ci.yml

# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Nightly at midnight UTC (for coverage)
    - cron: "0 0 * * *"

# Cancel in-progress runs when new commits are pushed
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Default to read-only permissions
permissions:
  contents: read
  pull-requests: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  # Validate conventional commit messages
  commits:
    name: Commit Messages
    runs-on: ubuntu-latest
    # Only run on pull requests - push to main is already validated
    if: github.event_name == 'pull_request'
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Validate PR title
        uses: step-security/action-semantic-pull-request@bc0cf74f5be4ce34accdec1ae908dff38dc5def1 # v6.1.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          types: |
            feat
            fix
            docs
            style
            refactor
            perf
            test
            build
            ci
            chore
            revert
            dx
            ai
            imp
          requireScope: false
          subjectPattern: ^[a-z].*$
          subjectPatternError: |
            The subject "{subject}" must start with a lowercase letter.
            Example: "feat: add user authentication" or "fix(api): handle empty requests"

  # Check code formatting
  fmt:
    name: Formatting
    runs-on: ubuntu-latest
    if: github.actor != 'dependabot[bot]'
    permissions:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust nightly toolchain
        uses: dtolnay/rust-toolchain@0b1efabc08b657293548b77fb76cc02d26091c7e # master
        with:
          toolchain: nightly
          components: rustfmt

      - name: Check formatting
        run: cargo +nightly fmt --all -- --check

  # Run Clippy for linting
  clippy:
    name: Linting
    runs-on: ubuntu-latest
    if: github.actor != 'dependabot[bot]'
    permissions:
      contents: read
    env:
      CARGO_INCREMENTAL: 0
      RUSTFLAGS: "-C codegen-units=16 -C link-arg=-fuse-ld=mold"
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable
          components: clippy

      - name: Install development tools via Mise
        uses: step-security/mise-action@d65cf9dcb78b983ae2530c89fd28e72286713505 # v3.5.1
        with:
          install_args: protobuf
          cache: true

      - name: Install mold linker
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold
          mold --version

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@9be15b830520fab0ec3939586e917e4855cf76bd # v2.8.3
        with:
          shared-key: management-ubuntu-latest-x86_64-unknown-linux-gnu
          save-if: false

      - name: Run clippy
        run: cargo clippy --workspace --all-targets --all-features -- -D warnings

  # Run tests on multiple platforms
  test:
    name: Test (${{ matrix.name }})
    needs: [fmt, clippy]
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-latest
            name: Linux AMD64
          - runner: ubuntu-24.04-arm
            name: Linux ARM64
          - runner: macos-latest
            name: macOS Apple Silicon
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable

      - name: Install mold linker (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold

      - name: Install protobuf compiler (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get install -y -qq protobuf-compiler

      - name: Install protobuf compiler (macOS)
        if: runner.os == 'macOS'
        run: |
          brew install protobuf

      - name: Install cargo-nextest
        uses: taiki-e/install-action@650c5ca14212efbbf3e580844b04bdccf68dac31 # v2.67.18
        with:
          tool: cargo-nextest

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@9be15b830520fab0ec3939586e917e4855cf76bd # v2.8.3
        with:
          shared-key: test-${{ matrix.runner }}

      - name: Run unit tests
        env:
          RUSTFLAGS: ${{ runner.os == 'Linux' && '-C codegen-units=16 -C link-arg=-fuse-ld=mold' || '' }}
        run: cargo nextest run --workspace --profile ci

      - name: Run doc tests
        run: cargo test --workspace --doc

  # Ledger Integration Tests
  # Runs Control tests against a real Ledger server to verify storage backend integration.
  # Uses Docker Compose to start a single-node Ledger cluster, then runs native cargo tests.
  ledger-integration-tests:
    name: Ledger Integration Tests
    needs: [fmt, clippy]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    timeout-minutes: 10
    env:
      CARGO_INCREMENTAL: 0
      RUSTFLAGS: "-C codegen-units=16 -C link-arg=-fuse-ld=mold"
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable

      - name: Install mold linker
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold

      - name: Install development tools via Mise
        uses: step-security/mise-action@d65cf9dcb78b983ae2530c89fd28e72286713505 # v3.5.1
        with:
          install_args: protobuf cargo:cargo-nextest
          cache: true

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@9be15b830520fab0ec3939586e917e4855cf76bd # v2.8.3
        with:
          shared-key: management-ubuntu-latest-x86_64-unknown-linux-gnu
          save-if: false

      - name: Start Ledger server
        working-directory: docker/ledger-integration-tests
        run: |
          docker compose up -d ledger
          echo "Waiting for Ledger to be ready..."
          # Wait for metrics endpoint to be available (indicates server is running)
          # Then add delay for Raft bootstrap to complete
          for i in {1..30}; do
            if curl -sf http://localhost:9092/metrics > /dev/null 2>&1; then
              echo "Ledger metrics endpoint is available"
              # Give Raft a moment to fully bootstrap after server starts
              sleep 3
              echo "Ledger should be ready!"
              break
            fi
            echo "Attempt $i/30: Ledger not ready yet..."
            sleep 2
          done
          # Final check - metrics endpoint must be available
          curl -sf http://localhost:9092/metrics > /dev/null || (docker compose logs ledger && exit 1)

      - name: Run Ledger integration tests
        env:
          LEDGER_ENDPOINT: "http://localhost:50052"
          RUST_BACKTRACE: "1"
        run: |
          cargo nextest run \
            --package inferadb-control-storage \
            --features integration \
            --test ledger_integration_tests \
            --profile ci \
            --no-fail-fast

      - name: Stop Ledger server
        if: always()
        working-directory: docker/ledger-integration-tests
        run: docker compose down -v

  # Test code coverage (nightly only to reduce CI costs)
  coverage:
    name: Code Coverage
    needs: test
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule'
    continue-on-error: true
    permissions:
      contents: read
    env:
      CARGO_INCREMENTAL: 0
      RUSTFLAGS: "-C codegen-units=16 -C link-arg=-fuse-ld=mold"
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable

      - name: Install mold linker
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold
          mold --version

      - name: Install development tools via Mise
        uses: step-security/mise-action@d65cf9dcb78b983ae2530c89fd28e72286713505 # v3.5.1
        with:
          install_args: protobuf cargo:cargo-llvm-cov
          cache: true

      - name: Restore build cache
        uses: step-security/rust-cache@9be15b830520fab0ec3939586e917e4855cf76bd # v2.8.3
        with:
          shared-key: management-ubuntu-latest-x86_64-unknown-linux-gnu
          save-if: false # Don't save, only restore from build job

      - name: Generate coverage
        run: cargo llvm-cov --workspace --lcov --output-path lcov.info

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
        with:
          files: lcov.info
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

  # Check dependencies (main branch only - informational, not blocking PRs)
  dependencies:
    name: Dependencies
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust toolchain (stable + nightly for udeps)
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable

      - name: Install Rust nightly toolchain (for cargo-udeps)
        uses: dtolnay/rust-toolchain@0b1efabc08b657293548b77fb76cc02d26091c7e # master
        with:
          toolchain: nightly

      - name: Install cargo-outdated
        uses: taiki-e/install-action@650c5ca14212efbbf3e580844b04bdccf68dac31 # v2.67.18
        with:
          tool: cargo-outdated

      - name: Install cargo-udeps
        uses: taiki-e/install-action@650c5ca14212efbbf3e580844b04bdccf68dac31 # v2.67.18
        with:
          tool: cargo-udeps

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@9be15b830520fab0ec3939586e917e4855cf76bd # v2.8.3

      - name: Check outdated dependencies
        run: cargo outdated --exit-code 1 || echo "Some dependencies are outdated"

      - name: Check for unused dependencies
        run: cargo +nightly udeps --workspace --all-targets || echo "Some dependencies may be unused"

      - name: Check for duplicate dependencies
        run: cargo tree --duplicates

  # Overall status check
  ci-success:
    name: CI Success
    needs: [commits, fmt, clippy, test, ledger-integration-tests, coverage, dependencies]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: always()
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
        with:
          egress-policy: audit

      - name: Check all jobs
        run: |
          # Commits check is only required on PRs
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            if [[ "${{ needs.commits.result }}" != "success" ]]; then
              echo "Commit message validation failed"
              echo "PR title must follow Conventional Commits format:"
              echo "  <type>(<scope>): <description>"
              echo "  Examples: 'feat: add new feature' or 'fix(api): handle edge case'"
              exit 1
            fi
          fi
          # Format and Clippy can be skipped for Dependabot PRs
          if [[ "${{ needs.fmt.result }}" != "success" && "${{ needs.fmt.result }}" != "skipped" ]]; then
            echo "Format check failed"
            exit 1
          fi
          if [[ "${{ needs.clippy.result }}" != "success" && "${{ needs.clippy.result }}" != "skipped" ]]; then
            echo "Clippy check failed"
            exit 1
          fi
          # Test job runs on multiple platforms
          if [[ "${{ needs.test.result }}" != "success" && "${{ needs.test.result }}" != "skipped" ]]; then
            echo "Tests failed"
            exit 1
          fi
          # Ledger integration tests verify storage backend
          if [[ "${{ needs.ledger-integration-tests.result }}" != "success" && "${{ needs.ledger-integration-tests.result }}" != "skipped" ]]; then
            echo "Ledger integration tests failed"
            exit 1
          fi
          # Coverage and dependencies are optional (skipped on PRs or non-main branches)
          if [[ "${{ needs.coverage.result }}" == "failure" ]]; then
            echo "::warning::Coverage check failed (non-blocking)"
          fi
          if [[ "${{ needs.dependencies.result }}" == "failure" ]]; then
            echo "::warning::Dependencies check failed (non-blocking)"
          fi

          echo "All required checks passed!"