rust.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  fmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - name: Check formatting
        run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - features: ""
            name: default
          - features: ttl-nix
            name: ttl-nix
          - features: ttl-pnet
            name: ttl-pnet
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
        with:
          key: clippy-${{ matrix.name }}
      - name: Clippy (${{ matrix.name }})
        run: |
          if [ -n "${{ matrix.features }}" ]; then
            cargo clippy --all --tests --features ${{ matrix.features }} -- -D warnings
          else
            cargo clippy --all --tests -- -D warnings
          fi
        shell: bash

  test:
    name: Test (${{ matrix.os }}, ${{ matrix.rust }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            rust: stable
            features: --all-features
          - os: ubuntu-latest
            rust: beta
            features: --all-features
          - os: macos-latest
            rust: stable
            features: ""
          - os: windows-latest
            rust: stable
            features: ""
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
      - uses: Swatinem/rust-cache@v2
        with:
          key: test-${{ matrix.os }}-${{ matrix.rust }}
      - name: Install Npcap SDK (Windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          Invoke-WebRequest -Uri "https://npcap.com/dist/npcap-sdk-1.13.zip" -OutFile "$env:TEMP/npcap-sdk.zip"
          Expand-Archive -Path "$env:TEMP/npcap-sdk.zip" -DestinationPath "C:/npcap-sdk"
          echo "LIB=C:/npcap-sdk/Lib/x64" >> $env:GITHUB_ENV
      - name: Run tests
        run: cargo test --verbose ${{ matrix.features }}

  test-features:
    name: Test Features
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - features: ""
            name: default
          - features: ttl-nix
            name: ttl-nix
          - features: ttl-pnet
            name: ttl-pnet
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: test-features-${{ matrix.name }}
      - name: Test (${{ matrix.name }})
        run: |
          if [ -n "${{ matrix.features }}" ]; then
            cargo test --verbose --features ${{ matrix.features }}
          else
            cargo test --verbose
          fi
        shell: bash

  build-release:
    name: Build Release (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: macos-latest
            target: x86_64-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-msvc
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          key: release-${{ matrix.target }}
      - name: Install Npcap SDK (Windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          Invoke-WebRequest -Uri "https://npcap.com/dist/npcap-sdk-1.13.zip" -OutFile "$env:TEMP/npcap-sdk.zip"
          Expand-Archive -Path "$env:TEMP/npcap-sdk.zip" -DestinationPath "C:/npcap-sdk"
          echo "LIB=C:/npcap-sdk/Lib/x64" >> $env:GITHUB_ENV
      - name: Build release
        run: cargo build --release --target ${{ matrix.target }}

  msrv:
    name: MSRV Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.93.0
      - uses: Swatinem/rust-cache@v2
        with:
          key: msrv
      - name: Check MSRV
        run: cargo check --all-features

  doc:
    name: Documentation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: doc
      - name: Build documentation
        run: cargo doc --no-deps --all-features
        env:
          RUSTDOCFLAGS: -D warnings

  package-deb:
    name: Package DEB
    runs-on: ubuntu-latest
    needs: [test]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: package-deb
      - name: Build release binary
        run: cargo build --release --all-features
      - name: Build DEB package
        run: |
          PKG_NAME=stamp-suite
          PKG_VERSION=0.5.0
          PKG_DIR="${PKG_NAME}_${PKG_VERSION}-1_amd64"
          mkdir -p "${PKG_DIR}/DEBIAN"
          mkdir -p "${PKG_DIR}/usr/bin"
          mkdir -p "${PKG_DIR}/lib/systemd/system"
          mkdir -p "${PKG_DIR}/usr/share/snmp/mibs"
          mkdir -p "${PKG_DIR}/usr/share/doc/${PKG_NAME}"
          # Control file
          cat > "${PKG_DIR}/DEBIAN/control" <<EOF
          Package: ${PKG_NAME}
          Version: ${PKG_VERSION}-1
          Architecture: amd64
          Maintainer: Piotr Olszewski <asmie@asmie.pl>
          Depends: adduser
          Description: Simple Two-Way Active Measurement Protocol (STAMP)
           stamp-suite is a Rust implementation of the Simple Two-Way Active
           Measurement Protocol (STAMP) as defined in RFC 8762 and RFC 8972.
          Section: net
          Priority: optional
          EOF
          # Trim leading spaces from heredoc
          sed -i 's/^          //' "${PKG_DIR}/DEBIAN/control"
          # Install files
          cp target/release/${PKG_NAME} "${PKG_DIR}/usr/bin/"
          cp dist/systemd/${PKG_NAME}.service "${PKG_DIR}/lib/systemd/system/"
          cp mibs/STAMP-SUITE-MIB.mib "${PKG_DIR}/usr/share/snmp/mibs/"
          cp README.md "${PKG_DIR}/usr/share/doc/${PKG_NAME}/"
          # Maintainer scripts
          for script in postinst postrm prerm; do
            if [ -f "dist/debian/${script}" ]; then
              cp "dist/debian/${script}" "${PKG_DIR}/DEBIAN/"
              chmod 0755 "${PKG_DIR}/DEBIAN/${script}"
            fi
          done
          chmod 0755 "${PKG_DIR}/usr/bin/${PKG_NAME}"
          dpkg-deb --build --root-owner-group "${PKG_DIR}"
      - name: Verify DEB package
        run: |
          echo "=== Package info ==="
          dpkg-deb --info stamp-suite_0.5.0-1_amd64.deb
          echo "=== Package contents ==="
          dpkg-deb --contents stamp-suite_0.5.0-1_amd64.deb
          echo "=== Verify expected files ==="
          dpkg-deb --contents stamp-suite_0.5.0-1_amd64.deb | grep -q usr/bin/stamp-suite
          dpkg-deb --contents stamp-suite_0.5.0-1_amd64.deb | grep -q lib/systemd/system/stamp-suite.service
          dpkg-deb --contents stamp-suite_0.5.0-1_amd64.deb | grep -q usr/share/snmp/mibs/STAMP-SUITE-MIB.mib
          echo "All expected files present in DEB package."

  package-rpm:
    name: Package RPM
    runs-on: ubuntu-latest
    needs: [test]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: package-rpm
      - name: Install RPM tools
        run: sudo apt-get update && sudo apt-get install -y rpm
      - name: Build release binary
        run: cargo build --release --all-features
      - name: Build RPM package
        run: |
          # Set up rpmbuild tree
          mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS,BUILDROOT}
          # Create source tarball layout expected by the spec
          PKG_NAME=stamp-suite
          PKG_VERSION=0.5.0
          TARDIR="${PKG_NAME}-${PKG_VERSION}"
          mkdir -p "/tmp/${TARDIR}"
          cp -a . "/tmp/${TARDIR}/"
          # Pre-build: place the release binary so rpmbuild finds it
          mkdir -p "/tmp/${TARDIR}/target/release"
          cp target/release/${PKG_NAME} "/tmp/${TARDIR}/target/release/"
          tar czf ~/rpmbuild/SOURCES/${PKG_NAME}-${PKG_VERSION}.tar.gz -C /tmp "${TARDIR}"
          # Patch spec to skip cargo build (binary already built)
          sed 's/^cargo build --release$/# binary pre-built/' dist/rpm/${PKG_NAME}.spec > ~/rpmbuild/SPECS/${PKG_NAME}.spec
          rpmbuild -bb --nodeps \
            --define "_topdir $HOME/rpmbuild" \
            --define "debug_package %{nil}" \
            --define "_unitdir /usr/lib/systemd/system" \
            ~/rpmbuild/SPECS/${PKG_NAME}.spec
      - name: Verify RPM package
        run: |
          RPM_FILE=$(find ~/rpmbuild/RPMS -name '*.rpm' | head -1)
          echo "=== Package info ==="
          rpm -qip "${RPM_FILE}"
          echo "=== Package contents ==="
          rpm -qlp "${RPM_FILE}"
          echo "=== Verify expected files ==="
          rpm -qlp "${RPM_FILE}" | grep -q /usr/bin/stamp-suite
          rpm -qlp "${RPM_FILE}" | grep -q stamp-suite.service
          rpm -qlp "${RPM_FILE}" | grep -q STAMP-SUITE-MIB.mib
          echo "All expected files present in RPM package."

  nix-build:
    name: Nix Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: cachix/install-nix-action@v31
        with:
          nix_path: nixpkgs=channel:nixpkgs-unstable
      - name: Build with Nix
        run: nix build --print-build-logs

  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}