ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  RUST_BACKTRACE: short
  RUSTFLAGS: -D warnings
  RUSTDOCFLAGS: -D rustdoc::broken-intra-doc-links
  RUSTUP_MAX_RETRIES: 10

jobs:
  fmt:
    name: rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # rustfmt.toml uses `imports_granularity` and `group_imports`, both
      # nightly-only options — fmt has to run on nightly.
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: clippy (${{ matrix.label }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: default
            features: ""
          - label: tokio-rich
            features: --features "tls,http2,http3,plugins,signals,multipart,simd,protobuf,ip-filter,hmac-signature,json-schema,zstd,client,validator,garde,typed-header,zero-copy-extractors,async-graphql,grpc,utoipa,vespera,metrics-prometheus,metrics-opentelemetry,tako-tracing,jwt-simple,file-stream,jemalloc,ahash,graphiql"
          - label: all-features
            features: --all-features
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
        with:
          key: clippy-${{ matrix.label }}
      # `--tests --examples` extends the lint sweep to the integration test
      # crate (`tako-rs/tests/*.rs`) and every example. Workspace-level
      # `pedantic = warn` opts those in too, so `-D warnings` catches
      # regressions like the ones surfaced by the v2 release audit (items
      # after statements, ignored unit patterns, map_unwrap_or).
      - run: cargo clippy --workspace --no-deps --tests --examples ${{ matrix.features }} -- -D warnings

  test:
    name: test (${{ matrix.os }} / ${{ matrix.toolchain }} / ${{ matrix.label }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        toolchain: [stable]
        label: [default]
        features: [""]
        include:
          - os: ubuntu-latest
            toolchain: stable
            label: rich
            features: --features "tls,http2,plugins,signals,multipart,simd,protobuf,ip-filter,hmac-signature,json-schema,zstd,client,typed-header,zero-copy-extractors,jwt-simple,file-stream"
          - os: ubuntu-latest
            toolchain: stable
            label: http3
            features: --features "tls,http2,http3,plugins,signals"
          - os: ubuntu-latest
            toolchain: stable
            label: all-features
            # Regression guard for A1 (compio/tokio !Send mismatch under
            # workspace-wide --all-features test-build). Re-fixing the
            # gated test bins requires both runtimes resolved at once.
            features: --all-features
          # Beta toolchain — early-warning for nightly→stable regressions
          # picked up by upstream crates.
          - os: ubuntu-latest
            toolchain: beta
            label: default
            features: ""
          # MSRV pin — make sure the declared `rust-version = "1.95"` actually
          # builds AND passes tests. The plain `msrv` job below only builds;
          # this one runs the rich feature set under the floor toolchain.
          - os: ubuntu-latest
            toolchain: "1.95"
            label: msrv-rich
            features: --features "tls,http2,plugins,signals,multipart,simd,protobuf,jwt-simple,client,typed-header,zero-copy-extractors,file-stream"
    env:
      # Tests don't need to break on every clippy nit; only enforce build-warnings
      # in build/clippy/doc jobs.
      RUSTFLAGS: ""
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.toolchain }}
      - uses: Swatinem/rust-cache@v2
        with:
          key: test-${{ matrix.os }}-${{ matrix.toolchain }}-${{ matrix.label }}
      - run: cargo test --workspace ${{ matrix.features }}

  msrv:
    name: MSRV build (1.95)
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: ""
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.95"
      - uses: Swatinem/rust-cache@v2
        with:
          key: msrv-1.95
      # Plain `cargo build` on the declared MSRV — paired with the
      # `toolchain: 1.95` row of the test matrix above so we catch both
      # compilation errors and behaviour drift at the floor toolchain.
      - run: cargo build --workspace --all-features

  doc:
    name: rustdoc
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: doc
      # `--all-features` catches broken intra-doc links that only appear on
      # feature-gated modules (timeout middleware, webtransport, compio
      # adapters). `RUSTDOCFLAGS: -D rustdoc::broken-intra-doc-links` from the
      # workflow `env` then turns those into hard failures.
      - run: cargo doc --no-deps --workspace --all-features

  deny:
    name: cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: EmbarkStudios/cargo-deny-action@v2

  examples:
    name: examples build
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: ""
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: examples
      - name: Build every example
        run: |
          set -euo pipefail
          # `examples/*` are excluded from the workspace, so iterate manifest by
          # manifest. Failures in any single example fail the job.
          for manifest in examples/*/Cargo.toml; do
            echo "::group::Building ${manifest}"
            cargo build --release --manifest-path "${manifest}"
            echo "::endgroup::"
          done

  bench-build:
    name: bench compile check
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: ""
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: bench
      # Verify the criterion harnesses still compile. We do not run them in
      # CI by default — bench numbers are PR-noise. A scheduled job runs the
      # full suite and posts the comparison.
      - run: cargo bench --no-run -p tako-rs-core

  autobahn:
    name: autobahn websocket suite
    runs-on: ubuntu-latest
    # The suite is heavy (4-7 minutes) and depends on docker. Run it on
    # PRs that touch streams + on main. PRs that don't touch the WS path
    # opt out via path filter.
    if: |
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' &&
       contains(github.event.pull_request.labels.*.name, 'run-autobahn'))
    env:
      RUSTFLAGS: ""
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: autobahn
      - name: Run Autobahn fuzzingclient
        run: ci/autobahn/run.sh
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: autobahn-report
          path: ci/autobahn/reports/

  fuzz-build:
    name: fuzz harness compile check
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: ""
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
        with:
          key: fuzz-build
      # cargo-fuzz needs the host nightly target with libfuzzer; we only
      # check that the targets compile here. Actual fuzz runs are
      # scheduled separately and post their findings to the issue tracker.
      - run: cargo install cargo-fuzz --version "^0.13"
      - run: cargo +nightly fuzz build

  fuzz-smoke:
    name: fuzz smoke (60s per target)
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'run-fuzz')
    env:
      RUSTFLAGS: ""
    strategy:
      fail-fast: false
      matrix:
        target:
          - proxy_protocol_parser
          - path_params_deserializer
          - grpc_timeout_parser
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
        with:
          key: fuzz-${{ matrix.target }}
      - run: cargo install cargo-fuzz --version "^0.13"
      - name: smoke
        run: |
          cargo +nightly fuzz run ${{ matrix.target }} \
            -- -max_total_time=60

  miri:
    name: miri (tako-rs-core + tako-rs-extractors)
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: ""
      MIRIFLAGS: -Zmiri-strict-provenance -Zmiri-disable-isolation
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: miri
      - uses: Swatinem/rust-cache@v2
        with:
          key: miri
      # Miri can't see most async I/O — keep the run scoped to the pure-Rust
      # subset that fits its execution model. The body extractor / params
      # deserializer / problem responder / signals registry suite is the
      # critical-correctness slice we want UB-checked.
      - run: |
          cargo +nightly miri test \
            -p tako-rs-core \
            -p tako-rs-extractors \
            --no-default-features \
            --features simd \
            -- \
            --skip server_ \
            --skip tcp_ \
            --skip udp_ \
            --skip h3_ \
            --skip tls_

  docs:
    name: docs site build
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: ""
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - name: Install
        working-directory: website
        run: bun install --frozen-lockfile
      - name: Audit (frontmatter, meta.json coverage, internal links)
        working-directory: website
        run: bun run audit
      - name: Build
        working-directory: website
        run: bun run build

  coverage:
    name: coverage
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main'
    env:
      RUSTFLAGS: ""
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview
      - uses: Swatinem/rust-cache@v2
        with:
          key: coverage
      - uses: taiki-e/install-action@cargo-llvm-cov
      - name: collect coverage
        run: |
          cargo llvm-cov --workspace \
            --features "tls,http2,plugins,signals,multipart,simd,protobuf,jwt-simple,client,typed-header" \
            --lcov --output-path lcov.info
      - uses: codecov/codecov-action@v4
        with:
          files: lcov.info
          fail_ci_if_error: false