ci.yml

name: CI

on:
  pull_request:
    types: [opened, synchronize, reopened]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
  CARGO_NET_GIT_FETCH_WITH_CLI: true

jobs:
  ci:
    name: Format, lint, build, and test
    # Self-hosted macOS runner required for CommonCrypto FFI and NAS access.
    # Skip fork PRs to prevent untrusted code execution on self-hosted runners.
    if: github.event.pull_request.head.repo.full_name == github.repository
    runs-on: spiceai-macos
    permissions:
      contents: read

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt,clippy

      - name: Cache Rust build artifacts
        uses: Swatinem/rust-cache@v2

      - name: Check formatting
        run: cargo fmt --all --check

      - name: Run cargo check
        run: cargo check --locked --all-targets --all-features

      - name: Run clippy
        run: cargo clippy --locked --all-targets --all-features -- -D warnings -D clippy::all -D clippy::cargo -A clippy::cargo-common-metadata

      - name: Check rustdoc
        run: RUSTDOCFLAGS="-D warnings" cargo doc --locked --workspace --no-deps --document-private-items

      - name: Build debug binary
        run: cargo build --locked

      - name: Run unit tests
        run: cargo test --locked

      - name: Check SMB credentials
        run: |
          if [[ -n "$SPICEIO_SMB_PASS" ]]; then
            echo "HAS_SMB_PASS=true" >> "$GITHUB_ENV"
          fi
        env:
          SPICEIO_SMB_PASS: ${{ secrets.UNAS_SMB_PASS }}

      - name: Install AWS CLI
        if: ${{ env.HAS_SMB_PASS == 'true' }}
        run: |
          if ! command -v aws &>/dev/null; then
            brew install awscli
          fi

      - name: Verify spiceio binary version
        run: |
          BUILT_VERSION=$(./target/debug/spiceio --version)
          echo "Built: ${BUILT_VERSION}"
          echo "SPICEIO_BUILT_VERSION=${BUILT_VERSION}" >> "$GITHUB_ENV"

          # If an older spiceio is already listening (e.g. from a previous run),
          # kill it so the test starts the freshly-built binary.
          for PORT in 18333 18334; do
            STALE_PID=$(lsof -i ":${PORT}" -sTCP:LISTEN -t 2>/dev/null || true)
            if [[ -n "$STALE_PID" ]]; then
              echo "Stale process on :${PORT} (pid ${STALE_PID}), killing..."
              kill "$STALE_PID" 2>/dev/null || true
            fi
          done

      - name: Run sccache integration test
        # Skipped when UNAS_SMB_PASS secret is not configured (e.g. fork PRs)
        if: ${{ env.HAS_SMB_PASS == 'true' }}
        env:
          SPICEIO_SMB_SERVER: ${{ vars.SPICEIO_SMB_SERVER || '192.168.3.148' }}
          SPICEIO_SMB_USER: ${{ vars.SPICEIO_SMB_USER || 'runner' }}
          SPICEIO_SMB_PASS: ${{ secrets.UNAS_SMB_PASS }}
          SPICEIO_SMB_SHARE: ${{ vars.SPICEIO_SMB_SHARE || 'ai_platform_dev' }}
          SPICEIO_BUCKET: ${{ vars.SPICEIO_BUCKET || 'spiceio' }}
          SPICEIO_REGION: ${{ vars.SPICEIO_REGION || 'us-west-1' }}
        run: ./scripts/test-sccache.sh

      - name: Run extended S3 operations test
        # Multipart, range, multi-delete, conditional writes, list-under-load,
        # streaming cancellation. Uses bucket 'extended' and port 18336 so it
        # doesn't collide with the sccache test above.
        if: ${{ env.HAS_SMB_PASS == 'true' }}
        env:
          SPICEIO_SMB_SERVER: ${{ vars.SPICEIO_SMB_SERVER || '192.168.3.148' }}
          SPICEIO_SMB_USER: ${{ vars.SPICEIO_SMB_USER || 'runner' }}
          SPICEIO_SMB_PASS: ${{ secrets.UNAS_SMB_PASS }}
          SPICEIO_SMB_SHARE: ${{ vars.SPICEIO_SMB_SHARE || 'ai_platform_dev' }}
          SPICEIO_BUCKET: extended
          SPICEIO_REGION: ${{ vars.SPICEIO_REGION || 'us-west-1' }}
          SPICEIO_BIND: 127.0.0.1:18336
          AWS_DEFAULT_REGION: ${{ vars.SPICEIO_REGION || 'us-west-1' }}
        run: ./scripts/test-extended.sh

      - name: Run concurrent stress test
        # Concurrent writes/reads/contention, write-then-read patterns,
        # mixed read/write on same key, and large-file pipelined I/O.
        if: ${{ env.HAS_SMB_PASS == 'true' }}
        env:
          SPICEIO_SMB_SERVER: ${{ vars.SPICEIO_SMB_SERVER || '192.168.3.148' }}
          SPICEIO_SMB_USER: ${{ vars.SPICEIO_SMB_USER || 'runner' }}
          SPICEIO_SMB_PASS: ${{ secrets.UNAS_SMB_PASS }}
          SPICEIO_SMB_SHARE: ${{ vars.SPICEIO_SMB_SHARE || 'ai_platform_dev' }}
          SPICEIO_BUCKET: stress
          SPICEIO_REGION: ${{ vars.SPICEIO_REGION || 'us-west-1' }}
          SPICEIO_BIND: 127.0.0.1:18335
          AWS_DEFAULT_REGION: ${{ vars.SPICEIO_REGION || 'us-west-1' }}
        run: ./scripts/stress-concurrent.sh

      - name: Build release artifact
        run: cargo build --release --locked --bin spiceio

      - name: Upload release artifact
        uses: actions/upload-artifact@v4
        with:
          name: spiceio-${{ runner.os }}-${{ runner.arch }}
          path: target/release/spiceio
          if-no-files-found: error