QA.yaml

name: QA

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Run tests
        run: cargo test --verbose

  lint:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      - uses: Swatinem/rust-cache@v2
      - name: Check formatting
        run: cargo fmt --check
      - name: Run clippy
        run: cargo clippy -- -D warnings

  build:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Build
        run: cargo build --verbose
      - name: Build release
        run: cargo build --release --verbose

  # SCA: Dependency vulnerability scanning
  security-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Cache cargo-audit
        uses: actions/cache@v5
        id: cache-audit
        with:
          path: ~/.cargo/bin/cargo-audit
          key: cargo-audit-0.21
      - name: Install cargo-audit
        if: steps.cache-audit.outputs.cache-hit != 'true'
        run: cargo install cargo-audit --locked
      - name: Run security audit
        run: cargo audit --deny warnings

  # Secrets scanning
  secrets-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Run gitleaks
        uses: gitleaks/gitleaks-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

  # License and supply chain compliance
  dependency-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Cache cargo-deny
        uses: actions/cache@v5
        id: cache-deny
        with:
          path: ~/.cargo/bin/cargo-deny
          key: cargo-deny-0.18
      - name: Install cargo-deny
        if: steps.cache-deny.outputs.cache-hit != 'true'
        run: cargo install cargo-deny --locked
      - name: Check dependencies
        run: cargo deny check