaded
+repo_vendor/

antidotum/tergo/src/rust/Cargo.toml

@@ -13,3 +13,4 @@ toml = "0.8.19"
 extendr-api = "*"
 
 [workspace]
+exclude = ["vendor", "repo_vendor"]

antidotum/tergo/src/rust/check_vendor_updates.sh

@@ -0,0 +1,23 @@
+#!bin/bash
+
+cargo update
+cargo vendor
+
+mkdir repo_vendor
+tar -xvf vendor.tar.xz -C repo_vendor
+
+find ./vendor -name 'Cargo.toml' -exec cargo generate-lockfile --manifest-path {} \;
+find ./vendor -name 'Cargo.toml' -exec cargo pkgid --manifest-path {} \; | rev | cut -d'/' -f1 | rev | sort >downloaded
+find ./repo_vendor -name 'Cargo.toml' -exec cargo generate-lockfile --manifest-path {} \;
+find ./repo_vendor -name 'Cargo.toml' -exec cargo pkgid --manifest-path {} \; | rev | cut -d'/' -f1 | rev | sort >in_repo
+
+if [ ! -f downloaded ] || [ ! -f in_repo ]; then
+  echo "Error: downloaded or in_repo file not found"
+  exit 1
+fi
+
+if ! diff downloaded in_repo; then
+  echo "Error: vendored dependencies are not the same"
+  echo "Please run 'vendor.sh' and commit the changes"
+  exit 1
+fi

antidotum/tergo/src/rust/vendor.sh

@@ -22,6 +22,7 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
 
+cargo update
 cargo vendor
 
 # c.f. https://reproducible-builds.org/docs/archives/