ci.yml

name: CI

permissions:
  contents: read

on: [push, pull_request]

env:
  RUST_BACKTRACE: 1
  CARGO_TERM_COLOR: always
  CLICOLOR: 1

jobs:
  ci:
    permissions:
      contents: none
    name: CI
    needs:
      [
        test,
        ui-test,
        msrv,
        docs,
        rustfmt,
        clippy,
        check-usage-docs,
        check-generated,
      ]
    runs-on: ubuntu-latest
    steps:
      - name: Done
        run: exit 0
  test:
    name: Test
    strategy:
      matrix:
        os: ["ubuntu-latest", "windows-latest", "macos-latest"]
        rust: ["stable"]
    continue-on-error: ${{ matrix.rust != 'stable' }}
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Setup pnpm
        # Installs the pnpm CLI tool
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
        with:
          package_json_file: ui/package.json
      - name: Setup Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version-file: ".nvmrc"
          cache: "pnpm"
          cache-dependency-path: ui/pnpm-lock.yaml
      - name: Verify pnpm is available
        run: pnpm --version
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          toolchain: ${{ matrix.rust }}
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Install UI dependencies
        run: pnpm install --frozen-lockfile
        working-directory: ./ui
      - name: Build UI
        run: pnpm build
        working-directory: ./ui
      - name: Build
        # [ToDo LQ] Re-enable --all-features once the issue is resolved in Tantivy (zstd-safe). This is an experimental feature anyway.
        run: cargo test --no-run --workspace
      - name: Default features
        run: cargo test --workspace
      # [ToDo LQ] Re-enable --all-features once the issue is resolved in Tantivy (zstd-safe). This is an experimental feature anyway.
      #      - name: All features
      #        run: cargo test --workspace --all-features
      - name: No-default features
        run: cargo test --workspace --no-default-features
      - name: History check
        run: cargo xtask history
      - name: Schema compat check
        run: cargo xtask schema-compat
  ui-test:
    name: UI Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Setup pnpm
        # Installs the pnpm CLI tool
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
        with:
          package_json_file: ui/package.json
      - name: Setup Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version-file: ".nvmrc"
          cache: "pnpm"
          cache-dependency-path: ui/pnpm-lock.yaml
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          toolchain: "stable"
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Install UI dependencies
        run: pnpm install --frozen-lockfile
        working-directory: ./ui
      - name: Build UI
        # UI assets are embedded into the binary at compile time, so build before cargo.
        run: pnpm build
        working-directory: ./ui
      - name: Build weaver
        # Pre-warm the binary so the Playwright webServer start stays within its timeout.
        run: cargo build
      - name: Install Playwright browser
        run: pnpm exec playwright install --with-deps chromium
        working-directory: ./ui
      - name: Run UI e2e tests
        # Playwright boots `cargo run -- serve` against the fixture registry.
        run: pnpm test:e2e
        working-directory: ./ui
      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: playwright-report
          path: ui/playwright-report/
          retention-days: 7
  msrv:
    name: Check MSRV
    runs-on: ubuntu-latest
    env:
      MSRV: "1.88.0" # MSRV
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Setup pnpm
        # Installs the pnpm CLI tool
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
        with:
          package_json_file: ui/package.json
      - name: Setup Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version-file: ".nvmrc"
          cache: "pnpm"
          cache-dependency-path: ui/pnpm-lock.yaml
      - name: Verify pnpm is available
        run: pnpm --version
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          toolchain: ${{ env.MSRV }}
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      # The intended toolchain is being overridden here by the version defined in rust-toolchain.toml so we need to manually set it back
      - name: Override default toolchain
        run: rustup override set "${{ env.MSRV }}"
      - name: Validate correct toolchain is active
        run: |
          CURRENT_TOOLCHAIN=$(rustup show active-toolchain | awk '{print $1}' | sed 's/-.*//')
          if [ "$CURRENT_TOOLCHAIN" != "${{ env.MSRV }}" ]; then
            echo "Expected active toolchain ${{ env.MSRV }} but got $CURRENT_TOOLCHAIN"
            exit 1
          else
            echo "Correct toolchain $CURRENT_TOOLCHAIN is installed and active"
          fi
      - name: Install UI dependencies
        run: pnpm install --frozen-lockfile
        working-directory: ./ui
      - name: Build UI
        run: pnpm build
        working-directory: ./ui
      - name: Default features
        run: cargo check --workspace --all-targets
      # [ToDo LQ] Re-enable --all-features once the issue is resolved in Tantivy (zstd-safe). This is an experimental feature anyway.
      # - name: All features
      #   run: cargo check --workspace --all-targets --all-features
      - name: No-default features
        run: cargo check --workspace --all-targets --no-default-features
  lockfile:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: "Is lockfile updated?"
        run: cargo fetch --locked
  docs:
    name: Docs
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Setup pnpm
        # Installs the pnpm CLI tool
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
        with:
          package_json_file: ui/package.json
      - name: Setup Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version-file: ".nvmrc"
          cache: "pnpm"
          cache-dependency-path: ui/pnpm-lock.yaml
      - name: Verify pnpm is available
        run: pnpm --version
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Install UI dependencies
        run: pnpm install --frozen-lockfile
        working-directory: ./ui
      - name: Build UI
        run: pnpm build
        working-directory: ./ui
      - name: Check documentation
        env:
          RUSTDOCFLAGS: -D warnings
        # [ToDo LQ] Re-enable --all-features once the issue is resolved in Tantivy (zstd-safe). This is an experimental feature anyway.
        # run: cargo doc --workspace --all-features --no-deps --document-private-items
        run: cargo doc --workspace --no-deps --document-private-items
  rustfmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          # Not MSRV because its harder to jump between versions and people are
          # more likely to have stable
          toolchain: stable
          components: rustfmt
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Check formatting
        run: cargo fmt --all -- --check
  check-external-types:
     name: Check external types
     runs-on: ubuntu-latest
     steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          # cargo check-external-types is only available on this specific nightly
          toolchain: nightly-2026-03-20
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: check-external-types
        run: |
          cargo install cargo-check-external-types
          ./scripts/check_external_types.sh
  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    permissions:
      security-events: write # to upload sarif results
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Setup pnpm
        # Installs the pnpm CLI tool
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
        with:
          package_json_file: ui/package.json
      - name: Setup Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version-file: ".nvmrc"
          cache: "pnpm"
          cache-dependency-path: ui/pnpm-lock.yaml
      - name: Verify pnpm is available
        run: pnpm --version
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          toolchain: "stable"
          components: clippy
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Install SARIF tools
        run: cargo install clippy-sarif --locked
      - name: Install SARIF tools
        run: cargo install sarif-fmt --locked
      - name: Install protoc
        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
      - name: Install UI dependencies
        run: pnpm install --frozen-lockfile
        working-directory: ./ui
      - name: Build UI
        run: pnpm build
        working-directory: ./ui
      - name: Check
        # [workaround] removed --all-features due to an issue in one of the dependency in Tantity (zstd-safe)
        # [ToDo LQ] Re-enable --all-features once the issue is resolved
        run: >
          cargo clippy --workspace --all-targets --message-format=json -- -D warnings --allow deprecated
          | clippy-sarif
          | tee clippy-results.sarif
          | sarif-fmt
        continue-on-error: true
      - name: Upload
        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
        with:
          sarif_file: clippy-results.sarif
          wait-for-processing: true
      - name: Report status
        run: cargo clippy --workspace --all-targets -- -D warnings --allow deprecated
  check-usage-docs:
    name: Check usage docs and schemas
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Setup pnpm
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
        with:
          package_json_file: ui/package.json
      - name: Setup Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version-file: ".nvmrc"
          cache: "pnpm"
          cache-dependency-path: ui/pnpm-lock.yaml
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Install UI dependencies
        run: pnpm install --frozen-lockfile
        working-directory: ./ui
      - name: Build UI
        run: pnpm build
        working-directory: ./ui
      - name: Regenerate usage docs
        run: cargo run -- --quiet markdown-help > /tmp/usage.md
      - name: Regenerate schema files
        run: |
          cargo run -- --quiet registry json-schema -j semconv-definition-v2 -o /tmp/semconv.schema.v2.json
          cargo run -- --quiet registry json-schema -j resolved-registry-v2 -o /tmp/semconv.resolved.v2.json
          cargo run -- --quiet registry json-schema -j materialized-registry-v2 -o /tmp/semconv.materialized.v2.json
          cargo run -- --quiet registry json-schema -j diff-v2 -o /tmp/semconv.diff.v2.json
          cargo run -- --quiet registry json-schema -j policy-finding -o /tmp/policy.finding.json
          cargo run -- --quiet registry json-schema -j publication-manifest-v2 -o /tmp/publication-manifest.v2.json
          cargo run -- --quiet registry json-schema -j definition-manifest-v2 -o /tmp/definition-manifest.v2.json
          cargo run -- --quiet registry json-schema -j weaver-config -o /tmp/weaver-config.json
      - name: Check generated files are up-to-date
        run: |
          failed=0

          check_file() {
            local repo_file="$1"
            local tmp_file="$2"
            local regen_cmd="$3"
            if ! diff -q "$repo_file" "$tmp_file" > /dev/null 2>&1; then
              echo "$repo_file is out of date. Run '$regen_cmd' to regenerate it."
              diff "$repo_file" "$tmp_file"
              failed=1
            fi
          }

          check_file docs/usage.md /tmp/usage.md \
            "cargo run -- --quiet markdown-help > docs/usage.md"
          check_file schemas/semconv.schema.v2.json /tmp/semconv.schema.v2.json \
            "cargo run -- --quiet registry json-schema -j semconv-definition-v2 -o ./schemas/semconv.schema.v2.json"
          check_file schemas/semconv.resolved.v2.json /tmp/semconv.resolved.v2.json \
            "cargo run -- --quiet registry json-schema -j resolved-registry-v2 -o ./schemas/semconv.resolved.v2.json"
          check_file schemas/policy.finding.json /tmp/policy.finding.json \
            "cargo run -- --quiet registry json-schema -j policy-finding -o ./schemas/policy.finding.json"
          check_file schemas/semconv.materialized.v2.json /tmp/semconv.materialized.v2.json \
            "cargo run -- --quiet registry json-schema -j materialized-registry-v2 -o ./schemas/semconv.materialized.v2.json"
          check_file schemas/semconv.diff.v2.json /tmp/semconv.diff.v2.json \
            "cargo run -- --quiet registry json-schema -j diff-v2 -o ./schemas/semconv.diff.v2.json"
          check_file schemas/publication-manifest.v2.json /tmp/publication-manifest.v2.json \
            "cargo run -- --quiet registry json-schema -j publication-manifest-v2 -o ./schemas/publication-manifest.v2.json"
          check_file schemas/definition-manifest.v2.json /tmp/definition-manifest.v2.json \
            "cargo run -- --quiet registry json-schema -j definition-manifest-v2 -o ./schemas/definition-manifest.v2.json"
          check_file schemas/weaver-config.json /tmp/weaver-config.json \
            "cargo run -- --quiet registry json-schema -j weaver-config -o ./schemas/weaver-config.json"

          exit $failed
  check-generated:
    name: Check generated live_check code
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          toolchain: stable
          components: rustfmt
      - name: Regenerate Rust code
        run: >
          docker run --rm
          -u "$(id -u):$(id -g)"
          -e HOME=/tmp
          -v "${{ github.workspace }}":/home/weaver/source
          otel/weaver:v0.24.2
          registry generate
          --registry /home/weaver/source/crates/weaver_live_check/model/
          --templates /home/weaver/source/crates/weaver_live_check/templates/
          --v2 rust
          /home/weaver/source/crates/weaver_live_check/src/
      - name: Regenerate documentation
        run: >
          docker run --rm
          -u "$(id -u):$(id -g)"
          -e HOME=/tmp
          -v "${{ github.workspace }}":/home/weaver/source
          otel/weaver:v0.24.2
          registry generate
          --registry /home/weaver/source/crates/weaver_live_check/model/
          --templates /home/weaver/source/crates/weaver_live_check/templates/
          --v2 markdown
          /home/weaver/source/crates/weaver_live_check/docs/
      - name: Format generated code
        run: cargo fmt -p weaver_live_check
      - name: Check generated files are up-to-date
        run: |
          if ! git diff --exit-code -- \
            crates/weaver_live_check/src/generated/ \
            crates/weaver_live_check/docs/; then
            echo ""
            echo "Generated files are out of date. Run 'just generate' and commit the results."
            exit 1
          fi
  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Install cargo-tarpaulin
        run: cargo install cargo-tarpaulin
      - name: Gather coverage
        run: cargo tarpaulin --workspace --output-dir coverage --out lcov --ignore-tests -e xtask -e weaver -e weaver_macros -e weaver_test_support --exclude-files 'crates/weaver_forge/codegen_examples/expected_codegen/*' 'crates/weaver_live_check/tests/*'
      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: open-telemetry/weaver