ci.yml

# SPDX-License-Identifier: GPL-3.0-or-later
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"
  # Pin the toolchain so CI matches local dev (no rustup here — the dev box is
  # Nix-pinned at this version) and clippy/rustfmt can't drift ahead on the
  # runner. Keep in sync with rust-toolchain.toml; bump both together.
  RUST_TOOLCHAIN: "1.95.0"

jobs:
  fmt:
    name: rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --workspace --all-targets --all-features -- -D warnings

  test:
    name: test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --workspace --all-targets
      - run: cargo test --workspace --all-targets

  headless:
    name: headless build (no TUI / clipboard deps)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - uses: Swatinem/rust-cache@v2
      # PRD G6: the server install path must keep building — the CLI behind
      # its `cli` feature gate, and the agent without the clipboard's
      # X11/Wayland dependency tree.
      - run: cargo build -p vault-cli --no-default-features --features cli
      - run: cargo build -p vault-agent --no-default-features

  version-gate:
    name: vault --version emits §13.2 attribution
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --bin vault --release
      - name: Verify attribution block
        run: |
          out=$(./target/release/vault --version)
          echo "$out"
          echo "$out" | grep -q "Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org>" \
            && echo "$out" | grep -q "GPL-3.0-or-later" \
            && echo "$out" | grep -q "https://Vault.SpacecraftSoftware.org/"

  audit:
    name: cargo-audit
    runs-on: ubuntu-latest
    # audit-check posts findings as a check run — needs checks:write. Job-level
    # permissions replace the default set, so contents:read is restated for
    # checkout.
    permissions:
      contents: read
      checks: write
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # Build-time / transitive advisories from the ratatui TUI tree, kept in
          # lock-step with deny.toml's policy (see that file for the paste
          # rationale). Both are informational (no fix that doesn't mean dropping
          # ratatui); revisit when ratatui's tree updates.
          #   RUSTSEC-2024-0436 — paste (unmaintained, build-time proc-macro)
          #   RUSTSEC-2026-0002 — lru 0.12.5 (unsound IterMut; transitive via ratatui)
          ignore: RUSTSEC-2024-0436,RUSTSEC-2026-0002

  deny:
    name: cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: EmbarkStudios/cargo-deny-action@v2

  # REUSE (§4.3): every file has license + copyright info (via REUSE.toml) and
  # the license texts live in LICENSES/. Python tool, independent of the pinned
  # Rust toolchain.
  reuse:
    name: REUSE lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-python@v5
        with:
          python-version: "3.x"
      - run: pip install reuse
      - run: reuse lint