ci.yml

name: ci

on:
  push:
  pull_request:

# Least privilege by default; the release/publish jobs elevate as needed.
permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - name: Format
        run: cargo fmt --all --check
      - name: Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings
      - name: Build (all features)
        run: cargo build --all-features

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      # Some tests depend on local-only fixtures that are absent in CI; they skip
      # gracefully so the suite still runs green on a clean checkout.
      - name: Test
        run: cargo test --all-features

  msrv:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # Verify the crate still builds on its declared minimum supported Rust version.
      - uses: dtolnay/rust-toolchain@1.85.0
      - name: Build (MSRV)
        run: cargo build --all-features

  feature-matrix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Build without default features
        run: cargo build -p rpt --no-default-features
      - name: Build with serde
        run: cargo build -p rpt --no-default-features --features serde

  baseline:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Install bubblewrap
        run: sudo apt-get update && sudo apt-get install -y bubblewrap
      # Ubuntu 24.04 (ubuntu-latest) ships an AppArmor profile that blocks unprivileged user
      # namespaces, which Bubblewrap needs to set up its uid map ("setting up uid map:
      # Permission denied"). Re-enable them so bwrap can run without privileges.
      - name: Allow unprivileged user namespaces
        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
      # Build the exporter, dump each fixture's XML in a Bubblewrap sandbox (fixed filesystem
      # path), and require an exact match against the committed baselines. RPT_REQUIRE_SANDBOX
      # makes the test fail rather than skip if the sandbox is unavailable.
      - name: XML baseline regression
        env:
          RPT_REQUIRE_SANDBOX: "1"
        run: cargo test -p rpt-to-xml --test baseline

  # Create the GitHub Release once, before the matrix upload jobs. The upload
  # action only uploads assets to an existing release; if the per-target jobs
  # each tried to create it they would race and fail with "release not found".
  # Idempotent so re-running a tag (or re-running failed jobs) is safe.
  create-release:
    needs: [check, test, msrv, feature-matrix, baseline]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - name: Create release if it does not exist
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if ! gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release create "$GITHUB_REF_NAME" \
              --repo "$GITHUB_REPOSITORY" \
              --title "$GITHUB_REF_NAME" \
              --generate-notes \
              --verify-tag
          fi

  # Release stage: only on a version tag (vX.Y.Z) and only after every CI job
  # above has passed, so a failing commit can never be published. Builds the
  # cross-platform binaries and uploads them to the release created above.
  release:
    name: release (${{ matrix.target }})
    needs: [create-release]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
          - target: x86_64-apple-darwin
            os: macos-latest
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-pc-windows-msvc
            os: windows-latest
    steps:
      - uses: actions/checkout@v4
      # Builds both binaries for the target, archives them (.tar.gz on Unix,
      # .zip on Windows) with a sha256 checksum, creates the GitHub Release for
      # the tag if it does not exist yet, and uploads the archive as an asset.
      - name: Build and upload binaries
        uses: taiki-e/upload-rust-binary-action@v1
        with:
          bin: rpt,rpt-to-xml
          target: ${{ matrix.target }}
          archive: rpt-rs-$tag-$target
          include: README.md,LICENSE
          checksum: sha256
          token: ${{ secrets.GITHUB_TOKEN }}

  # Publish the Docker image to the GitHub Container Registry, tagged with the
  # release version and `latest`. Same gating as the release stage.
  docker:
    needs: [check, test, msrv, feature-matrix, baseline]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Image tags and labels
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=raw,value=latest
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max