build.yml

name: Build

on:
  schedule:
    - cron: "0 0 1 * *" # First day of every month
  push:
    paths-ignore:
      - changelog
    branches-ignore:
      - main
  workflow_dispatch:
  pull_request:
env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  RUSTDOCFLAGS: "--deny warnings"
  MINIMUM_SUPPORTED_RUST_VERSION: 1.85.0
  RUST_CHANNEL: stable

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    name: Check
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - name: Install Rust
        run: |
          rustup update --no-self-update ${RUST_CHANNEL}
          rustup component add --toolchain ${RUST_CHANNEL} cargo
          rustup default ${RUST_CHANNEL}
        env:
          RUST_CHANNEL: ${{ env.RUST_CHANNEL }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
        with:
          cache-all-crates: true
      - name: Run cargo check
        run: cargo check --locked

  hack:
    name: Cargo hack
    needs: check
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - name: Install Rust
        run: |
          rustup update --no-self-update ${RUST_CHANNEL}
          rustup component add --toolchain ${RUST_CHANNEL} rustfmt rust-src
          rustup default ${RUST_CHANNEL}
        env:
          RUST_CHANNEL: ${{ env.RUST_CHANNEL }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
      - uses: taiki-e/install-action@9c2513f9f4b233b22bd50555b872dc29d48bf3a8
        with:
          tool: cargo-hack
      - run: sudo apt-get update && sudo apt-get install -y libcurl4-openssl-dev
      - run: cargo hack check --feature-powerset --no-dev-deps

  build:
    name: Build w/o features
    needs: check
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      matrix:
        rust:
          - stable
          - beta
          - nightly
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - run: |
          rustup update --no-self-update ${{ matrix.rust }}
          rustup default ${{ matrix.rust }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
      - name: Run cargo build
        run: cargo build

  build-for-targets:
    name: Build for targets
    needs: check
    runs-on: ${{ matrix.platforms.os }}
    continue-on-error: true
    permissions:
      contents: read
    strategy:
      matrix:
        platforms:
          - os: macos-15
            target: aarch64-apple-darwin
            features: "--features gssapi-vendored,libz-static,ssl-vendored"
          - os: macos-15-intel
            target: x86_64-apple-darwin
            features: "--features gssapi-vendored,libz-static,ssl-vendored"
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            features: "--features gssapi-vendored,libz-static,ssl-vendored"
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            features: "--features gssapi-vendored,libz-static,ssl-vendored"
          - os: windows-latest
            target: x86_64-pc-windows-gnu
            features: "--no-default-features"
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            features: "--no-default-features --features ssl-vendored,libz-static"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - uses: houseabsolute/actions-rust-cross@576730dbfbb705690d43bd285987a3094fd84874
        with:
          target: ${{ matrix.platforms.target }}
          args: "--locked ${{ matrix.platforms.features }}"
          strip: true

  lockfile:
    name: Lockfile
    needs: check
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: ${{ github.actor != 'dependabot[bot]' }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - name: Install Rust
        run: |
          rustup update --no-self-update ${RUST_CHANNEL}
          rustup component add --toolchain ${RUST_CHANNEL} cargo
          rustup default ${RUST_CHANNEL}
        env:
          RUST_CHANNEL: ${{ env.RUST_CHANNEL }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
      - name: Check lockfile is updated
        run: cargo update --locked

  clippy:
    needs: check
    name: Clippy
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - name: Install Rust
        run: |
          rustup update --no-self-update ${RUST_CHANNEL}
          rustup component add --toolchain ${RUST_CHANNEL} cargo
          rustup default ${RUST_CHANNEL}
        env:
          RUST_CHANNEL: ${{ env.RUST_CHANNEL }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
      - name: Run cargo clippy
        run: cargo clippy --all-targets --all-features -- --deny warnings

  license:
    needs: check
    name: License
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - name: Install Rust
        run: |
          rustup update --no-self-update ${RUST_CHANNEL}
          rustup component add --toolchain ${RUST_CHANNEL} cargo
          rustup default ${RUST_CHANNEL}
        env:
          RUST_CHANNEL: ${{ env.RUST_CHANNEL }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
      - name: Install git-cliff
        run: cargo install --locked cargo-deny
      - name: Run cargo deny
        run: cargo deny check licenses

  format:
    needs: check
    name: Format
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - name: Install Rust
        run: |
          rustup update --no-self-update ${RUST_CHANNEL}
          rustup component add --toolchain ${RUST_CHANNEL} cargo
          rustup default ${RUST_CHANNEL}
        env:
          RUST_CHANNEL: ${{ env.RUST_CHANNEL }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
      - name: Run cargo fmt
        run: cargo fmt --all -- --check

  unused-dependencies:
    needs: check
    name: Unused dependencies
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - uses: bnjbvr/cargo-machete@b81ce1560c5fbd0210cb66d88bf210329ff04266

  tests:
    needs: check
    name: Tests
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - name: Install Rust
        run: |
          rustup update --no-self-update ${RUST_CHANNEL}
          rustup component add --toolchain ${RUST_CHANNEL} cargo
          rustup default ${RUST_CHANNEL}
        env:
          RUST_CHANNEL: ${{ env.RUST_CHANNEL }}
      - run: cargo install cargo-nextest --locked
      - run: cargo nextest run --locked
        env:
          RUST_BACKTRACE: full
          CI: "true"

  doc:
    needs: check
    name: Documentation
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - name: Install Rust
        run: |
          rustup update --no-self-update ${RUST_CHANNEL}
          rustup component add --toolchain ${RUST_CHANNEL} cargo
          rustup default ${RUST_CHANNEL}
        env:
          RUST_CHANNEL: ${{ env.RUST_CHANNEL }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
      - name: Build documentation
        run: cargo doc --no-deps --document-private-items --verbose
      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
        with:
          node-version: 24
          cache-dependency-path: docs/package-lock.json
          cache: npm
      - name: Install dependencies
        run: npm install --prefix docs
      - name: Build with VitePress
        run: npm run build --prefix docs

  shear:
    name: Shear
    runs-on: ubuntu-latest
    needs: [check]
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - run: cargo install --locked cargo-shear
      - name: Run cargo Shear
        run: cargo shear

  lychee:
    name: Lychee
    runs-on: ubuntu-latest
    needs: [check]
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411
        name: Link Checker
        # https://github.com/lycheeverse/lychee/issues/1405
        with:
          args: --accept '100..=103,200..=299,429' --exclude-loopback README.md './crates/app/README.md' './crates/command/README.md' './docs' './crates/lib/README.md' './crates/wasm-types/README.md' './crates/bin/src/**' './crates/app/src/**' './crates/command/src/**' './crates/lib/src/**' './crates/wasm-types/src/**' './docs/**' --exclude-path './docs/url-templates/index.md' --exclude-path './docs/node_modules' --exclude-path './docs/schema-registry/index.md' --exclude-path './docs/what-is-yozefu/index.md'  --exclude 'https://docs.rs'

  # https://docs.github.com/en/actions/use-cases-and-examples/publishing-packages/publishing-docker-images
  docker:
    name: Docker image
    runs-on: ubuntu-latest
    needs: [check]
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
      - name: Build
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
        with:
          context: .
          push: false
          cache-from: type=gha
          cache-to: type=gha,mode=max

  typos:
    name: Typos
    runs-on: ubuntu-latest
    needs: [check]
    permissions:
      contents: read
    steps:
      - name: Checkout Actions Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - name: Check spelling of the project
        uses: crate-ci/typos@02ea592e44b3a53c302f697cddca7641cd051c3d

  cargo-deny:
    name: Cargo deny
    runs-on: ubuntu-latest
    permissions:
      contents: read
    needs: [check]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979

  # https://github.com/orhun/PKGBUILDs/tree/master/yozefu
  archlinux:
    name: Arch Linux
    runs-on: ubuntu-latest
    permissions:
      contents: read
    container:
      image: index.docker.io/library/archlinux@sha256:9a72b5e3c1675683016cb065f513deea7c65836cb5bd22b88c89353098faa40f
      volumes:
        - /tmp/yozefu-read-only:/tmp/yozefu-readonly:ro
    needs: [check]
    steps:
      - name: Checkout Actions Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - name: Install dependencies
        run: pacman -Sy --noconfirm --needed cargo devtools gcc-libs openssl cmake gcc clang base-devel
      # - name: Use GCC 14 
      #   # Because https://github.com/MaterializeInc/rust-krb5-src/issues/28
      #   run: |
      #     ln -s "$(which gcc-14)" "/usr/local/bin/gcc"
      #     ln -s "$(which g++-14)" "/usr/local/bin/g++"
      #     hash -r
      - name: Cargo build
        run: cargo build --all-features --locked
      - name: Cargo test
        run: cargo test --all-features --locked

  nix:
    name: Nix
    needs: check
    runs-on: ${{ matrix.platforms.os }}
    continue-on-error: true
    permissions:
      contents: read
    strategy:
      matrix:
        platforms:
          - os: macos-15
            target: aarch64-apple-darwin
          - os: macos-15-large
            target: x86_64-apple-darwin
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - run: nix build