ci.yaml

---
name: CI
on:
  pull_request:
    branches:
      - main
    types:
      - opened
      - synchronize
      - reopened
      - ready_for_review
    paths-ignore:
      - docs/**
      - .gitignore
      - .claude/**
  push:
    branches:
      - main
    paths-ignore:
      - docs/**
      - "**.md"
      - .claude/**
# run concurrency group for the workflow
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  changed_files:
    if: ${{ github.event.pull_request.draft == false }}
    runs-on: ubuntu-latest
    name: Test changed-files
    outputs:
      changed-rust-files: ${{ steps.changed-files-yaml.outputs.code_any_changed }}
      changed-lockfile-files: ${{ steps.changed-files-yaml.outputs.lockfile_any_changed }}
      changed-docker-files: ${{ steps.changed-files-yaml.outputs.docker_any_changed }}
      changed-tests-files: ${{ steps.changed-files-yaml.outputs.tests_any_changed }}
    steps:
      # Checkout the repository
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit
      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get changed files
        id: changed-files-yaml
        uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5
        with:
          files_yaml: |
            code:
              - '**/*.rs'
              - 'rustfmt.toml'
              - 'rust-toolchain.toml'
            lockfile:
              - 'Cargo.lock'
              - 'Cargo.toml'
            docker:
              - 'Dockerfile.development'
              - 'Dockerfile.production'
              - 'docker-compose.yml'
              - 'Cargo.lock'
              - 'Cargo.toml'
            tests:
              - '**/*.rs'
              - tests/**/*.json
  ci:
    # `always()` so this rollup runs even when its needs skip (e.g. on PRs
    # that touch no Rust files). Without it the job itself skips, and the
    # repo ruleset's required "CI" check waits forever for `success`.
    if: ${{ always() && (github.event_name == 'push' || (github.event.pull_request && github.event.pull_request.draft == false)) }}
    permissions:
      contents: none
    name: CI
    needs:
      - msrv
      - rustfmt
      - clippy
      - test
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit
      - name: Failed
        run: exit 1
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
  msrv:
    if: ${{ github.event.pull_request.draft == false && github.event_name != 'push' && (needs.changed_files.outputs.changed-rust-files == 'true' || needs.changed_files.outputs.changed-lockfile-files == 'true') }}
    runs-on: ubuntu-latest
    needs: changed_files
    steps:
      # Checkout the repository
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit
      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Prepare
        id: init
        uses: ./.github/actions/prepare

      # Get the output of the prepare composite action
      - name: Get cache-hit output
        run: 'echo "Cache hit >>>>>: ${{ steps.init.outputs.cache-hit }}"'
      - name: Install cargo hack
        uses: taiki-e/install-action@7689010b667477e55299b24c373cdf719c945fdf # cargo-hack

      # Check the minimum supported Rust version
      - name: Default features
        run: cargo hack check --feature-powerset --locked --rust-version --all-targets
  rustfmt:
    if: ${{ github.event.pull_request.draft == false && github.event_name != 'push' && needs.changed_files.outputs.changed-rust-files == 'true' }}
    needs: changed_files
    runs-on: ubuntu-latest
    steps:
      # Checkout the repository
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit
      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Prepare
        id: init
        uses: ./.github/actions/prepare

      # Get the output of the prepare composite action
      - name: Get cache-hit output
        run: 'echo "Cache hit >>>>>: ${{ steps.init.outputs.cache-hit }}"'

      # Check the formatting of the code
      - name: Check formatting
        run: cargo fmt --all -- --check
  clippy:
    if: ${{ github.event.pull_request.draft == false && github.event_name != 'push' && needs.changed_files.outputs.changed-rust-files == 'true' }}
    needs: changed_files
    runs-on: ubuntu-latest
    steps:
      # Checkout the repository
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit
      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Prepare
        id: init
        uses: ./.github/actions/prepare

      # Get the output of the prepare composite action
      - name: Get cache-hit output
        run: 'echo "Cache hit >>>>>: ${{ steps.init.outputs.cache-hit }}"'
      - name: Install SARIF tools
        run: cargo install clippy-sarif --locked
      - name: Install SARIF tools
        run: cargo install sarif-fmt --locked
      - name: Check
        run: >
          cargo clippy --all-features --all-targets --message-format=json
          | clippy-sarif
          | tee clippy-results.sarif
          | sarif-fmt
        continue-on-error: true
      - name: Report status
        run: cargo clippy --all-features --all-targets -- -D warnings --allow deprecated
  test:
    if: ${{ github.event.pull_request.draft == false && needs.changed_files.outputs.changed-tests-files == 'true' }}
    permissions:
      contents: read
    needs:
      - changed_files
    runs-on: ubuntu-latest
    timeout-minutes: 25
    services:
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 10
    env:
      REDIS_URL: redis://127.0.0.1:6379
    steps:
      # Checkout the repository
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit
      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "20"
      - name: Prepare
        id: init
        uses: ./.github/actions/prepare
        with:
          components: llvm-tools-preview

      # Get the output of the prepare composite action
      - name: Get cache-hit output
        run: 'echo "Cache hit >>>>>: ${{ steps.init.outputs.cache-hit }}"'
      - name: Install cargo hack
        uses: taiki-e/install-action@7689010b667477e55299b24c373cdf719c945fdf # cargo-hack
      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@16edcff251c6bb06f6878981359f84b77b28e7e2 # cargo-llvm-cov
      - name: Build
        run: cargo test --no-run --locked

      # Unit tests coverage
      - name: Run Unit Tests and Generate Coverage Report
        env:
          RUST_TEST_THREADS: 1
        run: cargo llvm-cov --locked --workspace --exclude solver-e2e-tests --lcov --output-path unit-lcov.info

      # Upload unit coverage
      - name: Upload Unit Coverage to Codecov
        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          name: unit-coverage
          files: unit-lcov.info
          flags: unittests
          fail_ci_if_error: false