ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

defaults:
  run:
    shell: bash

jobs:
  test:
    name: Test ${{ matrix.os }} (${{ matrix.simd_mode }})
    permissions:
      contents: read
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
        simd_mode: [portable, native]
    env:
      FASTPFOR_SIMD_MODE: ${{ matrix.simd_mode }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with: { persist-credentials: false, submodules: recursive }
      - if: github.event_name != 'release' && github.event_name != 'workflow_dispatch'
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          prefix-key: "v0-${{ matrix.simd_mode }}"
      - uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2.82.0
        with: { tool: 'just,cargo-binstall' }
      - run: just ci-test

  test-nightly:
    name: Nightly-specific tests
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with: { persist-credentials: false, submodules: recursive }
      - if: github.event_name != 'release' && github.event_name != 'workflow_dispatch'
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2.82.0
        with: { tool: 'just' }
      - run: rustup install nightly --profile minimal
      - run: just test-publish

  test-msrv:
    name: Test MSRV
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with: { persist-credentials: false, submodules: recursive }
      - if: github.event_name != 'release' && github.event_name != 'workflow_dispatch'
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2.82.0
        with: { tool: 'just' }
      - name: Read MSRV
        id: msrv
        run: echo "value=$(just get-msrv)" >> $GITHUB_OUTPUT
      - name: Install MSRV Rust ${{ steps.msrv.outputs.value }}
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: ${{ steps.msrv.outputs.value }}
      - run: just ci_mode=0 ci-test-msrv  # Ignore warnings in MSRV

  fuzz:
    name: Fuzz
    permissions:
      contents: read
    runs-on: ubuntu-latest
    env:
      # The number of seconds to run the fuzz target.
      FUZZ_TIME: 60
    strategy:
      matrix:
        include:
          - fuzz_target: cpp_roundtrip
          - fuzz_target: encode_oracle
          - fuzz_target: decode_oracle
          - fuzz_target: decode_arbitrary
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with: { persist-credentials: false, submodules: recursive }
      # Install the nightly Rust channel.
      - run: rustup toolchain install nightly
      - run: rustup default nightly
      # Install and cache `cargo-fuzz`.
      - uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2.82.0
        with: { tool: 'cargo-binstall' }
      - run: cargo binstall -y cargo-fuzz@0.13.1 # Pinned to avoid breakage.
      # Build and then run the fuzz target.
      #  --target x86_64-unknown-linux-gnu is necessary to not default to musl, which is not supported by cargo-fuzz.
      - run: cargo fuzz build --target x86_64-unknown-linux-gnu ${{ matrix.fuzz_target }}
      - run: cargo fuzz run --target x86_64-unknown-linux-gnu ${{ matrix.fuzz_target }} -- -max_total_time=${{ env.FUZZ_TIME }}
      # Upload fuzzing artifacts on failure for post-mortem debugging.
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: failure()
        with:
          name: fuzzing-artifacts-${{ matrix.fuzz_target }}-${{ github.sha }}
          path: fuzz/artifacts

  coverage:
    name: Code Coverage
    permissions:
      contents: read
    if: github.event_name != 'release'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with: { persist-credentials: false, submodules: recursive }
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2.82.0
        with: { tool: 'just,cargo-llvm-cov' }
      - name: Generate code coverage
        run: just ci-coverage
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: target/llvm-cov/codecov.info

  # This job checks if any of the previous jobs failed or were canceled.
  # This approach also allows some jobs to be skipped if they are not needed.
  ci-passed:
    permissions: {}
    needs: [ test, test-nightly, test-msrv, fuzz ]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Result of the needed steps
        run: echo "${{ toJSON(needs) }}"
      - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: exit 1

  release:
    # Some dependencies of the `ci-passed` job might be skipped, but we still want to run if the `ci-passed` job succeeded.
    if: always() && startsWith(github.ref, 'refs/tags/') && needs.ci-passed.result == 'success'
    name: Publish to crates.io
    permissions:
      contents: read
    needs: [ ci-passed ]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with: { persist-credentials: false, submodules: recursive }
      - name: Publish to crates.io
        run: cargo publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}