ci.yml

# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Nightly at midnight UTC (for coverage)
    - cron: "0 0 * * *"

# Cancel in-progress runs when new commits are pushed
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Default to read-only permissions
permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  RUST_BACKTRACE: 1
  MSRV: "1.75"

jobs:
  # Check code formatting
  fmt:
    name: Formatting
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust nightly toolchain
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly
        with:
          components: rustfmt

      - name: Check formatting
        run: cargo +nightly fmt --all -- --check

  # Run Clippy for linting
  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: "-C codegen-units=16 -C link-arg=-fuse-ld=mold"
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # stable
        with:
          components: clippy

      - name: Install mold linker
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold

      - name: Install development tools via Mise
        uses: step-security/mise-action@2fa1b2b4fa1577588d8ac75f4dfa0f67c266d2a0 # v3.4.1
        with:
          install_args: protobuf
          cache: true

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
        with:
          shared-key: clippy

      - name: Run clippy (default features)
        run: cargo clippy --workspace --all-targets -- -D warnings

      - name: Run clippy (all features)
        run: cargo clippy --workspace --all-targets --all-features -- -D warnings

      - name: Run clippy (no default features)
        run: cargo clippy --workspace --all-targets --no-default-features -- -D warnings

  # Check for unused dependencies
  udeps:
    name: Unused Dependencies
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: "-C codegen-units=16 -C link-arg=-fuse-ld=mold"
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust nightly toolchain
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly

      - name: Install mold linker
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold

      - name: Install development tools via Mise
        uses: step-security/mise-action@2fa1b2b4fa1577588d8ac75f4dfa0f67c266d2a0 # v3.4.1
        with:
          install_args: protobuf cargo:cargo-udeps
          cache: true

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
        with:
          shared-key: udeps

      - name: Check for unused dependencies
        run: cargo +nightly udeps --workspace --all-features

  # Check MSRV (Minimum Supported Rust Version)
  msrv:
    name: MSRV (${{ matrix.msrv }})
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: "-C codegen-units=16 -C link-arg=-fuse-ld=mold"
    strategy:
      matrix:
        msrv: ["1.92"]
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust ${{ matrix.msrv }}
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # master
        with:
          toolchain: ${{ matrix.msrv }}

      - name: Install mold linker
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold

      - name: Install development tools via Mise
        uses: step-security/mise-action@2fa1b2b4fa1577588d8ac75f4dfa0f67c266d2a0 # v3.4.1
        with:
          install_args: protobuf
          cache: true

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
        with:
          shared-key: msrv-${{ matrix.msrv }}

      - name: Check compilation
        run: cargo check --workspace --all-features

  # Run tests on multiple platforms
  test:
    name: Test (${{ matrix.os }})
    needs: [fmt, clippy]
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # stable

      - name: Install mold linker (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold

      - name: Install development tools via Mise
        uses: step-security/mise-action@2fa1b2b4fa1577588d8ac75f4dfa0f67c266d2a0 # v3.4.1
        with:
          install_args: protobuf
          cache: true

      - name: Install cargo-nextest
        uses: taiki-e/install-action@3522286d40783523f9c7880e33f785905b4c20d0 # v2.66.1
        with:
          tool: cargo-nextest

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
        with:
          shared-key: test-${{ matrix.os }}

      - name: Run unit tests (default features)
        env:
          RUSTFLAGS: ${{ runner.os == 'Linux' && '-C codegen-units=16 -C link-arg=-fuse-ld=mold' || '' }}
        run: cargo nextest run --lib

      - name: Run unit tests (all features)
        env:
          RUSTFLAGS: ${{ runner.os == 'Linux' && '-C codegen-units=16 -C link-arg=-fuse-ld=mold' || '' }}
        run: cargo nextest run --lib --all-features

      - name: Run doc tests
        run: cargo test --doc --all-features

  # Test feature combinations
  features:
    name: Feature Combinations
    needs: [fmt, clippy]
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: "-C codegen-units=16 -C link-arg=-fuse-ld=mold"
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # stable

      - name: Install mold linker
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold

      - name: Install development tools via Mise
        uses: step-security/mise-action@2fa1b2b4fa1577588d8ac75f4dfa0f67c266d2a0 # v3.4.1
        with:
          install_args: protobuf
          cache: true

      - name: Install cargo-nextest
        uses: taiki-e/install-action@3522286d40783523f9c7880e33f785905b4c20d0 # v2.66.1
        with:
          tool: cargo-nextest

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
        with:
          shared-key: features

      - name: Test no default features
        run: cargo nextest run --lib --no-default-features

      - name: Test gRPC only
        run: cargo nextest run --lib --no-default-features --features grpc,rustls

      - name: Test REST only
        run: cargo nextest run --lib --no-default-features --features rest,rustls

      - name: Test with native-tls
        run: cargo nextest run --lib --no-default-features --features rest,native-tls

      - name: Test with tracing
        run: cargo nextest run --lib --features tracing

      - name: Test with derive macros
        run: cargo nextest run --lib --features derive

      - name: Test with blocking
        run: cargo nextest run --lib --features blocking

  # Code coverage (nightly only to reduce CI costs)
  coverage:
    name: Code Coverage
    needs: test
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule'
    continue-on-error: true
    env:
      RUSTFLAGS: "-C codegen-units=16 -C link-arg=-fuse-ld=mold"
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # stable
        with:
          components: llvm-tools-preview

      - name: Install mold linker
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold

      - name: Install development tools via Mise
        uses: step-security/mise-action@2fa1b2b4fa1577588d8ac75f4dfa0f67c266d2a0 # v3.4.1
        with:
          install_args: protobuf cargo:cargo-llvm-cov
          cache: true

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
        with:
          shared-key: coverage

      - name: Generate coverage
        run: |
          cargo llvm-cov --lib \
            --ignore-filename-regex 'proto|inferadb\.authorization\.v1' \
            --codecov \
            --output-path codecov.json

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
        with:
          files: ./codecov.json
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

  # Build documentation
  docs:
    name: Documentation
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: "-C codegen-units=16 -C link-arg=-fuse-ld=mold"
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust nightly toolchain
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly

      - name: Install mold linker
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold

      - name: Install development tools via Mise
        uses: step-security/mise-action@2fa1b2b4fa1577588d8ac75f4dfa0f67c266d2a0 # v3.4.1
        with:
          install_args: protobuf
          cache: true

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
        with:
          shared-key: docs

      - name: Build documentation
        env:
          RUSTDOCFLAGS: -D warnings --cfg docsrs
        run: cargo +nightly doc --workspace --no-deps --all-features

  # Check examples compile
  examples:
    name: Examples
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: "-C codegen-units=16 -C link-arg=-fuse-ld=mold"
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # stable

      - name: Install mold linker
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold

      - name: Install development tools via Mise
        uses: step-security/mise-action@2fa1b2b4fa1577588d8ac75f4dfa0f67c266d2a0 # v3.4.1
        with:
          install_args: protobuf
          cache: true

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
        with:
          shared-key: examples

      - name: Check examples compile
        run: cargo check --examples --all-features

  # Overall status check
  ci-success:
    name: CI Success
    needs: [fmt, clippy, udeps, msrv, test, features, coverage, docs, examples]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Check all jobs
        env:
          FMT_RESULT: ${{ needs.fmt.result }}
          CLIPPY_RESULT: ${{ needs.clippy.result }}
          UDEPS_RESULT: ${{ needs.udeps.result }}
          MSRV_RESULT: ${{ needs.msrv.result }}
          TEST_RESULT: ${{ needs.test.result }}
          FEATURES_RESULT: ${{ needs.features.result }}
          DOCS_RESULT: ${{ needs.docs.result }}
          EXAMPLES_RESULT: ${{ needs.examples.result }}
          COVERAGE_RESULT: ${{ needs.coverage.result }}
        run: |
          results="$FMT_RESULT $CLIPPY_RESULT $UDEPS_RESULT $MSRV_RESULT $TEST_RESULT $FEATURES_RESULT $DOCS_RESULT $EXAMPLES_RESULT"

          for result in $results; do
            if [[ "$result" != "success" && "$result" != "skipped" ]]; then
              echo "One or more jobs failed"
              exit 1
            fi
          done

          # Coverage is optional
          if [[ "$COVERAGE_RESULT" == "failure" ]]; then
            echo "Coverage failed (non-blocking)"
          fi

          echo "All required checks passed!"