ci.yml

# SPDX-License-Identifier: GPL-3.0-or-later
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"
  # Pin the toolchain so CI matches local dev (no rustup here — the dev box is
  # Nix-pinned at this version) and clippy/rustfmt can't drift ahead on the
  # runner. Keep in sync with rust-toolchain.toml; bump both together.
  RUST_TOOLCHAIN: "1.95.0"

jobs:
  fmt:
    name: rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --workspace --all-targets --all-features -- -D warnings

  test:
    name: test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --workspace --all-targets
      - run: cargo test --workspace --all-targets

  headless:
    name: headless build (no TUI / clipboard deps)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - uses: Swatinem/rust-cache@v2
      # PRD G6: the server install path must keep building — the CLI behind
      # its `cli` feature gate, and the agent without the clipboard's
      # X11/Wayland dependency tree.
      - run: cargo build -p vault-cli --no-default-features --features cli
      - run: cargo build -p vault-agent --no-default-features

  version-gate:
    name: vault --version emits §13.2 attribution
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --bin vault --release
      - name: Verify attribution block
        run: |
          out=$(./target/release/vault --version)
          echo "$out"
          echo "$out" | grep -q "Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org>" \
            && echo "$out" | grep -q "GPL-3.0-or-later" \
            && echo "$out" | grep -q "https://Vault.SpacecraftSoftware.org/"

  audit:
    name: cargo-audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      # Installed directly (not via rustsec/audit-check@v2) so `--locked` pins
      # cargo-audit to its own committed lockfile. Without it, `cargo install`
      # re-resolves cargo-audit's dependencies fresh on every run, and a
      # transitive bump (e.g. kstring requiring a newer rustc) can outrun the
      # workspace's pinned toolchain even though nothing here changed.
      - run: cargo install cargo-audit --locked
      # --ignore mirrors `just audit`; keep both lists in lock-step.
      #   RUSTSEC-2024-0436 — paste (unmaintained, build-time proc-macro; transitive via ratatui)
      #   RUSTSEC-2026-0002 — lru 0.12.5 (unsound IterMut; transitive via ratatui)
      #   RUSTSEC-2023-0071 — rsa (Marvin timing sidechannel, no upstream fix). rsa unwraps
      #     organization keys (RSA-OAEP) once, locally, at unlock; the attack needs a
      #     network-observable decryption oracle, which Vault never exposes. Revisit if rsa
      #     ships a constant-time fix.
      #   RUSTSEC-2026-0195, RUSTSEC-2026-0194 — quick-xml 0.39.4 (build-time-only proc-macro
      #     dependency of wayland-scanner, itself transitive via arboard's Wayland clipboard
      #     support; parses only the Wayland protocol XML bundled in wayland-scanner at compile
      #     time, never runtime/attacker-controlled input). No newer wayland-scanner release is
      #     resolvable yet under wayland-client's current constraint; revisit when one lands.
      - run: >-
          cargo audit
          --ignore RUSTSEC-2024-0436 --ignore RUSTSEC-2026-0002 --ignore RUSTSEC-2023-0071
          --ignore RUSTSEC-2026-0195 --ignore RUSTSEC-2026-0194

  deny:
    name: cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: EmbarkStudios/cargo-deny-action@v2

  # REUSE (§4.3): every file has license + copyright info (via REUSE.toml) and
  # the license texts live in LICENSES/. Python tool, independent of the pinned
  # Rust toolchain.
  reuse:
    name: REUSE lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-python@v5
        with:
          python-version: "3.x"
      - run: pip install reuse
      - run: reuse lint