ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  schedule:
    - cron: '0 0 * * 0'  # Weekly dependency check

# Restrict permissions for all jobs by default
permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  RUST_BACKTRACE: short
  RUSTFLAGS: "-D warnings"
  RUSTUP_MAX_RETRIES: 10

# Cancel previous runs on new push
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Detect changes to skip unnecessary jobs
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      rust: ${{ steps.filter.outputs.rust }}
      workflows: ${{ steps.filter.outputs.workflows }}
    steps:
      - uses: actions/checkout@v6

      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            rust:
              - '**/*.rs'
              - '**/Cargo.toml'
              - '**/Cargo.lock'
              - 'rust-toolchain.toml'
              - 'deny.toml'
            workflows:
              - '.github/workflows/**'

  # Format check (nightly for Edition 2024)
  fmt:
    name: Format
    needs: changes
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt

      - name: Check formatting
        run: cargo fmt --all -- --check

  # Clippy and docs (stable)
  check:
    name: Check
    needs: changes
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "check"
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Clippy
        run: cargo clippy --workspace --all-targets --all-features -- -D warnings

      - name: Check documentation
        run: cargo doc --workspace --no-deps --all-features
        env:
          RUSTDOCFLAGS: "-D warnings"

  # Security audit
  security:
    name: Security Audit
    needs: changes
    if: needs.changes.outputs.rust == 'true' || github.event_name == 'schedule'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@v6

      - name: Install cargo-deny
        uses: taiki-e/install-action@cargo-deny

      - name: Run cargo-deny
        run: cargo deny check

      # Note: cargo-semver-checks removed for pre-1.0 development
      # Checking semver compliance for 7 crates takes 5-7 minutes
      # and is not valuable for pre-1.0 versions (breaking changes allowed)
      # Re-enable when approaching 1.0.0 release

  # Cross-platform tests with matrix
  test:
    name: Test (${{ matrix.os }}${{ matrix.target && format(' / {0}', matrix.target) || '' }})
    needs: [changes, fmt, check]
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        rust: [stable]
        include:
          # Test on beta channel on Linux only
          - os: ubuntu-latest
            rust: beta
          # Cross-compile check for Windows ARM64
          - os: windows-latest
            rust: stable
            target: aarch64-pc-windows-msvc
            cross: true

    steps:
      - uses: actions/checkout@v6

      - name: Install Rust ${{ matrix.rust }}
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          targets: ${{ matrix.target }}

      # Platform-specific setup
      - name: Install dependencies (Ubuntu)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y libssl-dev pkg-config

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "test-${{ matrix.os }}${{ matrix.target && format('-{0}', matrix.target) || '' }}"
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Install nextest
        if: ${{ !matrix.cross }}
        uses: taiki-e/install-action@nextest

      - name: Run tests
        if: ${{ !matrix.cross }}
        run: cargo nextest run --workspace --all-features --no-fail-fast

      - name: Run doctests
        if: ${{ !matrix.cross }}
        run: cargo test --workspace --doc --all-features

      - name: Build for cross-compile target
        if: ${{ matrix.cross }}
        run: cargo build --workspace --target ${{ matrix.target }}

  # Code coverage (Linux only for speed)
  # Optimized: Single test run with codecov flags for per-crate tracking
  # Previous approach ran tests 7 times (1 overall + 6 per-crate) taking ~15 min
  # New approach: Single run with flags takes ~5 min (67% faster, 67% less runner cost)
  coverage:
    name: Code Coverage
    needs: [changes, fmt, check]
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install llvm-cov and nextest
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-llvm-cov,cargo-nextest

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "coverage"

      - name: Generate coverage (single run for all crates)
        run: |
          cargo llvm-cov --all-features --workspace --lcov \
            --output-path lcov.info nextest

      # Upload overall coverage with overall flag
      - name: Upload overall coverage
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          flags: overall
          fail_ci_if_error: false
          verbose: true

      # Upload per-crate coverage using flags
      # Codecov automatically filters by file paths in each crate
      - name: Upload deps-core coverage
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          flags: deps-core
          fail_ci_if_error: false

      - name: Upload deps-cargo coverage
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          flags: deps-cargo
          fail_ci_if_error: false

      - name: Upload deps-npm coverage
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          flags: deps-npm
          fail_ci_if_error: false

      - name: Upload deps-pypi coverage
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          flags: deps-pypi
          fail_ci_if_error: false

      - name: Upload deps-go coverage
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          flags: deps-go
          fail_ci_if_error: false

      - name: Upload deps-lsp coverage
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          flags: deps-lsp
          fail_ci_if_error: false

      - name: Archive coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: lcov.info
          retention-days: 30

  # MSRV check
  msrv:
    name: Check MSRV
    needs: [changes, fmt, check]
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6

      - name: Read MSRV from Cargo.toml
        id: msrv
        run: |
          MSRV=$(grep '^rust-version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
          echo "version=$MSRV" >> $GITHUB_OUTPUT

      - name: Install Rust ${{ steps.msrv.outputs.version }}
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ steps.msrv.outputs.version }}

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "msrv"

      - name: Check with MSRV
        run: cargo check --workspace --all-features

  # WASM build check for Zed extension
  # Note: deps-zed is now a separate repository (submodule).
  # WASM build is handled in the deps-zed repo CI.
  # This job now validates that submodule is properly configured.
  wasm:
    name: WASM Build (Zed Extension)
    needs: [changes, fmt, check]
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-wasip1

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "wasm"

      - name: Build Zed extension
        working-directory: crates/deps-zed
        run: cargo build --target wasm32-wasip1 --release

      - name: Check WASM size
        run: |
          ls -lh crates/deps-zed/target/wasm32-wasip1/release/*.wasm
          du -sh crates/deps-zed/target/wasm32-wasip1/release/*.wasm

  # Verify benchmarks compile (without running)
  benchmark:
    name: Check Benchmarks
    needs: [changes, fmt, check]
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "bench"
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Build benchmarks
        run: cargo build --workspace --benches

  # Release build check
  release-check:
    name: Release Build Check
    needs: [test]
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "release"

      - name: Build release
        run: cargo build --workspace --release --all-features

      - name: Check binary size
        run: |
          ls -lh target/release/
          du -sh target/release/

  # All checks passed
  ci-success:
    name: CI Success
    needs: [changes, fmt, check, security, test, coverage, msrv, wasm, benchmark]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Check all jobs
        run: |
          # If no relevant changes, all skipped jobs are OK
          if [[ "${{ needs.changes.outputs.rust }}" != "true" && "${{ needs.changes.outputs.workflows }}" != "true" ]]; then
            echo "No relevant changes - skipped jobs are OK"
            exit 0
          fi

          # Check if any required job failed (skipped is OK for conditional jobs)
          check_job() {
            local result="$1"
            local name="$2"
            if [[ "$result" == "failure" || "$result" == "cancelled" ]]; then
              echo "Job $name failed: $result"
              return 1
            fi
            return 0
          }

          failed=0
          check_job "${{ needs.fmt.result }}" "fmt" || failed=1
          check_job "${{ needs.check.result }}" "check" || failed=1
          check_job "${{ needs.security.result }}" "security" || failed=1
          check_job "${{ needs.test.result }}" "test" || failed=1
          check_job "${{ needs.coverage.result }}" "coverage" || failed=1
          check_job "${{ needs.msrv.result }}" "msrv" || failed=1
          check_job "${{ needs.wasm.result }}" "wasm" || failed=1
          check_job "${{ needs.benchmark.result }}" "benchmark" || failed=1

          if [[ $failed -eq 1 ]]; then
            echo "One or more jobs failed"
            exit 1
          fi
          echo "All jobs passed successfully!"