ci.yml

name: CI

# Continuous integration for every push to `main` and every pull request.
#
# This is the day-to-day quality gate (the `publish.yml` workflow only fires on
# `v*` tags). It enforces formatting, lints, docs, the test suite, AND a
# **line-coverage floor of 80%** measured with `cargo llvm-cov`. A change that
# drops line coverage below 80% fails the build.
#
# Flaky-test management (#489): the test suite runs under `cargo nextest` with
# `--retries 2` so a test that fails then passes on retry is reported as FLAKY
# (surfaced in the run output / JUnit) rather than silently green or blocking
# the merge on transient flakiness. Coverage instrumentation still runs via
# `cargo llvm-cov nextest` so the 80% floor is measured the same way.
#
# Coverage notes:
# - Measured against the production-shaped **default** feature set
#   (`native-tls,relay,erlay,compact-blocks,dandelion`). The `tor` and `rustls`
#   features are opt-in and pull heavy / alternate-TLS dependencies, so they are
#   not part of the coverage gate (their cfg-gated code is excluded from the
#   default-feature report rather than counted as "uncovered").
# - `vendor/` (the patched chia-protocol / chia-sdk-client / native-tls crates)
#   is excluded via `--ignore-filename-regex` — we only gate on our own `src/`.
# - Integration tests bind loopback TLS listeners; they run single-threaded
#   (`--test-threads=1`) to match `publish.yml` and avoid port/handshake races.

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always

permissions:
  contents: read

jobs:
  lint:
    name: Format, Clippy & Docs
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          components: rustfmt, clippy

      - name: Cache dependencies
        uses: Swatinem/rust-cache@v2

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Check clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Check documentation
        run: cargo doc --no-deps --all-features

  lock:
    name: Cargo.lock in sync
    # The version-drift guard (#1885). A PR that bumps Cargo.toml without re-locking leaves the
    # lock's own entry for this crate behind, and `--locked` then fails for everyone — CI, a
    # contributor on a clean checkout, and every consumer that resolves dig-gossip by git rev
    # (this crate is git-dep'd, not on crates.io, so its lock is what consumers resolve against).
    # `cargo metadata --locked` fails whenever the lock is not already a valid solution for the
    # manifests, which is exactly that drift — and it needs no build, so it reports in seconds.
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Verify Cargo.lock matches Cargo.toml
        run: cargo metadata --locked --format-version 1 > /dev/null

  rustls-tests:
    name: rustls inbound tests (Linux, #1371)
    # The coverage job above measures the native-tls default feature set; the rustls inbound
    # acceptor (#1371) is cfg-gated out of it. This job runs the rustls-feature test suite on Linux
    # so the OpenSSL/Linux inbound cert-capture regression test actually executes on every PR.
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Cache dependencies
        uses: Swatinem/rust-cache@v2

      - name: Run rustls-feature library tests
        # `--lib` only: the integration-test binaries under `tests/` (con_001/con_002/…) are
        # `required-features = ["native-tls"]` and are covered by the native-tls coverage job. The
        # rustls inbound acceptor's regression test (#1371) lives in `src/connection/rustls_inbound.rs`
        # and runs here so the OpenSSL/Linux cert-capture path is exercised on every PR.
        run: >-
          cargo test
          --locked
          --no-default-features
          --features rustls,relay,erlay,compact-blocks,dandelion
          --lib
          --
          --test-threads=1

  coverage:
    name: Test Suite + Coverage (>=80%)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          components: llvm-tools-preview

      - name: Cache dependencies
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov

      - name: Install cargo-nextest
        uses: taiki-e/install-action@nextest

      - name: Run tests with coverage and enforce >=80% line coverage
        run: >-
          cargo llvm-cov nextest
          --locked
          --no-default-features
          --features native-tls,relay,erlay,compact-blocks,dandelion
          --ignore-filename-regex 'vendor/'
          --fail-under-lines 80
          --lcov --output-path lcov.info
          --test-threads=1
          --retries 2

      - name: Coverage summary
        if: always()
        run: >-
          cargo llvm-cov report
          --ignore-filename-regex 'vendor/'

      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: lcov.info
          path: lcov.info
          if-no-files-found: ignore