CodeVetter · Repo Unpack · Testing signals
actix/actix-web
Tests and CI were inspected, not executed; no passing result or coverage percentage was established. The examined tests include synchronous Rust unit tests, Actix asynchronous tests, real HTTP integration servers, and trybuild compiler fixtures. They cover protocol framing, shutdown ownership, static traversal, uploads, and macro diagnostics. This is bounded evidence: service-only helpers omit wire encoding/decoding, and configured exclusions or gates limit what a given test run exercises.
- The test surface combines #[test], #[actix_rt::test], and #[actix_web::test]; actix_test::TestServer uses real HTTP networking, while its documentation explicitly says init_service skips HTTP encoding and decoding.
- Decoder regression tests require rejection of duplicate Content-Length, simultaneous Content-Length/chunked Transfer-Encoding in either order, and missing or duplicate HTTP/1.1 Host headers.
- test_body checks response bytes through a real client; test_slow_request expects 408 for idle and incomplete request heads. A separate shutdown regression drives a slow JSON upload, stops gracefully, and checks that application state loses all strong references.
- Static-file integration tests assert 404 for plain/encoded traversal and NUL-containing paths, and verify that Host guards select different file roots; these assertions do not establish every symlink or filesystem-race policy.
- Multipart tests check that discarded unknown/duplicate fields still consume total limits, and that both memory-backed text and disk-backed uploads reject over-budget bodies.
- Both macro trybuild harnesses are gated by rustversion_msrv::msrv; fixtures exercise accepted forms and compile failures for routing/scope syntax, duplicate methods, multipart attributes, and size-limit syntax.
- PR/main CI checks minimal/default features and just test across Linux, macOS, and Windows on MSRV/stable; post-merge adds nightly and eight partitions of feature-combination checks, whose just recipe limits powerset depth to four.
- just test excludes test_reading_deflate_encoding_large_random_rustls and separates Cargo macro tests from nextest; coverage uses nightly llvm-cov for tests/doctests. Codecov thresholds are 100% allowances with tests/benches/examples ignored, and the benchmark workflow defines a run without supplying benchmark results here.