ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Cancel in-flight PR runs when a newer commit lands on the same ref.
# `main` pushes don't cancel — we want every commit on main to produce a
# completed run for telemetry / status-badge purposes.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always
  # Fail fast on any rustc warning across all jobs that compile code.
  # `cargo fmt --check` and clippy carry their own -D flags below;
  # this catches stray warnings the test build would otherwise tolerate.
  RUSTFLAGS: "-D warnings"

jobs:
  fmt:
    name: rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --all-targets -- -D warnings

  # The release-critical guard for bugsee/bugsee-cli#20. Nothing else in this
  # repo compiles aarch64-pc-windows-msvc before a tag push (`pr-run-mode =
  # "plan"` means the PR Release run only plans), and dist's `host` job needs
  # EVERY build-local-artifacts leg — so a leg that fails only at tag time means
  # no GitHub Release, and therefore no S3 mirror and no npm publish, since both
  # chain off `workflow_run.conclusion == 'success'`. Catch it on the PR instead.
  #
  # Runs NATIVELY on windows-11-arm rather than cross-compiling: under
  # cargo-xwin, `ring` assembles its ARM64 Windows `.S` files with the plain
  # `clang` driver and chokes on MSVC-style `/imsvc` include flags. Same reason
  # `[workspace.metadata.dist.github-custom-runners]` pins the release leg there.
  build-win-arm64:
    name: build aarch64-pc-windows-msvc
    runs-on: windows-11-arm
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-pc-windows-msvc
      - uses: Swatinem/rust-cache@v2
      # Build only: the `test` job above covers behaviour, and this job exists
      # to prove the target still compiles — ring/zstd-sys/zip/flate2 included.
      # The `test` matrix now RUNS the suite on windows-11-arm, so this job is back to what it
      # says: proof that the release profile still links for the target it ships.
      - run: cargo build --release --target aarch64-pc-windows-msvc
      # One command per step ON PURPOSE. The default shell here is pwsh, where a
      # NATIVE command's non-zero exit does not abort the script — GitHub only
      # inspects $LASTEXITCODE after the whole thing runs. Both commands in one
      # step would let `--version` crash and still report green as long as the
      # last line succeeded, which is precisely the failure this job exists to
      # keep out of a tag release.
      - name: Smoke-test --version on its native host
        run: .\target\aarch64-pc-windows-msvc\release\bugsee-cli.exe --version
      - name: Smoke-test stdout purity on its native host
        run: .\target\aarch64-pc-windows-msvc\release\bugsee-cli.exe vcs-metadata

  # install.ps1 gained an ARM64 arch arm; a parse error there is invisible on
  # Linux and only shows up when a user runs the installer.
  installer-ps1-parses:
    name: install.ps1 parses
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v7
      - name: Parse installer/install.ps1
        shell: pwsh
        run: |
          $errors = $null
          $null = [System.Management.Automation.Language.Parser]::ParseFile(
            (Resolve-Path ./installer/install.ps1), [ref]$null, [ref]$errors)
          if ($errors) { $errors | ForEach-Object { $_.Message }; exit 1 }
          Write-Host "install.ps1 parses clean"

  # Runs on macOS as well as Linux. Some tests need the Apple toolchain to say
  # anything: `xcode upload-dsyms`'s upload coverage builds a real `.dSYM` with
  # clang + dsymutil, because a fabricated bundle is rejected by
  # `dsym::identify` and skipped before any network call — on Linux those tests
  # skip themselves, so an ubuntu-only matrix would leave the command's actual
  # job unverified in CI.
  # `npm/bootstrap-names.sh` decides whether a package is correctly configured
  # for OIDC publishing. A wrong answer is invisible until a release 404s
  # halfway through the publish loop, and its `other` branch tells an operator
  # to REVOKE a trust entry — so the classifier needs its fixtures run on every
  # change, not just on whoever last touched it.
  #
  # No network, npm or auth: the fixtures stand in for `npm trust list`.
  npm-scripts:
    name: npm scripts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: shellcheck
        # Print the version: the codes for "this function is never invoked"
        # differ between shellcheck generations (SC2317 before 0.10, SC2329
        # after), so a failure here is much easier to read with it in the log.
        run: |
          shellcheck --version
          shellcheck npm/bootstrap-names.sh npm/test-bootstrap-names.sh
      - name: trust_state fixtures
        run: bash npm/test-bootstrap-names.sh

  test:
    name: test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # windows-latest runs the suite on the platform this ships to. It was absent for a long
        # time, and the Windows leg was a build-only job, so 500+ tests had never executed there —
        # a test using a Unix-only API passed every check while breaking `cargo test` for every
        # Windows developer.
        # BOTH Windows architectures run the whole suite: x64 and the native ARM64 runner. The
        # release ships both, and they differ in more than instruction set — `ring`'s ARM64 Windows
        # assembly is why the release leg is pinned to a native runner rather than cross-compiled.
        os: [ubuntu-latest, macos-latest, windows-latest, windows-11-arm]
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --all-targets
      # No `cargo test --doc` step: `bugsee-cli` is a binary-only crate
      # (no `[lib]` target), so doctests don't exist. If we ever split out
      # a reusable library crate, add the step back here.