ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main
      - master
  workflow_dispatch:
  workflow_call:
    inputs:
      run_semver:
        description: Run the public API compatibility check for this invocation
        required: false
        default: false
        type: boolean

permissions:
  contents: read
  packages: read

env:
  CARGO_TERM_COLOR: always
  HUBUUM_TARGET_SERVER_VERSION: "0.0.9"
  HUBUUM_TARGET_SERVER_IMAGE: ghcr.io/hubuum/hubuum-server@sha256:1f12baf882b6d3df5b4b2dbdf26aad0793274e57f86a2c186b8e1e68632db5db

jobs:
  quality:
    name: Formatting, Lints, and Docs
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt

      - name: Cache Cargo Artifacts
        uses: Swatinem/rust-cache@v2

      - name: Test Release Provenance Guard
        run: ./scripts/test-release-provenance.sh

      - name: Check Formatting
        run: cargo fmt --all -- --check

      - name: Check Generated Resource Code
        run: cargo run -p hubuum_reconcile --locked -- check

      - name: Run Clippy
        run: cargo clippy --workspace --all-targets --all-features -- -D warnings

      - name: Build Documentation
        run: cargo doc --workspace --all-features --no-deps
        env:
          RUSTDOCFLAGS: -D warnings

      - name: Validate Pinned OpenAPI Contract
        run: python3 scripts/openapi-contract.py validate

      - name: Test GitHub Release Helpers
        run: ./scripts/test-github-release.sh

  test:
    name: Unit, Behavior, and Compile Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo Artifacts
        uses: Swatinem/rust-cache@v2

      - name: Run Full Test Suite
        run: cargo test --workspace --all-features --locked

  features:
    name: Feature Set (${{ matrix.name }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: no-client
            flags: --no-default-features
          - name: async
            flags: --no-default-features --features async
          - name: blocking
            flags: --no-default-features --features blocking
          - name: async-typed
            flags: --no-default-features --features async,typed-schemas
          - name: blocking-typed
            flags: --no-default-features --features blocking,typed-schemas
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo Artifacts
        uses: Swatinem/rust-cache@v2

      - name: Check Feature Set
        run: cargo check -p hubuum_client --locked ${{ matrix.flags }}

  msrv:
    # Keep this check name stable because the main-branch ruleset requires it.
    name: MSRV
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust 1.88
        uses: dtolnay/rust-toolchain@1.88

      - name: Cache Cargo Artifacts
        uses: Swatinem/rust-cache@v2
        with:
          key: msrv

      - name: Check Workspace at MSRV
        run: cargo check --workspace --all-targets --all-features --locked

  server-contract:
    # Keep this check name stable because the main-branch ruleset requires it.
    name: OpenAPI Drift
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Compare with Target Server OpenAPI
        run: python3 scripts/openapi-contract.py check

  supply-chain:
    name: Supply Chain
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Audit Published Advisories
        # Node 24 support is on RustSec's default branch but not yet tagged.
        uses: rustsec/audit-check@858dc40f52ca2b8570b7a997c1c4e35c6fc9a432
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Check Licenses, Bans, and Sources
        uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check bans licenses sources
          rust-version: 1.88

  semver:
    name: Public API Compatibility
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' || inputs.run_semver
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Check SemVer
        uses: obi1kenobi/cargo-semver-checks-action@v2
        with:
          feature-group: all-features

  integration:
    name: Integration Tests (Pinned Server)
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo Artifacts
        uses: Swatinem/rust-cache@v2

      - name: Authenticate to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME || github.actor }}
          password: ${{ secrets.GHCR_TOKEN || secrets.GITHUB_TOKEN }}

      - name: Run Integration Test Suite
        run: ./scripts/run-integration-tests.sh --with-e2e-client -- --test-threads=1
        env:
          HUBUUM_INTEGRATION_SERVER_IMAGE: ${{ env.HUBUUM_TARGET_SERVER_IMAGE }}