ci.yml

name: CI

on:
  push:
    branches: [master, main]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  fmt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Format
        run: cargo fmt --all --check

  clippy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Cache cargo
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: |
            crates/workshop/package-lock.json
            crates/gateway/*/ui/package-lock.json

      - name: Install UI dependencies
        run: |
          npm ci --prefix crates/workshop
          npm ci --prefix crates/gateway/config-ui/ui

      - name: Build Gateway without Workshop UI tooling
        run: cargo build --locked -p gateway

      - name: Clippy
        env:
          CARGO_BUILD_WARNINGS: deny
        run: cargo clippy --workspace --exclude workshop --exclude workshop-server --exclude workshop-server-api --all-targets --all-features

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install cargo-nextest
        uses: taiki-e/install-action@4dc1969decfa71b34f25aa7f3dd4656654d9ad1e # nextest

      - name: Cache cargo
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: |
            crates/workshop/package-lock.json
            crates/gateway/*/ui/package-lock.json

      - name: Install UI dependencies
        run: |
          npm ci --prefix crates/workshop
          npm ci --prefix crates/gateway/config-ui/ui

      - name: Test (concurrent via nextest)
        run: cargo nextest run --locked --workspace --exclude workshop --exclude workshop-server --exclude workshop-server-api --all-features

      - name: Check headless gateway
        run: cargo check -p gateway --no-default-features

      # No build step may write into the repository (the UI bundles build
      # into OUT_DIR now); catch a regression here rather than in a diff.
      - name: Clean tree
        shell: bash
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "the build dirtied the repository:"
            git status --porcelain
            exit 1
          fi

  docs:
    runs-on: ubuntu-latest
    env:
      RUSTDOCFLAGS: -D warnings
    steps:
      - uses: actions/checkout@v4

      - name: Cache cargo
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: |
            crates/workshop/package-lock.json
            crates/gateway/*/ui/package-lock.json

      - name: Install UI dependencies
        run: |
          npm ci --prefix crates/workshop
          npm ci --prefix crates/gateway/config-ui/ui

      - name: Docs
        run: cargo doc --workspace --no-deps --all-features --exclude workshop --exclude workshop-server --exclude workshop-server-api

      # Each facade as consumers read it and as the docs site publishes it: the
      # topic docs build alone, with default features.
      - name: Facade docs
        run: cargo doc -p runvil --no-deps

      - name: Harness facade docs
        run: cargo doc -p harness --no-deps

      - name: Engine docs (private items)
        run: cargo doc --locked --no-deps --all-features -p runvil-engine --document-private-items

  check-workshop:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install cargo-nextest
        uses: taiki-e/install-action@4dc1969decfa71b34f25aa7f3dd4656654d9ad1e # nextest

      - name: Cache cargo
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: |
            crates/workshop/package-lock.json
            crates/gateway/*/ui/package-lock.json

      - name: Install UI dependencies
        run: |
          npm ci --prefix crates/workshop
          npm ci --prefix crates/gateway/config-ui/ui

      - name: Build featureless Gateway
        run: cargo build --locked -p gateway --no-default-features

      - name: Stage Gateway sidecar
        run: node tools/stage-gateway-sidecar.mjs stage --target x86_64-pc-windows-msvc --source target/debug/runvil-gateway.exe

      # workshop-server-api is the desktop app's re-export view of workshop-server,
      # so it runs in this partition with the crates it fronts and stays
      # out of the workspace-wide jobs like them.
      - name: Clippy (workshop)
        env:
          CARGO_BUILD_WARNINGS: deny
        run: cargo clippy -p workshop -p workshop-server -p workshop-server-api --all-targets

      # One build runs every Windows-only test: the Workshop crates' suites
      # (the workspace jail's Windows paths included) and the gateway's
      # process-ownership races, the only tests the filter selects from the
      # gateway and gateway-api-discovery suites.
      - name: Test (Windows)
        shell: bash
        run: >-
          cargo nextest run --locked --no-default-features --features gateway/test-fixtures
          -p workshop -p workshop-server -p workshop-server-api -p workshop-workspace
          -p gateway-api-discovery -p gateway
          -E 'package(workshop) | package(workshop-server) | package(workshop-server-api)
          | package(workshop-workspace)
          | (package(gateway-api-discovery) & test(a_process_lifetime_lease_recovers_after_its_owner_is_terminated))
          | (package(gateway) & binary(it) & (test(simultaneous_direct_launches_leave_one_owner_and_one_clean_handoff)
          | test(workshop_launch_lock_and_direct_launch_do_not_deadlock_or_double_boot)
          | test(a_direct_launch_recovers_the_lease_from_a_terminated_owner)
          | test(a_silent_process_lease_owner_causes_a_bounded_console_only_failure)))'

      - name: Docs (workshop-server, private items)
        env:
          RUSTDOCFLAGS: -D warnings
        run: cargo doc --locked --no-deps -p workshop-server --document-private-items

      - name: Remove Gateway sidecar
        if: always()
        run: node tools/stage-gateway-sidecar.mjs remove --target x86_64-pc-windows-msvc

      - name: Clean tree
        shell: bash
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "the build dirtied the repository:"
            git status --porcelain
            exit 1
          fi

  # First Linux build of the desktop app: compile-only, against the Tauri
  # system packages a Linux developer installs. Catches the
  # missing-system-package class of failure the Windows-only job cannot see.
  check-workshop-linux:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: Cache cargo
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2

      - name: Install Tauri system packages
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends libwebkit2gtk-4.1-dev libssl-dev librsvg2-dev

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: |
            crates/workshop/package-lock.json
            crates/gateway/*/ui/package-lock.json

      - name: Install UI dependencies
        run: |
          npm ci --prefix crates/workshop
          npm ci --prefix crates/gateway/config-ui/ui

      - name: Build featureless Gateway
        run: cargo build --locked -p gateway --no-default-features

      - name: Stage Gateway sidecar
        run: node tools/stage-gateway-sidecar.mjs stage --target x86_64-unknown-linux-gnu --source target/debug/runvil-gateway

      - name: Build (workshop, Linux)
        run: cargo build --locked -p workshop

      - name: Remove Gateway sidecar
        if: always()
        run: node tools/stage-gateway-sidecar.mjs remove --target x86_64-unknown-linux-gnu

      - name: Clean tree
        shell: bash
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "the build dirtied the repository:"
            git status --porcelain
            exit 1
          fi

  # The UI build is its own job: typecheck, bundle, and test. The cargo
  # jobs drive the same bundle through the crates' build scripts, hence
  # their npm ci.
  ui:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: |
            crates/workshop/package-lock.json
            crates/gateway/*/ui/package-lock.json

      - name: Install UI dependencies
        working-directory: crates/workshop
        run: npm ci

      - name: Typecheck
        working-directory: crates/workshop
        run: npm run typecheck --workspaces --if-present

      - name: Build
        working-directory: crates/workshop
        run: npm run build --workspace ui

      - name: Test
        working-directory: crates/workshop
        run: npm test --workspaces --if-present

      - name: Install config UI dependencies
        working-directory: crates/gateway/config-ui/ui
        run: npm ci

      - name: Typecheck config UI
        working-directory: crates/gateway/config-ui/ui
        run: npm run typecheck

      - name: Build config UI
        working-directory: crates/gateway/config-ui/ui
        run: npm run build

      - name: Test config UI
        working-directory: crates/gateway/config-ui/ui
        run: npm test

  supply-chain:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2
        with:
          tool: cargo-deny, cargo-audit

      - name: cargo deny
        run: cargo deny check

      - name: cargo audit
        run: cargo audit

      # The gateway holds vendor credentials, so it links exactly one rustls
      # crypto backend, aws-lc-rs. This fails when `ring` re-enters its
      # normal-edge closure (through a reqwest bump or a Tauri plugin default)
      # and when `cargo tree` itself cannot run; only a successful, ring-free
      # result passes.
      - name: One rustls crypto backend in the gateway
        shell: bash
        run: |
          set -euo pipefail
          if ! out="$(cargo tree --locked -p gateway -e normal -i ring --depth 0 2>&1)"; then
            echo "cargo tree failed:"
            printf '%s\n' "$out"
            exit 1
          fi
          if printf '%s\n' "$out" | grep -v '^warning: nothing to print' | grep -q '^ring v'; then
            echo "ring is linked into the gateway; aws-lc-rs is the only permitted rustls backend"
            printf '%s\n' "$out"
            exit 1
          fi

  # `cargo xtask api` reads rustdoc JSON, which only a nightly emits, so this
  # job runs on the nightly pinned in crates/build-xtask/src/api/toolchain.rs.
  # The date is read from that constant, never repeated here, so the two
  # cannot drift; exporting it as RUSTUP_TOOLCHAIN puts every cargo below on it.
  api-surface:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Read the pinned nightly
        id: pin
        shell: bash
        run: |
          set -euo pipefail
          nightly="$(sed -n 's/^ *nightly: "\(nightly-[0-9-]*\)",.*$/\1/p' crates/build-xtask/src/api/toolchain.rs)"
          case "$nightly" in
            nightly-[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]) ;;
            *)
              echo "expected one pinned nightly in crates/build-xtask/src/api/toolchain.rs, found: '$nightly'"
              exit 1
              ;;
          esac
          echo "nightly=$nightly" >> "$GITHUB_OUTPUT"
          echo "RUSTUP_TOOLCHAIN=$nightly" >> "$GITHUB_ENV"

      - name: Install the pinned nightly
        run: rustup toolchain install "${{ steps.pin.outputs.nightly }}" --profile minimal

      - name: Install cargo-nextest
        uses: taiki-e/install-action@4dc1969decfa71b34f25aa7f3dd4656654d9ad1e # nextest

      - name: Cache cargo
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2

      - name: Surface closure and listing
        run: cargo xtask api --check

      - name: Nightly-only fixtures
        run: cargo nextest run --locked -p build-xtask --run-ignored only

  # The Engine crates inherit `rust-version` from the root Cargo.toml's
  # [workspace.package]; this job builds them at that toolchain. The version
  # is read from the manifest, never repeated here, so the two cannot drift.
  msrv:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Read the declared floor
        id: floor
        shell: bash
        run: |
          set -euo pipefail
          floor="$(sed -n 's/^rust-version = "\([0-9.]*\)"$/\1/p' Cargo.toml)"
          if [[ ! "$floor" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
            echo "expected one rust-version in the root Cargo.toml, found: '$floor'"
            exit 1
          fi
          echo "floor=$floor" >> "$GITHUB_OUTPUT"
          echo "RUSTUP_TOOLCHAIN=$floor" >> "$GITHUB_ENV"

      - name: Install the floor toolchain
        run: rustup toolchain install "${{ steps.floor.outputs.floor }}" --profile minimal

      - name: Cache cargo
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2

      - name: Build the Engine crates at the floor
        run: cargo build --locked -p runvil -p runvil-engine -p runvil-lua -p runvil-parser -p runvil-types -p runvil-vfs -p runvil-model-client

  # Single required status check for branch protection: it fails when any
  # job fails or is cancelled, so a cancelled job cannot read as green.
  # needs: is a static list, so every newly added job must be added to it
  # or that job bypasses this gate.
  ci-green:
    runs-on: ubuntu-latest
    needs: [fmt, clippy, test, docs, check-workshop, check-workshop-linux, ui, supply-chain, api-surface, msrv]
    if: always()
    steps:
      - name: Verify every job succeeded
        shell: bash
        run: |
          status=0
          for result in ${{ join(needs.*.result, ' ') }}; do
            if [ "$result" != "success" ]; then
              echo "a required job did not succeed: $result"
              status=1
            fi
          done
          exit $status