ci.yml

name: CI
on:
  pull_request:
  merge_group:
  push:
    branches: [main]

permissions:
  contents: read

env:
  STABLE_TOOLCHAIN: "1.94.1"

jobs:
  fmt:
    name: Cargo fmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          toolchain: nightly
          components: rustfmt
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - run: cargo fmt --all -- --check

  clippy:
    name: Cargo clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          toolchain: ${{ env.STABLE_TOOLCHAIN }}
          components: clippy
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Run clippy check
        run: cargo clippy --all-targets --all-features -- -D warnings
        env:
          RUSTFLAGS: "--cfg tokio_unstable"

  build:
    name: Build (${{ matrix.os }}, ${{ matrix.toolchain }})
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
        toolchain: ["1.94.1", nightly]
        # aarch64 Linux exercises arch-specific unwind asm, PAC stripping,
        # and ucontext layout that x86_64 Linux doesn't cover.
        include:
          - os: ubuntu-24.04-arm
            toolchain: "1.94.1"
    env:
      RUST_BACKTRACE: 1
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: ./.github/actions/rust-build
        with:
          toolchain: ${{ matrix.toolchain }}
          save-if: ${{ github.ref == 'refs/heads/main' }}

  feature-check:
    name: Feature combinations
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: "--cfg tokio_unstable"
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          toolchain: ${{ env.STABLE_TOOLCHAIN }}
      - uses: taiki-e/install-action@184183c2401be73c3bf42c2e61268aa5855379c1 # v2
        with:
          tool: cargo-hack
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Check each feature compiles
        run: >
          cargo hack check
          --each-feature --no-dev-deps
          --workspace
          --exclude metrics-service
          --exclude simple-local
          --exclude-features _shuttle

  check-docs:
    name: Check docs.rs
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          toolchain: nightly
          components: rust-docs
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - run: sudo apt-get update && sudo apt-get install -y jq
      - run: cargo install cargo-docs-rs
      - run: ./scripts/check-docsrs.sh

  trace-integrity:
    name: Trace Integrity & Analysis
    runs-on: ubuntu-latest
    services:
      dynamodb-local:
        image: amazon/dynamodb-local
        ports:
          - 8000:8000
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          toolchain: ${{ env.STABLE_TOOLCHAIN }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24
      - name: Enable perf_event_open and kallsyms for tests
        run: |
          sudo sysctl kernel.perf_event_paranoid=1
          sudo sysctl kernel.kptr_restrict=0
      - run: scripts/e2e-trace-tests.sh

  asan:
    name: AddressSanitizer (perf-self-profile)
    runs-on: ubuntu-latest
    env:
      RUST_BACKTRACE: 1
      RUSTFLAGS: "--cfg tokio_unstable -Zsanitizer=address"
      RUSTDOCFLAGS: "-Zsanitizer=address"
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          toolchain: nightly
          components: rust-src
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Enable perf_event_open and kallsyms
        run: |
          sudo sysctl kernel.perf_event_paranoid=1
          sudo sysctl kernel.kptr_restrict=0
      - name: Run perf-self-profile tests under ASAN (perf path)
        run: |
          sudo prlimit --pid $$ --memlock=unlimited:unlimited
          cargo test -p dial9-perf-self-profile --lib --all-features \
            -Z build-std --target x86_64-unknown-linux-gnu
      - name: Restrict perf_event_open to force ctimer path
        run: sudo sysctl kernel.perf_event_paranoid=3
      - name: Run perf-self-profile tests under ASAN (ctimer path)
        # paranoid=3 blocks perf_event_open
        # With paranoid=3, /proc/kallsyms shows zero kernel addresses on this runner
        run: |
          sudo prlimit --pid $$ --memlock=unlimited:unlimited
          cargo test -p dial9-perf-self-profile --lib --all-features \
            -Z build-std --target x86_64-unknown-linux-gnu \
            -- --skip sys::linux::symbolize::tests::resolve_kernel_symbol_returns_name

  ecs-sim:
    name: ECS simulation (ctimer fallback)
    runs-on: ubuntu-latest
    env:
      RUST_BACKTRACE: 1
      RUSTFLAGS: "--cfg tokio_unstable"
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          toolchain: ${{ env.STABLE_TOOLCHAIN }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Restrict perf_event_open (simulate ECS/Fargate)
        # paranoid=3 blocks perf_event_open to trigger the ctimer fallback path
        run: sudo sysctl kernel.perf_event_paranoid=3
      - name: Run perf-self-profile tests (auto-fallback path)
        # With paranoid=3, /proc/kallsyms also shows zero kernel addresses on this runner 
        # (exact mechanism is kernel/distro specific), so resolve_kernel_symbol_returns_name fails. 
        # Kernel symbolization is also irrelevant to this path: frame-pointer unwinding only captures
        # userspace addresses.
        run: |
          cargo test -p dial9-perf-self-profile --lib --all-features \
            -- --skip sys::linux::symbolize::tests::resolve_kernel_symbol_returns_name

  shuttle:
    name: Shuttle tests
    runs-on: ubuntu-latest
    env:
      RUST_BACKTRACE: 1
      RUSTFLAGS: "--cfg tokio_unstable --cfg shuttle"
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          toolchain: ${{ env.STABLE_TOOLCHAIN }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Run shuttle tests
        run: scripts/test-shuttle.sh

  semver-checks:
    name: Semver checks
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          toolchain: ${{ env.STABLE_TOOLCHAIN }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Install cargo-semver-checks
        uses: taiki-e/install-action@184183c2401be73c3bf42c2e61268aa5855379c1 # v2
        with:
          tool: cargo-semver-checks
      - name: Check semver compliance
        env:
          RUSTFLAGS: "--cfg tokio_unstable"
        run: |
          cargo semver-checks \
            -p dial9-trace-format-derive \
            -p dial9-trace-format \
            -p dial9-perf-self-profile \
            -p dial9-macro \
            -p dial9-tokio-telemetry \
            -p dial9-viewer

  package:
    name: Cargo package
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          toolchain: ${{ env.STABLE_TOOLCHAIN }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Verify all publishable crates package cleanly
        env:
          RUSTFLAGS: "--cfg tokio_unstable"
        run: |
          cargo package \
            -p dial9-trace-format-derive \
            -p dial9-trace-format \
            -p dial9-perf-self-profile \
            -p dial9-macro \
            -p dial9-tokio-telemetry \
            -p dial9-viewer

  ci-pass:
    name: CI Pass
    runs-on: ubuntu-latest
    needs: [fmt, clippy, build, feature-check, check-docs, trace-integrity, asan, ecs-sim, shuttle, package]
    if: always()
    steps:
      - run: |
          if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            echo "One or more required jobs failed or were cancelled"
            exit 1
          fi