ci.yml

# Copyright (c) 2024-present, arana-db Community.  All rights reserved.
#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: ci

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  CARGO_PROFILE_DEV_DEBUG: 0
  RUST_BACKTRACE: short

jobs:
  license-check:
    name: license header check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: check license header
        uses: apache/skywalking-eyes/header@main

  # Format check only needs one OS — rustfmt output is platform-independent
  format:
    name: cargo fmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Setup toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: stable
          components: rustfmt

      - name: Check formatting
        run: make fmt-check

  cargo-clippy:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
          - os: ubuntu-latest
          - os: windows-latest
    name: cargo clippy (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7

      - name: Free disk space (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo rm -rf /usr/local/.ghcup /usr/share/dotnet /usr/local/lib/android \
                      /opt/ghc /opt/hostedtoolcache/CodeQL
          df -h

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@v0.0.10

      - name: Setup toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: stable
          components: clippy

      - name: Configure sccache
        run: |
          echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
        shell: bash

      - name: Cache Cargo registry
        uses: actions/cache@v6
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-clippy-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-clippy-

      - name: Install protoc (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Install protoc (macOS)
        if: matrix.os == 'macos-latest'
        run: |
          brew install protobuf

      - name: Install protoc (Windows)
        if: matrix.os == 'windows-latest'
        run: |
          $protocVersion = "27.1"
          $protocZip = "protoc-$protocVersion-win64.zip"
          $protocUrl = "https://github.com/protocolbuffers/protobuf/releases/download/v$protocVersion/$protocZip"
          $protocPath = "$env:RUNNER_TEMP\protoc"
          Invoke-WebRequest -Uri $protocUrl -OutFile "$env:RUNNER_TEMP\$protocZip"
          Expand-Archive -Path "$env:RUNNER_TEMP\$protocZip" -DestinationPath $protocPath
          echo "$protocPath\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

      - run: make lint

  build-and-test:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
          - os: ubuntu-latest
          - os: windows-latest
    name: build and test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7

      - name: Free disk space (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo rm -rf /usr/local/.ghcup /usr/share/dotnet /usr/local/lib/android \
                      /opt/ghc /opt/hostedtoolcache/CodeQL
          df -h

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@v0.0.10

      - name: Setup toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: stable

      - name: Configure sccache
        run: |
          echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
        shell: bash

      - name: Cache Cargo registry
        uses: actions/cache@v6
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Install protoc (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Install protoc (macOS)
        if: matrix.os == 'macos-latest'
        run: |
          brew install protobuf

      - name: Install protoc (Windows)
        if: matrix.os == 'windows-latest'
        run: |
          $protocVersion = "27.1"
          $protocZip = "protoc-$protocVersion-win64.zip"
          $protocUrl = "https://github.com/protocolbuffers/protobuf/releases/download/v$protocVersion/$protocZip"
          $protocPath = "$env:RUNNER_TEMP\protoc"
          Invoke-WebRequest -Uri $protocUrl -OutFile "$env:RUNNER_TEMP\$protocZip"
          Expand-Archive -Path "$env:RUNNER_TEMP\$protocZip" -DestinationPath $protocPath
          echo "$protocPath\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

      - name: Build
        run: make build

      - name: Run Unit Test with retry
        uses: nick-fields/retry@v4
        with:
          timeout_minutes: 30
          max_attempts: 2
          command: bash -o pipefail -c "make test 2>&1 | tee cargo-test.log"

      - name: Upload test results on failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: test-results-${{ matrix.os }}
          retention-days: 7
          path: |
            cargo-test.log

  # Integration tests (Python) only on ubuntu
  integration-test:
    name: integration test
    runs-on: ubuntu-latest
    needs: [build-and-test]
    steps:
      - uses: actions/checkout@v7

      - name: Setup toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: stable

      - name: Cache Cargo registry
        uses: actions/cache@v6
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Build project
        run: make build

      - name: Setup Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.x'

      - name: Install Python dependencies
        run: make -C tests install-deps

      - name: Run integration tests
        run: bash tests/run_python_integration.sh

  sanitizers:
    name: Sanitizers (${{ matrix.sanitizer }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        sanitizer: [address, leak, thread]
    steps:
      - uses: actions/checkout@v7

      - name: Setup Rust nightly with sanitizer support
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: nightly
          components: rust-src

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Run tests with ${{ matrix.sanitizer }} sanitizer
        env:
          RUSTFLAGS: "-Z sanitizer=${{ matrix.sanitizer }}"
          RUSTDOCFLAGS: "-Z sanitizer=${{ matrix.sanitizer }}"
          # AddressSanitizer enables leak detection by default. Leak checks run in
          # the dedicated leak sanitizer job, where third-party suppressions are
          # applied explicitly.
          ASAN_OPTIONS: "detect_leaks=0"
          LSAN_OPTIONS: "suppressions=${{ github.workspace }}/.github/lsan.supp"
          TSAN_OPTIONS: "suppressions=${{ github.workspace }}/.github/tsan.supp"
        run: |
          set -o pipefail
          if [[ "${{ matrix.sanitizer }}" == "leak" || "${{ matrix.sanitizer }}" == "thread" ]]; then
            # RocksDB/libstdc++ trigger sanitizer reports and timing instability
            # in storage integration test binaries. The net crate's end-to-end
            # storage command tests also spin up a real RocksDB-backed stack, so
            # skip them under LSan/TSan for the same reason. Keep LSan/TSan on
            # the rest of the workspace and storage unit tests; regular tests and
            # ASan still cover the RocksDB-backed integration tests.
            {
              cargo +nightly test -Z build-std --target x86_64-unknown-linux-gnu \
                --workspace --exclude storage \
                -- --skip cursor_snapshot_roundtrip \
                --skip install_snapshot_with_existing_data \
                --skip install_snapshot_rearms_append_log_hook \
                --skip test_snapshot_with_logindex_state \
                --skip test_on_binlog_write_updates_collector \
                --skip test_collector_state_export_restore \
                --skip storage_command_e2e_
              cargo +nightly test -Z build-std --target x86_64-unknown-linux-gnu \
                -p storage --lib
            } 2>&1 | tee sanitizer.log
          else
            cargo +nightly test -Z build-std --target x86_64-unknown-linux-gnu 2>&1 | tee sanitizer.log
          fi

      - name: Upload results on failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: sanitizer-${{ matrix.sanitizer }}-results
          retention-days: 7
          path: sanitizer.log

  docker-build:
    name: Docker Build Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          load: true
          tags: kiwi:test
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Test Docker image
        run: |
          docker run --rm kiwi:test kiwi --version

  static-analysis:
    name: Static Analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Setup toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: stable

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Security audit
        run: cargo audit