ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  # -D warnings on every compile (deps + workspace). Keep byte-identical across all
  # jobs: any per-job RUSTFLAGS delta re-fingerprints the whole graph and every
  # sccache object key, defeating reuse.
  RUSTFLAGS: "-D warnings"
  # sccache caches individual rustc invocations across jobs AND runs, including the
  # workspace crates (which Swatinem drops). Requires incremental off. Backed by a
  # Cloudflare R2 bucket (S3 API), so the cache is shared across jobs, runs, the
  # Dockerfile build, and the local host sccache — one silo, zero egress cost.
  # Set at the workflow env level (not the composite) because composite actions
  # cannot read the `secrets` context. Keys are content-addressed on the full
  # compiler input, and the sole build.rs (cow-venue) + nexum-macros are
  # deterministic, so PR builds writing to the shared bucket write correct objects
  # under correct keys (no poisoning); bound storage with an R2 lifecycle-expiry
  # rule on the bucket (sccache does not evict cloud backends itself).
  RUSTC_WRAPPER: sccache
  CARGO_INCREMENTAL: "0"
  SCCACHE_BUCKET: shepherd-sccache
  SCCACHE_ENDPOINT: https://${{ secrets.R2_ACCOUNT_ID }}.r2.cloudflarestorage.com
  SCCACHE_REGION: auto
  SCCACHE_S3_KEY_PREFIX: ci/rust-1.94
  AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}

jobs:
  fmt:
    name: rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: ./.github/actions/rust-setup
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check # parse-only; never compiles

  clippy:
    name: clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: ./.github/actions/rust-setup
        with:
          components: clippy
      # clippy runs in its own job and target dir: no build/doc step precedes it, so
      # -D warnings is re-evaluated on clippy's own fingerprints and can never be
      # served from an rmeta a warning-tolerant build primed. (This is why the native
      # jobs stay parallel rather than merged into one warm-target-dir job.)
      - run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings

  test:
    name: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      # mold is symlinked as `ld` by setup-mold, NOT put in RUSTFLAGS: it keeps
      # linking fast (which sccache cannot cache anyway) without a linker flag in the
      # cache key. wasm targets link with rust-lld, untouched.
      - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
      - uses: ./.github/actions/rust-setup
        with:
          targets: wasm32-wasip2
      - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
        with:
          tool: nextest
      # Build all 15 guest module wasms ONCE (release/wasm32-wasip2): the single
      # source of truth for guest buildability and the artifacts the integration
      # tests load. Replaces the deleted 9-way build-module matrix, which recompiled
      # the shared wasm dependency graph ~9x cold. Per-module size report folded in;
      # a compile break still names the offending crate and -D warnings still applies.
      - name: build module wasms (+ size report)
        run: |
          cargo build --release --target wasm32-wasip2 --locked \
            -p example -p twap-monitor -p ethflow-watcher -p price-alert \
            -p balance-tracker -p stop-loss -p http-probe \
            -p clock-reader -p flaky-bomb -p fuel-bomb \
            -p memory-bomb -p panic-bomb -p slow-host
          {
            echo "### module .wasm sizes"
            echo "| module | bytes |"
            echo "|---|---:|"
            for f in target/wasm32-wasip2/release/*.wasm; do
              printf '| %s | %s |\n' "$(basename "$f" .wasm)" "$(wc -c < "$f")"
            done
          } >> "$GITHUB_STEP_SUMMARY"
      # The integration tests load the wasms from their exact
      # target/wasm32-wasip2/release/*.wasm paths built above; keep --release and the
      # path and --all-features on both nextest and the doctests.
      - run: cargo nextest run --workspace --all-features --no-fail-fast --locked
      # nextest does not run doctests; keep them covered separately.
      - run: cargo test --doc --workspace --all-features --locked

  docs:
    name: rustdoc
    runs-on: ubuntu-latest
    env:
      # RUSTDOCFLAGS affects only the rustdoc pass (not the sccache-keyed rustc), so
      # it may differ from RUSTFLAGS without splitting the compile cache.
      RUSTDOCFLAGS: "-D warnings"
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: ./.github/actions/rust-setup
      - run: cargo doc --workspace --no-deps --locked

  # Lenient guard that the workspace still type-checks for arm64 (the library is
  # consumed on Android/iOS via arm64). The native x86_64 leg is dropped: on
  # ubuntu-latest the host target IS x86_64-unknown-linux-gnu, which the clippy and
  # test jobs already compile with more coverage. `continue-on-error` keeps this a
  # signal, not a gate; it runs `cargo check` (no final link) so no cross linker is
  # required. Push/dispatch only: it never gates, so a per-PR run would only spend a
  # cold cross cache for nothing.
  cross-check:
    name: cross-check aarch64
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: ./.github/actions/rust-setup
        with:
          targets: aarch64-unknown-linux-gnu
      - name: install arm64 cross toolchain
        run: sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
      - name: cargo check
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
          CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
          CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
          AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
        run: cargo check --workspace --all-features --locked --target aarch64-unknown-linux-gnu