CI.yml

name: CI

on:
  push:
    branches:
      - main
    paths-ignore:
      - '**/*.md'
      - LICENSE
      - '**/*.gitignore'
      - .editorconfig
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    container:
      image: xd009642/tarpaulin:develop-nightly
      options: --security-opt seccomp=unconfined
    steps:
      - uses: actions/checkout@v6
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - uses: actions-rust-lang/setup-rust-toolchain@v1
      - name: Install
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      - name: Build
        run: cargo check
      - name: Lint
        run: cargo clippy --all-targets --all-features -- -D warnings
      - name: Test Deploy
        run: cargo publish --dry-run
      - name: Doctest
        # tarpaulin's --all-targets / default run never compiles doc
        # tests, which let a never-passing doctest land unnoticed —
        # run them explicitly before the (slow) coverage step.
        run: cargo test --workspace --doc
      - name: Test
        run: |
          # rust coverage issue
          echo 'max_width = 100000' > .rustfmt.toml
          echo 'tab_spaces = 4' >> .rustfmt.toml
          echo 'newline_style = "Unix"' >> .rustfmt.toml
          echo 'fn_call_width = 100000' >> .rustfmt.toml
          echo 'fn_params_layout = "Compressed"' >> .rustfmt.toml
          echo 'chain_width = 100000' >> .rustfmt.toml
          echo 'merge_derives = true' >> .rustfmt.toml
          echo 'use_small_heuristics = "Default"' >> .rustfmt.toml
          cargo fmt
          cargo tarpaulin --out Lcov Stdout --engine llvm
      - name: Upload to codecov.io
        uses: codecov/codecov-action@v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true
          files: lcov.info
        if: github.ref == 'refs/heads/main'

  # publish
  changepacks:
    name: changepacks
    runs-on: ubuntu-latest
    # jni-e2e gates publishing: a release must never ship with a broken
    # JNI dispatch path on any supported OS.
    needs: [test, jni-e2e]
    permissions:
      # create pull request comments
      pull-requests: write

      # Actions > General > Workflow permissions for creating pull request
      # Create branch to create pull request
      contents: write

      # Publish to GitHub Packages
      packages: write
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '17'
      - name: Make gradlew executable
        # Both Java packages need their gradlew runnable — changepacks
        # invokes `./gradlew publish` from each project directory.
        run: |
          chmod +x libs/vespera-bridge/gradlew
          chmod +x libs/vespera-bridge-gradle-plugin/gradlew
      - uses: changepacks/action@main
        id: changepacks
        with:
          publish: true
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
          GITHUB_ACTOR: ${{ github.actor }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Maven Central (Central Portal) credentials
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          # GPG signing (in-memory key, no keyring file)
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.GPG_SIGNING_KEY }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_SIGNING_PASSWORD }}
          # Gradle Plugin Portal credentials (read natively by
          # com.gradle.plugin-publish for the `publishPlugins` task)
          GRADLE_PUBLISH_KEY: ${{ secrets.GRADLE_PUBLISH_KEY }}
          GRADLE_PUBLISH_SECRET: ${{ secrets.GRADLE_PUBLISH_SECRET }}
    outputs:
      changepacks: ${{ steps.changepacks.outputs.changepacks }}
      release_assets_urls: ${{ steps.changepacks.outputs.release_assets_urls }}

  # JNI end-to-end tests — builds the rust-jni-demo cdylib, publishes the
  # vespera-bridge JAR to mavenLocal (so the demo-app Gradle plugin can
  # resolve kr.devfive:vespera-bridge:0.1.1), then runs the full
  # :demo-app:test suite (StreamingClosureStressTest + JNI dispatch tests)
  # across all three target host OSes. This is the project's only Java/JNI
  # coverage gate — until now the workflow ran zero JNI tests.
  #
  # Runs unconditionally on every push/PR (matching the existing CI job's
  # style — no per-job paths-filter). The whole workflow already inherits
  # the workflow-level `paths-ignore` for docs-only changes.
  jni-e2e:
    name: JNI E2E (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '17'
          cache: 'gradle'
      - uses: actions-rust-lang/setup-rust-toolchain@v1
      - name: Build rust-jni-demo cdylib (release)
        # The vespera-bridge Gradle plugin's bundleNativeLib task copies
        # this cdylib from target/release into demo-app's resources, so it
        # must exist before `:demo-app:test` (processResources) runs.
        run: cargo build -p rust-jni-demo --release
      - name: Make gradlew executable (unix)
        if: runner.os != 'Windows'
        run: |
          chmod +x libs/vespera-bridge/gradlew
          chmod +x libs/vespera-bridge-gradle-plugin/gradlew
          chmod +x examples/rust-jni-demo/java/gradlew
      - name: Publish vespera-bridge Gradle plugin to mavenLocal
        # demo-app's plugins block resolves kr.devfive.vespera-bridge from
        # mavenLocal (settings.gradle.kts pluginManagement) — the plugin is
        # not on the Gradle Plugin Portal.
        shell: bash
        working-directory: libs/vespera-bridge-gradle-plugin
        run: ./gradlew publishToMavenLocal --console=plain --no-daemon
      - name: Publish vespera-bridge to mavenLocal
        # demo-app resolves kr.devfive:vespera-bridge:0.1.1 from mavenLocal
        # (see examples/rust-jni-demo/java/demo-app/build.gradle.kts —
        # bridgeVersion.set("0.1.1")).
        shell: bash
        working-directory: libs/vespera-bridge
        run: ./gradlew publishToMavenLocal --console=plain --no-daemon
      - name: Run demo-app JNI E2E tests
        # Includes StreamingClosureStressTest (1000 × 1 MiB SHA256
        # bidirectional round-trip). Bench knobs are NOT propagated —
        # gated bench tests stay skipped in CI.
        shell: bash
        working-directory: examples/rust-jni-demo/java
        run: ./gradlew :demo-app:test --console=plain --no-daemon
      - name: Upload demo-app test results
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: jni-e2e-${{ matrix.os }}-test-results
          path: examples/rust-jni-demo/java/demo-app/build/test-results/test/*.xml