pr.yml

name: Pull Request
on: pull_request

env:
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  RUSTUP_MAX_RETRIES: 10
  RUSTFLAGS: "-D warnings -D deprecated --cfg tokio_unstable -C debuginfo=0"

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref }}
  cancel-in-progress: true

jobs:
  meta:
    timeout-minutes: 5
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - id: build
        uses: tj-actions/changed-files@0b975f61488402a699abcebd6a1e25924cf85218
        with:
          files: |
            .github/workflows/pr.yml
            justfile
            Dockerfile
      - id: actions
        uses: tj-actions/changed-files@0b975f61488402a699abcebd6a1e25924cf85218
        with:
          files: |
            .github/workflows/**
            .devcontainer/*
      - id: cargo
        uses: tj-actions/changed-files@0b975f61488402a699abcebd6a1e25924cf85218
        with:
          files_ignore: "Cargo.toml"
          files: |
            **/Cargo.toml
      - id: cargo-crates
        if: steps.cargo.outputs.any_changed == 'true'
        run: ./.github/list-crates.sh ${{ steps.cargo.outputs.all_changed_files }}
      - id: rust
        uses: tj-actions/changed-files@0b975f61488402a699abcebd6a1e25924cf85218
        with:
          files: |
            **/*.rs
            Cargo.lock
    outputs:
      is_dependabot: ${{ github.actor == 'dependabot[bot]' }}
      any_changed: ${{ steps.build.outputs.any_changed == 'true' || steps.actions.outputs.any_changed == 'true' || steps.cargo.outputs.any_change == 'true' || steps.rust.outputs.any_changed == 'true' }}
      build_changed: ${{ steps.build.outputs.any_changed }}
      actions_changed: ${{ steps.build.outputs.any_changed == 'true' || steps.actions.outputs.any_changed == 'true' }}
      cargo_changed: ${{ steps.cargo.outputs.any_changed == 'true' }}
      cargo_crates: ${{ steps.cargo-crates.outputs.crates }}
      rust_changed: ${{ steps.build.outputs.any_changed == 'true' ||  steps.rust.outputs.any_changed == 'true' }}

  info:
    timeout-minutes: 3
    needs: meta
    runs-on: ubuntu-24.04
    steps:
      - name: Info
        run: |
          echo 'github.actor: ${{ github.actor }}'
          echo 'github.event_name: ${{ github.event_name }}'
          echo 'github.event.pull_request.number: ${{ github.event.pull_request.number }}'
          echo 'needs.meta.outputs.is_dependabot: ${{ needs.meta.outputs.is_dependabot }}'
          echo 'needs.meta.outputs.any_changed: ${{ needs.meta.outputs.any_changed }}'
          echo 'needs.meta.outputs.actions_changed: ${{ needs.meta.outputs.actions_changed }}'
          echo 'needs.meta.outputs.cargo_changed: ${{ needs.meta.outputs.cargo_changed }}'
          echo 'needs.meta.outputs.cargo_crates: ${{ needs.meta.outputs.cargo_crates }}'
          echo 'needs.meta.outputs.rust_changed: ${{ needs.meta.outputs.rust_changed }}'

  actions:
    needs: meta
    if: needs.meta.outputs.actions_changed == 'true'
    runs-on: ubuntu-24.04
    steps:
      - uses: linkerd/dev/actions/setup-tools@v45
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - run: just action-lint
      - run: just action-dev-check

  rust:
    needs: meta
    if: needs.meta.outputs.cargo_changed == 'true' || needs.meta.outputs.rust_changed == 'true'
    runs-on: ubuntu-24.04
    container: ghcr.io/linkerd/dev:v45-rust
    permissions:
      contents: read
    timeout-minutes: 20
    steps:
      - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3
      - run: just fetch
      - run: cargo deny --all-features check bans licenses sources
      - run: just check-fmt
      - run: just clippy
      - run: just doc
      - run: just test --exclude=linkerd2-proxy --no-run
      - run: just test --exclude=linkerd2-proxy
        env:
          NEXTEST_RETRIES: 3

  rust-windows:
    needs: meta
    runs-on: windows-2022
    permissions:
      contents: read
    timeout-minutes: 20
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: Install Rust (rustup)
        run: rustup update stable --no-self-update && rustup default stable
      - name: Install nextest
        run: curl -LsSf https://get.nexte.st/latest/windows-tar | tar zxf - -C "$CARGO_HOME"/bin
      - name: Add windows target
        run: rustup target add x86_64-pc-windows-gnu
      - name: Install nasm
        run: choco install nasm
      - name: Install protoc
        run: choco install protoc
      - name: Install LLVM and Clang
        uses: KyleMayes/install-llvm-action@6ba6e2cd3813def9879be378609d87cb3ef3bac3
        with:
          version: "19.1.7"
          directory: ${{ runner.temp }}/llvm
      - name: Set LIBCLANG_PATH
        run: echo "LIBCLANG_PATH=$((gcm clang).source -replace "clang.exe")" >> "$GITHUB_ENV"
      - run: cargo fetch --locked
      - run: cargo fmt -- --check
      - run: cargo clippy --target=x86_64-pc-windows-gnu --workspace --all-targets --frozen
      - run: cargo nextest run --target=x86_64-pc-windows-gnu --workspace --frozen --exclude=linkerd2-proxy --no-run
      - run: cargo nextest run --target=x86_64-pc-windows-gnu --workspace --frozen --exclude=linkerd2-proxy
        env:
          NEXTEST_RETRIES: 3

  rust-crates:
    needs: meta
    if: needs.meta.outputs.cargo_changed == 'true'
    timeout-minutes: 20
    runs-on: ubuntu-24.04
    container: ghcr.io/linkerd/dev:v45-rust
    strategy:
      matrix:
        crate: ${{ fromJson(needs.meta.outputs.cargo_crates) }}
    steps:
      - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3
      - run: just fetch
      - run: just check-crate ${{ matrix.crate }}

  linkerd-install:
    needs: meta
    if: needs.meta.outputs.cargo_changed == 'true' || needs.meta.outputs.rust_changed == 'true'
    timeout-minutes: 20
    runs-on: ubuntu-24.04
    env:
      WAIT_TIMEOUT: 2m
    steps:
      - uses: linkerd/dev/actions/setup-tools@v45
      - name: scurl https://run.linkerd.io/install-edge | sh
        run: |
          scurl https://run.linkerd.io/install-edge | sh
          echo "PATH=$PATH:$HOME/.linkerd2/bin" >> "$GITHUB_ENV"
          export PATH="$PATH:$HOME/.linkerd2/bin"
          tag=$(linkerd version --client --short)
          echo "linkerd $tag"
          echo "LINKERD_TAG=$tag" >> "$GITHUB_ENV"
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - run: just docker
      - run: just-k3d create
      - run: just k3d-load-linkerd
      - run: just linkerd-install
      - run: just linkerd-check-control-plane-proxy
        env:
          TMPDIR: ${{ runner.temp }}

  ship-it:
    timeout-minutes: 3
    needs: [meta, actions, rust, rust-crates, linkerd-install]
    if: always()
    runs-on: ubuntu-24.04

    permissions:
      contents: write
      pull-requests: write

    steps:
      - name: Results
        run: |
          echo 'needs.actions.result: ${{ needs.actions.result }}'
          echo 'needs.rust.result: ${{ needs.rust.result }}'
          echo 'needs.rust-crates.result: ${{ needs.rust-crates.result }}'
          echo 'needs.linkerd-install.result: ${{ needs.linkerd-install.result }}'

      - name: Verify jobs
        # All jobs must succeed or be skipped.
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: exit 1

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        if: needs.meta.outputs.is_dependabot == 'true' && needs.meta.outputs.any_changed == 'true'
      - name: "Merge dependabot changes"
        if: needs.meta.outputs.is_dependabot == 'true' && needs.meta.outputs.any_changed == 'true'
        run: gh pr merge '${{ github.event.pull_request.number }}' --auto --squash
        env:
          GH_TOKEN: ${{ github.token }}