ci.yml

name: CI

on:
  push:
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  # Lint levels live in `[lints]` in Cargo.toml so local and CI runs agree;
  # don't add a blanket RUSTFLAGS here.
  CARGO_TERM_COLOR: always

jobs:
  rust:
    name: Rust
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          # This job executes repository code (cargo build/test); don't persist
          # the token in git config.
          persist-credentials: false
          submodules: true

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - uses: Swatinem/rust-cache@v2

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Build
        run: cargo build --all-targets --all-features

      - name: Test
        run: cargo test --all-features

      - name: Test default features
        run: cargo test

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-llvm-cov

      - name: Enforce per-file line coverage
        shell: bash
        run: |
          set -euo pipefail
          report="target/coverage.json"
          cargo llvm-cov --all-features --all-targets --json --output-path "$report"

          # Anchored at the workspace root: this repo is vendored inside other
          # checkouts, so an unanchored "/vendor/" match would exclude the
          # crate's own sources when it is built from one of those paths.
          below_threshold="$(jq -r --arg root "$PWD" '
            .data[0].files[]
            | select(.filename | contains("/src/"))
            # Vendored submodules carry code from another repository, whose
            # coverage is not this one to enforce. They only entered the report
            # when the module crate made tinybus part of the build graph.
            # (No apostrophes here: the whole jq program is single-quoted.)
            | select(.filename | startswith($root + "/vendor/") | not)
            | select(.summary.lines.percent < 90)
            | "\(.filename): \(.summary.lines.percent)%"
          ' "$report")"

          if [[ -n "$below_threshold" ]]; then
            echo "Files below 90% line coverage:" >&2
            echo "$below_threshold" >&2
            exit 1
          fi


  module-e2e:
    name: TinyBus module E2E
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: true

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Build the loadable module
        run: cargo build --locked --release --package tinywallet-module

      # The only test that exercises the real cdylib, the ABI and manifest
      # gates, the dynamic loader and a broker routing frames. It asserts that
      # signing through the module equals signing in-process, byte for byte.
      - name: Load the module and sign on every chain
        env:
          TINYWALLET_TEST_MODULE: ${{ github.workspace }}/target/release/libtinywallet_module.so
        run: cargo test --locked --release --package tinywallet-module --test module_e2e -- --ignored

  docs:
    name: Docs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: true

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Build documentation
        env:
          RUSTDOCFLAGS: -D warnings
        run: cargo doc --no-deps --all-features

  msrv:
    name: Minimum supported Rust version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: true

      - name: Read rust-version from Cargo.toml
        id: msrv
        run: |
          set -euo pipefail
          msrv="$(cargo metadata --format-version 1 --no-deps \
            | jq -r '.packages[0].rust_version')"
          if [[ -z "$msrv" || "$msrv" == "null" ]]; then
            echo "package.rust-version is not set in Cargo.toml" >&2
            exit 1
          fi
          echo "version=$msrv" >> "$GITHUB_OUTPUT"

      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ steps.msrv.outputs.version }}

      - uses: Swatinem/rust-cache@v2

      # Scoped to the published library on purpose. `tinywallet-module` is
      # `publish = false` and depends on tinybus, whose macros use let-chains
      # and so need a newer compiler than this crate promises its consumers.
      # Holding the module to the library's MSRV would either fail here or
      # force the library's MSRV up for a crate nobody depends on.
      - name: Build with the declared MSRV
        run: cargo build --package tinywallet --all-targets --all-features

  supply-chain:
    name: Supply chain
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: true

      - name: Check advisories, licenses, bans, and sources
        uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check all