ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  # Build, lint, and run the full test suite (unit/component + integration)
  # on both first-class platforms. Windows is included so the Windows Service
  # and Event Log code is compiled, linted, and tested too.
  test:
    name: test & clippy (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          components: clippy
      - name: Cache cargo registry and build artifacts
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Clippy (all targets, warnings denied)
        run: cargo clippy --all-targets --locked -- -D warnings
      # The plugin SDK is behind an off-by-default `plugins` feature, so the
      # default steps never compile it. Lint and test it explicitly on both
      # platforms so the feature-gated module and its core call sites cannot
      # bitrot. The default steps stay too, proving the stock build is unchanged.
      - name: Clippy (plugins feature, warnings denied)
        run: cargo clippy --all-targets --locked --features plugins -- -D warnings
      - name: Test (lib, bins, integration, examples)
        run: cargo test --all-targets --locked
        env:
          # On Windows, require the ProgramData DACL tests to actually run: they
          # skip on a non-elevated account, so without this a runner that cannot
          # apply the DACL could report green while never verifying it. Empty on
          # Linux (the tests are Windows-only), where it has no effect.
          ALIGHIERI_REQUIRE_DACL_TESTS: ${{ matrix.os == 'windows-latest' && '1' || '' }}
      - name: Test (plugins feature)
        run: cargo test --all-targets --locked --features plugins
        env:
          ALIGHIERI_REQUIRE_DACL_TESTS: ${{ matrix.os == 'windows-latest' && '1' || '' }}
      - name: Doctests
        run: cargo test --doc --locked

  # Cross-compile the extra ARM64 release targets so the release matrix is
  # validated on every change, not only when a tag is pushed. Build-only: the
  # x86_64 GitHub runners cannot execute these binaries.
  cross-build:
    name: cross-build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            linker: gcc-aarch64-linux-gnu
          - os: windows-latest
            target: aarch64-pc-windows-msvc
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          targets: ${{ matrix.target }}
      - name: Cache cargo registry and build artifacts
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Install aarch64 cross toolchain (Linux)
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y ${{ matrix.linker }}
          # Linker for cargo, and CC so cc-rs build scripts (e.g. ring) use the
          # cross compiler instead of the host toolchain.
          {
            echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc"
            echo "CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc"
          } >> "$GITHUB_ENV"
      - name: Cross-compile (release, build-only)
        run: cargo build --release --locked --target ${{ matrix.target }}

  # Formatting is platform-independent, so check it once.
  rustfmt:
    name: rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          components: rustfmt
      - name: Check formatting
        run: cargo fmt --all -- --check

  # Lint the Linux management scripts and run their bundled self-tests (the
  # installer's path-normalisation and hardened-path warning logic). shellcheck
  # is preinstalled on the GitHub-hosted Ubuntu runners.
  shellcheck:
    name: shellcheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Lint shell scripts
        run: shellcheck scripts/*.sh
      - name: Run installer self-tests
        run: bash scripts/alighieri.sh __selftest

  # Verify the crate still builds on its declared minimum supported Rust
  # version (Cargo.toml `rust-version`). Clippy and rustfmt stay on the stable
  # job above: their output drifts across releases, so pinning them here would
  # freeze tooling at the MSRV instead of tracking current stable.
  msrv:
    name: build on MSRV (1.88)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Rust 1.88
        uses: dtolnay/rust-toolchain@98e1b82157cd469e843cb7f524c1313b4ad9492c # 1.88.0
      - name: Cache cargo registry and build artifacts
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Build all targets on the MSRV toolchain
        run: cargo build --all-targets --locked
      # Verify the feature-gated plugin SDK (and its extra dependency,
      # async-trait) also builds on the MSRV toolchain.
      - name: Build with the plugins feature on the MSRV toolchain
        run: cargo build --all-targets --locked --features plugins

  # Exercise the exact source archive that crates.io will receive. This catches
  # allowlist mistakes, missing docs/examples, and dependencies on repository
  # files that are not present after Cargo extracts the `.crate` archive.
  package:
    name: crates.io package
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      - name: Cache cargo registry and build artifacts
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Build all-feature documentation (warnings denied)
        run: cargo doc --all-features --no-deps --locked
        env:
          RUSTDOCFLAGS: -D warnings
      - name: Check package contents
        shell: bash
        run: |
          set -euo pipefail
          package_list="$RUNNER_TEMP/alighieri-package-files.txt"
          cargo package --list --locked > "$package_list"

          required=(
            Cargo.toml
            Cargo.lock
            src/lib.rs
            src/main.rs
            README.md
            CHANGELOG.md
            LICENSE
            LICENSING.md
            doc/alighieri.conf
            doc/plugin-sdk.md
            scripts/alighieri.sh
            scripts/install-linux.sh
          )
          for path in "${required[@]}"; do
            if ! grep -Fqx "$path" "$package_list"; then
              echo "::error::Required package file is missing: $path"
              exit 1
            fi
          done

          forbidden='^(\.github|\.agents|\.codex|target)/|^(\.dockerignore|Dockerfile)$'
          if grep -En "$forbidden" "$package_list"; then
            echo "::error::The package contains repository-only files"
            exit 1
          fi
      - name: Build and extract package
        shell: bash
        run: |
          set -euo pipefail
          cargo package --locked
          package_version="$(
            python3 -c \
              'import tomllib; print(tomllib.load(open("Cargo.toml", "rb"))["package"]["version"])'
          )"
          crate_file="target/package/alighieri-$package_version.crate"
          if [[ ! -f "$crate_file" ]]; then
            echo "::error::cargo package did not produce $crate_file"
            exit 1
          fi

          extract_root="$RUNNER_TEMP/alighieri-package"
          mkdir -p "$extract_root"
          tar -xzf "$crate_file" -C "$extract_root"
          crate_dir="$(find "$extract_root" -mindepth 1 -maxdepth 1 -type d -name 'alighieri-*' -print -quit)"
          if [[ -z "$crate_dir" ]]; then
            echo "::error::Could not locate the extracted alighieri package"
            exit 1
          fi
          echo "CRATE_DIR=$crate_dir" >> "$GITHUB_ENV"
      - name: Test extracted package (default features)
        run: cargo test --manifest-path "$CRATE_DIR/Cargo.toml" --all-targets --locked
      - name: Test extracted package (all features)
        run: cargo test --manifest-path "$CRATE_DIR/Cargo.toml" --all-targets --all-features --locked
      - name: Install and smoke-test extracted binary
        shell: bash
        run: |
          set -euo pipefail
          install_root="$RUNNER_TEMP/alighieri-install"
          cargo install --path "$CRATE_DIR" --locked --root "$install_root"
          "$install_root/bin/alighieri" --version
          "$install_root/bin/alighieri" --help
          "$install_root/bin/alighieri" --check "$CRATE_DIR/doc/alighieri.conf"

  # There is no registry baseline until the manual 0.4.0 publication. Probe for
  # that exact version so this job is harmless before the first release and
  # automatically becomes a required compatibility check afterwards.
  semver:
    name: public API semver
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Check whether the 0.4.0 registry baseline exists
        id: baseline
        shell: bash
        run: |
          set -euo pipefail
          response="$RUNNER_TEMP/alighieri-0.4.0.json"
          status="$(
            curl --silent --show-error --location \
              --retry 3 --retry-all-errors \
              --header "User-Agent: Wiresock-Foundation/alighieri CI" \
              --output "$response" --write-out '%{http_code}' \
              https://crates.io/api/v1/crates/alighieri/0.4.0
          )"
          case "$status" in
            200)
              echo "available=true" >> "$GITHUB_OUTPUT"
              ;;
            404)
              echo "available=false" >> "$GITHUB_OUTPUT"
              echo "alighieri 0.4.0 is not published yet; skipping the semver baseline check"
              ;;
            *)
              cat "$response"
              echo "::error::crates.io returned HTTP $status while checking the semver baseline"
              exit 1
              ;;
          esac
      - name: Check public API compatibility
        if: steps.baseline.outputs.available == 'true'
        uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2
        with:
          package: alighieri
          feature-group: all-features