ci.yml

name: CI
env:
  CI: true
permissions:
  contents: read
on:
  pull_request:
  merge_group:
  push:
    branches:
    - main
    paths-ignore:
    - '**.md'
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  test:
    strategy:
      matrix:
        # test both stable and beta versions of Rust on ubuntu-latest
        os: [ubuntu-latest]
        rust: [stable, beta]
        # test only stable version of Rust on Windows and MacOS
        include:
          - rust: stable
            os: windows-latest
          - rust: stable
            os: macos-latest
          - rust: stable
            os: ubuntu-24.04-arm
    runs-on: ${{ matrix.os }}
    continue-on-error: ${{ matrix.rust == 'beta' }}
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
      with:
        egress-policy: audit

    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        submodules: true
    - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
      with:
        toolchain: ${{ matrix.rust }}
        components: rustfmt
    - name: "Set rustup profile"
      run: rustup set profile minimal
    - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
      with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
    - name: Test
      run: bash ./scripts/test.sh
  lint:
    runs-on: ubuntu-latest
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
      with:
        egress-policy: audit

    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        submodules: true
    - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
      with:
        toolchain: stable
        components: rustfmt, clippy
    - uses: taiki-e/install-action@68675c5a5f1a6950c3975d33f3ae0ef155e5bf3d # v2.68.15
      with:
          tool: cargo-hack
    - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
      with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
    - name: Format
      run: cargo fmt --all -- --check
    - name: Lint
      run: bash ./scripts/lint.sh
  external-types:
    strategy:
      matrix:
        member: [opentelemetry, opentelemetry-sdk, opentelemetry-otlp, opentelemetry-zipkin]
    runs-on: ubuntu-latest # TODO: Check if this could be covered for Windows. The step used currently fails on Windows.
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          # Rust version should be kept in sync with the one the release was tested with
          # https://github.com/awslabs/cargo-check-external-types/releases
          toolchain: nightly-2025-05-04
          components: rustfmt
      - uses: taiki-e/install-action@68675c5a5f1a6950c3975d33f3ae0ef155e5bf3d # v2.68.15
        with:
          tool: cargo-check-external-types@0.2.0
      - name: external-type-check
        working-directory: ${{ matrix.member }}
        run: cargo check-external-types --all-features --config allowed-external-types.toml
  msrv:
    strategy:
      matrix:
        os: [windows-latest, ubuntu-latest]
    runs-on: ${{ matrix.os }}
    continue-on-error: true
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: true
      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: stable
      - uses: taiki-e/install-action@68675c5a5f1a6950c3975d33f3ae0ef155e5bf3d # v2.68.15
        with:
          tool: cargo-msrv
      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Check MSRV for all crates
        run: bash ./scripts/msrv.sh
  cargo-deny:
    runs-on: ubuntu-latest # This uses the step `EmbarkStudios/cargo-deny-action@v1` which is only supported on Linux
    continue-on-error: true # Prevent sudden announcement of a new advisory from failing ci
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check advisories
        uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
        with:
          command: check advisories

      - name: Check licenses
        uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
        with:
          command: check licenses

      - name: Check bans
        uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
        with:
          command: check bans

      - name: Check sources
        uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
        with:
          command: check sources

  docs:
    continue-on-error: true
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: stable
          components: rustfmt
      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
        with:
            repo-token: ${{ secrets.GITHUB_TOKEN }}
      - name: doc
        run: cargo doc --no-deps --all-features
        env:
          CARGO_INCREMENTAL: '0'
          RUSTDOCFLAGS: -Dwarnings
  coverage:
    continue-on-error: true
    runs-on: ubuntu-latest
    if: ${{ ! contains(github.event.pull_request.labels.*.name, 'dependencies') }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: true
      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: stable
          components: rustfmt,llvm-tools-preview
      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@68675c5a5f1a6950c3975d33f3ae0ef155e5bf3d # v2.68.15
        with:
          tool: cargo-llvm-cov
      - name: cargo generate-lockfile
        if: hashFiles('Cargo.lock') == ''
        run: cargo generate-lockfile
      - name: cargo llvm-cov
        run: cargo llvm-cov --locked --all-features --workspace --lcov --lib --output-path lcov.info
      - name: Upload to codecov.io
        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
          fail_ci_if_error: true
  build-examples:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # stable
        with:
          toolchain: stable
          components: rustfmt
      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Build examples
        run: |
          for example in examples/*; do
            if [ -d "$example" ]; then
              echo "Building $example"
              cargo build
            fi
          done
  cargo-shear:
    continue-on-error: true
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: true
      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: nightly
      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: taiki-e/install-action@68675c5a5f1a6950c3975d33f3ae0ef155e5bf3d # v2.68.15
        with:
          tool: cargo-shear
      - name: cargo shear
        run: cargo shear --expand