rust.yml

name: Rust (Library & CLI)

on:
  push:
    branches: [main]
    tags: ["*"]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

env:
  RUST_BACKTRACE: 1
  CARGO_TERM_COLOR: always
  CARGO_NET_RETRY: 10
  RUSTUP_MAX_RETRIES: 10
  UV_HTTP_RETRIES: 5
  UV_HTTP_TIMEOUT: 60

jobs:
  plan:
    runs-on: ubuntu-slim
    outputs:
      test: ${{ steps.decisions.outputs.test }}
      gate: ${{ steps.decisions.outputs.gate }}
      lint_and_format: ${{ steps.decisions.outputs.lint_and_format }}
    steps:
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        if: github.event_name == 'pull_request'
        id: filter
        with:
          filters: |
            src:
              - 'core/**'
              - 'macros/**'
              - 'sysand/**'
              - 'Cargo.*'
              - '.github/workflows/rust.yml'
            rs_src:
              - '**/Cargo.*'
              - '**/*.rs'
      - id: decisions
        run: |
          test=${{ steps.filter.outputs.src == 'true' || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
          gate=${{ github.event_name == 'pull_request' }}
          echo "test=$test" >> "$GITHUB_OUTPUT"
          echo "gate=$gate" >> "$GITHUB_OUTPUT"

          lint_and_format=${{ steps.filter.outputs.rs_src == 'true' || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
          echo "lint_and_format=$lint_and_format" >> "$GITHUB_OUTPUT"

  lint-and-format:
    needs: [plan]
    if: needs.plan.outputs.lint_and_format == 'true'
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1

      - uses: taiki-e/install-action@921a4027af787cda265c4f334a0f7f89b21d72e9 # v2.75.8
        with:
          tool: cargo-hack

      # cargo clippy is run with variants of features enabled, where
      # --all-features is done by prek so we don't do it here

      - name: cargo clippy ... (no features)
        run: cargo clippy --workspace --locked --all-targets -- --deny warnings

      - name: cargo clippy --features std,filesystem,alltests ...  (specific feature set 1)
        run: cargo clippy --workspace --locked --all-targets --no-default-features --features std,filesystem,alltests -- --deny warnings

      - name: cargo clippy --features std,networking,alltests ... (specific feature set 2)
        run: cargo clippy --workspace --locked --all-targets --no-default-features --features std,networking,alltests -- --deny warnings

      # since we use --no-dev-deps below (as recommended), we don't do
      # --all-targets to include tests with required development dependencies
      - name: cargo hack clippy --each-feature ... (individual features)
        run: cargo hack clippy --each-feature --no-dev-deps --features std --ignore-unknown-features -- --deny warnings

  test:
    needs: [plan]
    if: needs.plan.outputs.test == 'true'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-24.04
          - ubuntu-24.04-arm
          - windows-latest
          - windows-11-arm
          - macos-15-intel # x86
          - macos-latest # arm64

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1

      - name: cargo test ... (Rust library & CLI)
        run: >-
          cargo test --locked
          --package sysand-core
          --package sysand
          --features sysand-core/filesystem,sysand-core/networking,sysand-core/js,sysand-core/python,alltests,kpar-bzip2,kpar-zstd,kpar-xz,kpar-ppmd

  build:
    needs: [test]
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os:
          - ubuntu-24.04
          - ubuntu-24.04-arm
          - windows-latest
          - windows-11-arm
          - macos-15-intel # x86
          - macos-latest # arm64
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1

      - name: cargo build ...
        run: cargo build --locked --bin sysand --release

      - name: Relocate binaries
        run: |
          mkdir -p dist
          ext=${{ (matrix.os == 'windows-latest' || matrix.os == 'windows-11-arm') && '.exe' || '' }}
          cp target/release/sysand${ext} dist/sysand-${{ matrix.os }}${ext}

      - name: Upload binaries
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sysand-cli-${{ matrix.os }}
          path: dist
          if-no-files-found: error

  ci-gate:
    name: Rust CI Gate
    needs: [plan, lint-and-format, test, build]
    if: needs.plan.outputs.gate == 'true' && !cancelled()
    runs-on: ubuntu-slim
    steps:
      - run: |
          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]]; then
            exit 1
          fi

  nightly-release:
    name: Nightly Release
    needs: [test, build]
    if: github.ref == 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-24.04
    permissions:
      id-token: write # for actions/attest
      attestations: write # for actions/attest
      artifact-metadata: write # for actions/attest
      contents: write # for "gh release create"

    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: artifacts
          merge-multiple: true

      - name: Generate artifact attestation
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-path: "artifacts/*"

      - name: Rename artifacts
        run: |
          mv artifacts/sysand-ubuntu-24.04 artifacts/sysand-linux-x86_64
          mv artifacts/sysand-ubuntu-24.04-arm artifacts/sysand-linux-arm64
          mv artifacts/sysand-windows-latest.exe artifacts/sysand-windows-x86_64.exe
          mv artifacts/sysand-windows-11-arm.exe artifacts/sysand-windows-arm64.exe
          mv artifacts/sysand-macos-15-intel artifacts/sysand-macos-x86_64
          mv artifacts/sysand-macos-latest artifacts/sysand-macos-arm64

      - name: Create a nightly release
        run: |
          NEW_TAG=$(date +v-%Y-%m-%d-%H%M)
          gh release create "$NEW_TAG" \
              --title "Nightly Release $NEW_TAG" \
              --prerelease \
              --target "$GITHUB_SHA" \
              artifacts/*
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}

  release:
    name: Release
    needs: [test, build]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-24.04
    permissions:
      id-token: write # for actions/attest
      attestations: write # for actions/attest
      artifact-metadata: write # for actions/attest
      contents: write # for "gh release create"

    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: artifacts
          merge-multiple: true

      - name: Generate artifact attestation
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-path: "artifacts/*"

      - name: Rename artifacts
        run: |
          mv artifacts/sysand-ubuntu-24.04 artifacts/sysand-linux-x86_64
          mv artifacts/sysand-ubuntu-24.04-arm artifacts/sysand-linux-arm64
          mv artifacts/sysand-windows-latest.exe artifacts/sysand-windows-x86_64.exe
          mv artifacts/sysand-windows-11-arm.exe artifacts/sysand-windows-arm64.exe
          mv artifacts/sysand-macos-15-intel artifacts/sysand-macos-x86_64
          mv artifacts/sysand-macos-latest artifacts/sysand-macos-arm64

      - name: Create a release
        run: |
          gh release create "$TRIGGERING_TAG" \
              --title "Release $TRIGGERING_TAG" \
              --verify-tag \
              artifacts/*
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          TRIGGERING_TAG: ${{ github.ref_name }}