ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  # fmt · clippy · test · MSRV · cargo-deny · cargo-vet · secret scan ·
  # fuzz build-check · rustdoc · coverage · path-dep gate.
  ci:
    uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@9234e1fa9f85b14a8d6fddc7a8f7378f7e30b183
    with:
      # CARRIED ACROSS. The replaced test job ran on [ubuntu-latest, macos-latest]
      # — not windows, and not ubuntu alone. Until `test-os` existed this repo
      # could not adopt at all: `os-matrix: true` adds a platform it does not
      # support, `false` drops one it does. Either is a behaviour change smuggled
      # into an adoption PR, so the platform set is named explicitly and is
      # identical to before.
      test-os: '["ubuntu-latest","macos-latest"]'

      # MIGRATION DEBT — and the first coverage this repo has ever measured, as
      # the replaced workflow had no coverage job at all. There is no earlier
      # number to regress from. Measured at the fleet scope
      # (--workspace --all-features): 92.76% of 80,212 lines.
      #
      # The floor is 92, just under the measured value, so it holds the line
      # rather than granting slack. It is NOT the fleet's per-line gate: a floor
      # cannot honour a `// cov:unreachable` exemption and never names which
      # lines are uncovered, so the shared workflow renders it as debt and warns
      # on every run.
      #
      # REMOVE WHEN: the uncovered surface is tested (vol_compat.rs, at 76.81% of
      # lines, is the largest single gap) and this repo can inherit
      # `coverage-gate: strict`.
      coverage-gate: floor
      coverage-floor: 92

  # Repo-specific: mem4n6 ships as a static musl binary, and "it built" is not
  # the same claim as "it has no external dependencies". Carried over verbatim,
  # including the toolchain pin — a floating `stable` adds the musl target to the
  # wrong toolchain and the pinned build then fails with E0463.
  musl-static:
    name: Static musl binary
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      # Pin to rust-toolchain.toml's channel (1.96.0) so the musl target is added
      # to the SAME toolchain the build uses — a floating `stable` here adds the
      # target to the wrong toolchain and the pinned build fails with E0463.
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.96.0"
          targets: x86_64-unknown-linux-musl
      - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2
        with:
          cache-on-failure: true
      - run: sudo apt-get update && sudo apt-get install -y musl-tools
      - run: cargo build --release --target x86_64-unknown-linux-musl --bin mem4n6
      - name: Assert statically linked
        run: |
          BIN=target/x86_64-unknown-linux-musl/release/mem4n6
          file "$BIN"
          # Accept both classic static and static-PIE (self-contained + ASLR) — both have no external deps.
          file "$BIN" | grep -qE 'statically linked|static-pie linked' || { echo "::error::mem4n6 is NOT statically linked"; exit 1; }
          ldd "$BIN" 2>&1 | grep -qiE 'not a dynamic executable|statically linked' || { echo "::error::ldd reports dynamic linkage"; exit 1; }