nightly.yml

name: Nightly

on:
  schedule:
    - cron: "0 3 * * *"
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

jobs:
  mutants:
    name: Mutation Testing
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@0f1b44df7e9cbb178d781a242338dfa5e243ad7f # nightly
      - uses: taiki-e/install-action@328a871ad8f62ecac78390391f463ccabc974b72 # v2
        with:
          tool: cargo-mutants
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Run mutant testing
        run: cargo +nightly mutants --timeout 60 -- --all-features
        continue-on-error: true
      - name: Mutants Summary
        if: always()
        run: |
          echo "## Mutation Testing Results" >> "$GITHUB_STEP_SUMMARY"
          if [ -f mutants.out/caught.txt ]; then
            echo "Caught: $(wc -l < mutants.out/caught.txt)" >> "$GITHUB_STEP_SUMMARY"
          fi
          if [ -f mutants.out/missed.txt ]; then
            echo "Missed: $(wc -l < mutants.out/missed.txt)" >> "$GITHUB_STEP_SUMMARY"
          fi
      - name: Upload mutants report
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: mutants-report
          path: mutants.out/

  miri-extended:
    name: Miri Extended
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@0f1b44df7e9cbb178d781a242338dfa5e243ad7f # nightly
        with:
          components: miri
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Miri with stacked borrows
        run: cargo +nightly miri test -p mantis-queue --lib --all-features
        env:
          MIRIFLAGS: -Zmiri-strict-provenance -Zmiri-symbolic-alignment-check
      - name: Miri with tree borrows
        run: cargo +nightly miri test -p mantis-queue --lib --all-features
        env:
          MIRIFLAGS: -Zmiri-tree-borrows -Zmiri-strict-provenance

  coverage-full:
    name: Full Coverage Report
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@0f1b44df7e9cbb178d781a242338dfa5e243ad7f # nightly
        with:
          components: llvm-tools-preview
      - uses: taiki-e/install-action@328a871ad8f62ecac78390391f463ccabc974b72 # v2
        with:
          tool: cargo-llvm-cov
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - run: cargo +nightly llvm-cov --all-features --branch --html
      - name: Upload coverage report
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: coverage-html
          path: target/llvm-cov/html/

  asm-check:
    name: ASM Toggle (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@0f1b44df7e9cbb178d781a242338dfa5e243ad7f # nightly
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Test with default features
        run: cargo +nightly test --all-features
      - name: Test with no default features
        run: cargo +nightly test -p mantis-core -p mantis-types -p mantis-queue --no-default-features
      - name: Install cargo-show-asm
        uses: taiki-e/install-action@328a871ad8f62ecac78390391f463ccabc974b72 # v2
        with:
          tool: cargo-show-asm
      - name: Run ASM inspection
        run: ./scripts/check-asm.sh
      - name: Upload ASM artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: asm-output-${{ matrix.os }}
          path: target/asm/
          retention-days: 30

  kani:
    name: Kani Proofs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - name: Install Kani
        run: |
          cargo install --locked kani-verifier
          cargo kani setup
      - name: Run proofs
        run: |
          set -o pipefail
          cargo kani -p mantis-verify 2>&1 | tee kani-output.txt
      - name: Kani Summary
        if: always()
        run: |
          echo "## Kani Proof Results" >> "$GITHUB_STEP_SUMMARY"
          grep -E "(VERIFIED|FAILED|harness|error)" kani-output.txt >> "$GITHUB_STEP_SUMMARY" || true
      - name: Upload proof output
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: kani-proofs
          path: kani-output.txt

  fuzz:
    name: Fuzz Testing
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@0f1b44df7e9cbb178d781a242338dfa5e243ad7f # nightly
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Install cargo-fuzz
        uses: taiki-e/install-action@328a871ad8f62ecac78390391f463ccabc974b72 # v2
        with:
          tool: cargo-fuzz
      - name: Run fuzz targets
        run: |
          for target in $(cargo +nightly fuzz list 2>/dev/null || true); do
            echo "Fuzzing: $target (10 min)"
            cargo +nightly fuzz run "$target" -- -max_total_time=600 || true
          done
        continue-on-error: true
      - name: Upload corpus
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: fuzz-corpus
          path: fuzz/corpus/
          retention-days: 90
      - name: Upload crashes
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: failure()
        with:
          name: fuzz-crashes
          path: fuzz/artifacts/
      - name: Fuzz Summary
        if: always()
        run: |
          echo "## Fuzz Results" >> "$GITHUB_STEP_SUMMARY"
          echo "Duration: 10 minutes per target" >> "$GITHUB_STEP_SUMMARY"
          echo "Corpus size: $(find fuzz/corpus -type f 2>/dev/null | wc -l) inputs" >> "$GITHUB_STEP_SUMMARY"