ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always

jobs:
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      sdk: ${{ steps.filter.outputs.sdk }}
      apply_schema: ${{ steps.filter.outputs.apply_schema }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            sdk:
              - 'sdk/**'
            apply_schema:
              - 'cli/src/cli.rs'
              - 'cli/src/main.rs'
              - 'lite/src/init.rs'
              - 'cli/schema.json'

  cli-schema-drift:
    name: CLI Schema Drift
    needs: [changes]
    if: needs.changes.outputs.apply_schema == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Generate apply schema
        run: cargo run -q -p s2-cli -- apply --schema > /tmp/apply.schema.json
      - name: Check for schema drift
        run: diff -u cli/schema.json /tmp/apply.schema.json

  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt
      - run: cargo +nightly fmt --all --check

  lockfile:
    name: Lockfile
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - name: Verify Cargo.lock is up-to-date
        run: cargo metadata --locked --format-version 1 >/dev/null

  sort:
    name: Cargo Sort
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: taiki-e/install-action@cargo-sort
      - run: cargo sort --workspace --check

  deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: taiki-e/install-action@cargo-deny
      - run: cargo deny check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - name: Install Protoc
        uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - run: cargo clippy --workspace --all-features --all-targets -- -D warnings --allow deprecated

  test:
    name: Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: taiki-e/install-action@nextest
      - run: cargo nextest run --workspace --all-features -E 'not (package(s2-cli) & binary(integration)) - package(s2-sdk)'

  helm-lint:
    name: Helm Chart Lint & Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Helm
        uses: azure/setup-helm@v4
        with:
          version: v3.14.0

      - name: Lint Helm chart
        run: helm lint charts/s2-lite-helm

      - name: Test template rendering (default)
        run: helm template test-release charts/s2-lite-helm --dry-run > /dev/null

      - name: Test with TLS self-signed
        run: helm template test-release charts/s2-lite-helm --set tls.enabled=true --set tls.selfSigned=true --dry-run > /dev/null

      - name: Test with TLS provided cert
        run: helm template test-release charts/s2-lite-helm --set tls.enabled=true --set tls.cert=/etc/tls/tls.crt --set tls.key=/etc/tls/tls.key --dry-run > /dev/null

      - name: Test with S3 object storage
        run: helm template test-release charts/s2-lite-helm --set objectStorage.enabled=true --set objectStorage.bucket=test-bucket --dry-run > /dev/null

      - name: Test with S3 and TLS
        run: |
          helm template test-release charts/s2-lite-helm \
            --set tls.enabled=true \
            --set tls.selfSigned=true \
            --set objectStorage.enabled=true \
            --set objectStorage.bucket=test-bucket \
            --set objectStorage.endpoint=https://s3.amazonaws.com \
            --set metrics.serviceMonitor.enabled=true \
            --dry-run > /dev/null

      - name: Test TLS without cert/key fails but selfSigned and provided cert work
        run: |
          if helm template test-release charts/s2-lite-helm \
            --set tls.enabled=true \
            --dry-run 2>&1; then
            echo "Expected failure but got success"
            exit 1
          fi
          helm template test-release charts/s2-lite-helm \
            --set tls.enabled=true \
            --set tls.selfSigned=true \
            --dry-run > /dev/null
          helm template test-release charts/s2-lite-helm \
            --set tls.enabled=true \
            --set tls.cert=/etc/tls/tls.crt \
            --set tls.key=/etc/tls/tls.key \
            --dry-run > /dev/null

      - name: Test objectStorage without bucket fails
        run: |
          if helm template test-release charts/s2-lite-helm \
            --set objectStorage.enabled=true \
            --dry-run 2>&1; then
            echo "Expected failure but got success"
            exit 1
          fi

  build-server:
    name: Build s2-lite
    uses: ./.github/workflows/build-s2-lite.yml
    with:
      ref: ${{ github.sha }}

  sdk-integration-tests:
    name: SDKs <> s2-lite Integration Tests
    needs: [build-server, test, clippy]
    uses: ./.github/workflows/sdk-tests.yml
    with:
      mode: local
      server-binary: server
      server-args: "--port 8080"
      server-port: 8080
      sdks: |
        [
          {
            "name": "go",
            "repo": "s2-streamstore/s2-sdk-go",
            "ref": "main",
            "lang": "go",
            "go-version": "1.24",
            "test_cmd": "go test -v -count=1 -skip 'WithScope|AccessToken|Metrics|Client_InvalidToken' ./s2/..."
          },
          {
            "name": "typescript",
            "repo": "s2-streamstore/s2-sdk-typescript",
            "ref": "main",
            "lang": "bun",
            "bun-version": "latest",
            "test_cmd": "S2_LITE=1 bun run vitest --run --exclude '**/account-basin*' --exclude '**/accessTokens*' --exclude '**/metrics*'"
          },
          {
            "name": "rust",
            "repo": "${{ github.repository }}",
            "ref": "${{ github.sha }}",
            "lang": "rust",
            "test_cmd": "cargo test -p s2-sdk --all-features -- --skip access_token --skip metrics"
          }
        ]

  rust-sdk:
    name: Rust SDK
    needs: [test, clippy, changes]
    if: needs.changes.outputs.sdk == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Check docs
        run: cargo doc -p s2-sdk --all-features --no-deps
        env:
          RUSTDOCFLAGS: "-D warnings"
      - name: Run tests
        run: cargo test -p s2-sdk --all-features
        env:
          S2_ACCESS_TOKEN: ${{ secrets.S2_ACCESS_TOKEN_FOR_RUST_SDK_TESTS }}

  cli-integration-tests:
    name: CLI <> s2-lite Integration Tests
    needs: [build-server, test, clippy]
    uses: ./.github/workflows/sdk-tests.yml
    with:
      mode: local
      server-binary: server
      server-args: "--port 8080"
      server-port: 8080
      sdks: |
        [
          {
            "name": "cli",
            "repo": "${{ github.repository }}",
            "ref": "${{ github.sha }}",
            "lang": "rust",
            "test_cmd": "cargo test -p s2-cli --test integration -j 1"
          }
        ]