ci.yml

name: CI

on:
  push:
    branches: [master, main, develop]
  pull_request:
    branches: [master, main, develop]
  schedule:
    # Weekly security audit on Sundays at midnight
    - cron: "0 0 * * 0"

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  RUST_BACKTRACE: short
  # Don't use RUSTFLAGS=-D warnings, use workspace lints configuration instead
  RUSTUP_MAX_RETRIES: 10

# Cancel previous runs on new push
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Quick checks first - fail fast strategy
  check:
    name: Check
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Install Rust nightly (for rustfmt)
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "check"
          save-if: ${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' }}

      - name: Check formatting (nightly)
        run: cargo +nightly fmt --all -- --check

      - name: Clippy (all targets, all features)
        run: cargo +stable clippy --all-targets --all-features --workspace

      - name: Check documentation
        run: cargo +stable doc --no-deps --all-features --workspace
        env:
          RUSTDOCFLAGS: "-D warnings"

  # Security audit using cargo-deny
  security:
    name: Security Audit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - name: Run cargo-deny (advisories, licenses, bans, sources)
        uses: EmbarkStudios/cargo-deny-action@v2
        with:
          log-level: warn
          command: check
          arguments: --all-features
          command-arguments: advisories licenses bans sources

  # Cross-platform tests with matrix
  test:
    name: Test (${{ matrix.os }}, Rust ${{ matrix.rust }})
    needs: [check]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 45
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        rust: [stable]
        include:
          # Test on beta channel on Linux only
          - os: ubuntu-latest
            rust: beta

    steps:
      - uses: actions/checkout@v6

      - name: Install Rust ${{ matrix.rust }}
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "test-${{ matrix.os }}-${{ matrix.rust }}"
          save-if: ${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' }}

      - name: Install nextest
        uses: taiki-e/install-action@v2
        with:
          tool: nextest

      - name: Build (all targets, all features)
        run: cargo build --all-targets --all-features --workspace

      - name: Run tests (nextest)
        run: cargo nextest run --all-features --workspace --no-fail-fast

      - name: Run doctests
        run: cargo test --doc --all-features --workspace

  # Code coverage (Linux only for speed)
  coverage:
    name: Code Coverage
    needs: [check]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      actions: write  # For uploading artifacts
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install llvm-cov
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-llvm-cov

      - name: Install nextest
        uses: taiki-e/install-action@v2
        with:
          tool: nextest

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "coverage"
          save-if: ${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' }}

      - name: Generate coverage (nextest)
        run: |
          cargo llvm-cov --all-features --workspace --lcov \
            --output-path lcov.info nextest

      - name: Upload to codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          fail_ci_if_error: false
          verbose: true
          flags: unittests
          name: codecov-umbrella

      - name: Archive coverage report
        uses: actions/upload-artifact@v6
        with:
          name: coverage-report
          path: lcov.info
          retention-days: 30

  # MSRV check (Minimum Supported Rust Version)
  msrv:
    name: Check MSRV (1.89)
    needs: [check]
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust 1.89
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.89"

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "msrv"

      - name: Check with MSRV
        run: cargo check --all-features --workspace

  # Benchmarks (build only, don't run in CI)
  benchmark:
    name: Benchmark Build
    needs: [check]
    runs-on: ubuntu-latest
    timeout-minutes: 25
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "bench"

      - name: Build benchmarks (no run)
        run: cargo bench --no-run --profile bench-fast --workspace

  # Release build check
  release:
    name: Release Build
    needs: [test]
    runs-on: ubuntu-latest
    timeout-minutes: 25
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "release"

      - name: Build release
        run: cargo build --release --all-features --workspace

      - name: Check binary sizes
        run: |
          echo "Binary sizes:"
          ls -lh target/release/ | grep -E "(mcp-execution-cli|mcp-examples)" || true
          echo ""
          echo "Target directory size:"
          du -sh target/release/

  # All checks passed
  ci-success:
    name: CI Success
    needs: [check, security, test, coverage, msrv, benchmark]
    runs-on: ubuntu-latest
    if: always()
    permissions:
      contents: read
    steps:
      - name: Check all jobs
        run: |
          if [[ "${{ needs.check.result }}" != "success" ]] || \
             [[ "${{ needs.security.result }}" != "success" ]] || \
             [[ "${{ needs.test.result }}" != "success" ]] || \
             [[ "${{ needs.coverage.result }}" != "success" ]] || \
             [[ "${{ needs.msrv.result }}" != "success" ]] || \
             [[ "${{ needs.benchmark.result }}" != "success" ]]; then
            echo "One or more required jobs failed or were cancelled"
            exit 1
          fi
          echo "All required jobs passed successfully!"