ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  scripts-tests:
    name: scripts tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

      - name: Run scripts unit tests
        run: |
          python3 -m unittest \
            scripts.tests.test_ci_workflows \
            scripts.tests.test_check_i18n_parity \
            scripts.tests.test_check_openharness_upstream \
            scripts.tests.test_verify_version_changelog \
            scripts.tests.test_verify_release_consistency \
            scripts.tests.test_resolve_release_tag \
            scripts.tests.test_provider_health_report \
            scripts.tests.test_package_release \
            scripts.tests.test_onboard_metrics_report

  versioning-guard:
    name: versioning guard (PR)
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Verify version/changelog rule
        run: |
          python3 scripts/verify_version_changelog.py \
            --base-ref "${{ github.event.pull_request.base.sha }}" \
            --head-ref "${{ github.sha }}"

  fmt:
    name: cargo fmt
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Format check
        run: cargo fmt --all --check

  secrets:
    name: gitleaks
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Scan for secrets
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_ENABLE_COMMENTS: "false"

  test:
    name: cargo test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Test
        run: cargo test --workspace --locked

  session-replay:
    name: session replay (fast) (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Test (session replay)
        run: cargo test -p rexos --locked --test session_replay

  loopforge-cli-fast:
    name: loopforge cli (fast) (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Test (loopforge-cli)
        run: cargo test -p loopforge-cli --locked

  bedrock-feature-compile:
    name: bedrock feature compile (fast)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Check (loopforge-cli with bedrock)
        run: cargo check -p loopforge-cli --locked --features bedrock

  security-boundaries-fast:
    name: security boundaries (fast) (windows)
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Test (rexos-tools web/a2a/browser policy slices)
        run: |
          cargo test -p rexos-tools --locked tests::web::a2a::
          cargo test -p rexos-tools --locked tests::web::fetch::web_fetch_respects_egress_policy_rules
          cargo test -p rexos-tools --locked tests::browser::policy::url::

  msrv-compile:
    name: msrv compile (rust 1.75.0)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust 1.75.0
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: 1.75.0

      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Check (workspace, locked)
        run: cargo check --workspace --locked

  clippy-workspace:
    name: clippy workspace (all targets)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Clippy (workspace, all targets)
        run: cargo clippy --workspace --all-targets --locked -- -D warnings

  docs:
    name: docs build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.x"
          cache: pip
          cache-dependency-path: requirements-docs.txt

      - name: Install docs dependencies
        run: pip install -r requirements-docs.txt

      - name: Build docs
        run: python -m mkdocs build --strict