ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

permissions:
  contents: read

jobs:
  rust-tools:
    name: Build and test Rust tools
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: tools
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable

      - name: Build pmpl-sign
        run: |
          if [ -d "pmpl-sign" ]; then
            cd pmpl-sign
            cargo build --release
          fi

      - name: Build pmpl-verify
        run: |
          if [ -d "pmpl-verify" ]; then
            cd pmpl-verify
            cargo build --release
          fi

      - name: Build pmpl-audit
        run: |
          if [ -d "pmpl-audit" ]; then
            cd pmpl-audit
            cargo build --release
          fi

      - name: Run tests (if any)
        run: |
          if ls */Cargo.toml >/dev/null 2>&1; then
            for crate in */Cargo.toml; do
              dir=$(dirname "$crate")
              (cd "$dir" && cargo test) || exit 1
            done
          fi

  asciidoc:
    name: Validate AsciiDoc docs
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Install Asciidoctor
        run: |
          sudo apt-get update
          sudo apt-get install -y asciidoctor

      - name: Build key docs
        run: |
          find . -name '*.adoc' -maxdepth 2 -print0 | xargs -0 -n1 asciidoctor -o /dev/null

  scm-validate:
    name: Validate SCM manifests
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Check Scheme files parse
        run: |
          if command -v guile >/dev/null 2>&1; then
            for f in *.scm; do
              echo "Checking $f"
              guile -c "(load \"$f\")" || exit 1
            done
          else
            echo "Guile not installed; installing..."
            sudo apt-get update
            sudo apt-get install -y guile-3.0
            for f in *.scm; do
              echo "Checking $f"
              guile -c "(load \"$f\")" || exit 1
            done
          fi

  spdx-headers:
    name: Check SPDX headers
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Verify SPDX identifiers
        run: |
          set -e
          echo "Checking for PMPL SPDX headers..."
          # Example: check a few key directories; you can refine the patterns.
          files=$(git ls-files '*.rs' '*.ex' '*.exs' '*.adoc' '*.scm' || true)
          missing=0
          for f in $files; do
            if ! grep -q "SPDX-License-Identifier: PMPL-1.0-or-later" "$f"; then
              echo "Missing SPDX header in: $f"
              missing=1
            fi
          done
          if [ "$missing" -ne 0 ]; then
            echo "Some files are missing SPDX headers."
            exit 1
          fi

  fuzz:
    name: Fuzzing (cargo-fuzz, if present)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable

      - name: Install cargo-fuzz
        run: cargo install cargo-fuzz || true

      - name: Run fuzz targets (if any)
        run: |
          if [ -d "tools" ]; then
            cd tools
            if find . -name 'fuzz' -type d | grep -q fuzz; then
              for fuzz_dir in $(find . -name 'fuzz' -type d); do
                echo "Running fuzz in $fuzz_dir"
                cd "$fuzz_dir"
                # Run briefly to satisfy tooling without blowing CI time
                FUZZ_TARGETS=$(cargo fuzz list || true)
                for t in $FUZZ_TARGETS; do
                  echo "Fuzzing target $t for a short run"
                  cargo fuzz run "$t" -- -max_total_time=30 || true
                done
                cd - >/dev/null
              done
            else
              echo "No fuzz targets found; skipping."
            fi
          fi