ci.yml

# SPDX-FileCopyrightText: Copyright © 2025 hashcatHitman
#
# SPDX-License-Identifier: Apache-2.0 OR MIT

name: CI

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["**"]
  workflow_dispatch: {}

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_VET_VERSION: 0.10.2
  CARGO_AUDIT_VERSION: 0.22.1
  ZIZMOR_VERSION: 1.23.1
  MSRV: 1.89.0

defaults:
  run:
    shell: bash

jobs:
  zizmor:
    name: Workflow Scan
    runs-on: ubuntu-latest
    permissions:
      security-events: write # Required for upload-sarif to upload SARIF files.
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install Rust
        run: rustup update stable && rustup default stable
      - name: Check cache for zizmor
        id: cache-zizmor
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: ~/.cargo/bin/zizmor
          key: zizmor-bin-${{ env.ZIZMOR_VERSION }}
      - if: ${{ steps.cache-zizmor.outputs.cache-hit != 'true' }}
        name: Install zizmor
        run: cargo install --locked --version ${ZIZMOR_VERSION} zizmor
      - name: Invoke zizmor
        run: zizmor --persona auditor --format=sarif . > zizmor_results.sarif
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
        with:
          sarif_file: zizmor_results.sarif
          category: zizmor

  reuse:
    name: REUSE compliance check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: REUSE Compliance Check
        uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0

  cargo-audit:
    name: Audit Dependencies
    runs-on: ubuntu-latest
    permissions:
      security-events: write # Required for upload-sarif to upload SARIF files.
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install Rust
        run: rustup update stable && rustup default stable
      - name: Check cache for cargo-audit
        id: cache-cargo-audit
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: ~/.cargo/bin/cargo-audit
          key: cargo-audit-bin-${{ env.CARGO_AUDIT_VERSION }}
      - if: ${{ steps.cache-cargo-audit.outputs.cache-hit != 'true' }}
        name: Install cargo-audit
        run: cargo install --locked --version ${CARGO_AUDIT_VERSION} cargo-audit
      - name: Invoke cargo-audit
        run: cargo audit --deny warnings --format=sarif > cargo_audit_results.sarif
      - if: success() || failure()
        name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
        with:
          sarif_file: cargo_audit_results.sarif
          category: cargo-audit

  cargo-vet:
    name: Vet Dependencies
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install Rust
        run: rustup update stable && rustup default stable
      - name: Check cache for cargo-vet
        id: cache-cargo-vet
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: ~/.cargo/bin/cargo-vet
          key: cargo-vet-bin-${{ env.CARGO_VET_VERSION }}
      - if: ${{ steps.cache-cargo-vet.outputs.cache-hit != 'true' }}
        name: Install cargo-vet
        run: cargo install --locked --version ${CARGO_VET_VERSION} cargo-vet
      - name: Invoke cargo-vet
        run: cargo vet --locked

  quality-control:
    name: Quality Control
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Nightly Install
        run: rustup toolchain add nightly && rustup component add --toolchain nightly rustfmt clippy
      - name: Format Check (Nightly)
        run: cargo +nightly fmt --verbose --all --check
      - name: Clippy (Nightly)
        run: cargo +nightly clippy --locked --workspace --all-targets --all-features -- -D warnings -Zcrate-attr=feature"(strict_provenance_lints,unqualified_local_imports,must_not_suspend,multiple_supertrait_upcastable,non_exhaustive_omitted_patterns_lint,supertrait_item_shadowing)"

  build-test-msrv:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]

    name: Build & Test (${{ matrix.os }}) (MSRV)
    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: MSRV Install
        run: rustup toolchain add ${MSRV}
      - name: Build
        run: cargo +${MSRV} build --verbose --workspace --all-targets --all-features --locked
      - name: Tests
        run: cargo +${MSRV} test --verbose --workspace --all-targets --all-features --locked
      - name: Doctests
        run: cargo +${MSRV} test --verbose --workspace --doc --all-features --locked

  build-test-nightly:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]

    name: Build & Test (${{ matrix.os }}) (Nightly)
    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Build
        run: cargo +nightly build --verbose --workspace --all-targets --all-features --locked
      - name: Tests
        run: cargo +nightly test --verbose --workspace --all-targets --all-features --locked
      - name: Doctests
        run: cargo +nightly test --verbose --workspace --doc --all-features --locked