ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  check-test-coverage:
    name: Check, Test & Coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: cargo-ubuntu-check-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-ubuntu-
      - name: Cache cargo-llvm-cov
        id: cache-llvm-cov
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.cargo/bin/cargo-llvm-cov
          key: cargo-llvm-cov-${{ runner.os }}
      - name: Install Rust
        run: |
          rustup toolchain install stable --profile minimal --component clippy,rustfmt,llvm-tools-preview
          rustup default stable
      - name: Format check
        run: cargo fmt --check
      - name: Clippy
        run: cargo clippy --all-targets -- -D warnings
      - name: Install cargo-llvm-cov
        if: steps.cache-llvm-cov.outputs.cache-hit != 'true'
        run: cargo install cargo-llvm-cov
      - name: Test with coverage
        run: cargo llvm-cov --lcov --output-path lcov.info --ignore-filename-regex 'main\.rs|auth/' -- --test-threads=1
      - name: Coverage summary
        run: cargo llvm-cov report --ignore-filename-regex 'main\.rs|auth/'
      - name: Upload coverage artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-report
          path: lcov.info

  cross-compile-linux:
    name: Cross Compile (Linux)
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: "-C target-feature=+crt-static"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Install Rust
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable
          rustup target add x86_64-unknown-linux-musl aarch64-unknown-linux-musl
      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: cargo-ubuntu-cross-linux-musl-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-ubuntu-
      - uses: ./.github/actions/install-musl-toolchain
      - name: Build x86_64 musl
        run: cargo build --release --target x86_64-unknown-linux-musl --features vendored-openssl
      - name: Verify x86_64 static linkage
        run: |
          file target/x86_64-unknown-linux-musl/release/pup
          if readelf -d target/x86_64-unknown-linux-musl/release/pup | grep -q "(NEEDED)"; then
            echo "ERROR: binary has dynamic NEEDED entries"
            exit 1
          fi
      - name: Build aarch64 musl
        run: cargo build --release --target aarch64-unknown-linux-musl --features vendored-openssl
      - name: Verify aarch64 static linkage
        run: |
          file target/aarch64-unknown-linux-musl/release/pup
          if readelf -d target/aarch64-unknown-linux-musl/release/pup | grep -q "(NEEDED)"; then
            echo "ERROR: binary has dynamic NEEDED entries"
            exit 1
          fi
      - name: Report sizes
        run: |
          ls -lh target/x86_64-unknown-linux-musl/release/pup
          ls -lh target/aarch64-unknown-linux-musl/release/pup

  cross-compile-macos:
    name: Cross Compile (macOS)
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: cargo-cross-macos-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-cross-macos-
      - name: Install Rust
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable
          rustup target add x86_64-apple-darwin aarch64-apple-darwin
      - name: Build all targets
        run: |
          PIDS=()
          for target in x86_64-apple-darwin aarch64-apple-darwin; do
            (set -o pipefail
             echo "==> Starting ${target}"
             cargo build --release --target "${target}" 2>&1 \
               | tee "/tmp/${target}.log"
            ) &
            PIDS+=($!)
          done
          status=0
          for pid in "${PIDS[@]}"; do
            wait "$pid" || status=1
          done
          exit $status
      - name: Report sizes
        run: |
          for target in x86_64-apple-darwin aarch64-apple-darwin; do
            echo "${target}:"
            ls -lh "target/${target}/release/pup"
          done

  cross-compile-windows:
    name: Cross Compile (Windows)
    runs-on: windows-latest
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: cargo-windows-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-windows-
      - name: Enable long paths
        run: git config --global core.longpaths true
      - name: Install NASM
        run: |
          choco install nasm -y
          echo "C:\Program Files\NASM" >> "$GITHUB_PATH"
      - name: Install Rust
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable
      - name: Build
        run: cargo build --release
      - name: Run tests
        run: cargo test --verbose -- --test-threads=1
      - name: Report binary size
        run: ls -lh target/release/pup.exe

  wasm:
    name: WASM (WASI + Browser)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: cargo-ubuntu-wasm-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-ubuntu-
      - name: Install Rust
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable
          rustup target add wasm32-wasip2 wasm32-unknown-unknown
      - name: Cache wasm-pack
        id: cache-wasm-pack
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.cargo/bin/wasm-pack
          key: wasm-pack-${{ runner.os }}
      - name: Build WASI
        run: cargo build --target wasm32-wasip2 --no-default-features --features wasi --release
      - name: Install wasm-pack
        if: steps.cache-wasm-pack.outputs.cache-hit != 'true'
        run: cargo install wasm-pack
      - name: Build browser WASM
        run: wasm-pack build --target web --no-default-features --features browser
      - name: Report sizes
        run: |
          echo "WASI:"
          ls -lh target/wasm32-wasip2/release/pup.wasm
          echo "Browser WASM:"
          ls -lh pkg/pup_wasm_bg.wasm