ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

env:
  # This CLI calls user-scoped endpoints only. These steps are a tripwire,
  # not the access control: a literal reference to the platform-admin API in
  # the source or the built binary fails the build.
  ADMIN_API_PATTERN: "/api/admin|platform-admins|flagship"

jobs:
  checks:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: No admin API references in the source
        run: |
          # git grep exits 0 on a match, 1 on none, and anything else on error.
          # This file holds the pattern, so it is the one path excluded.
          rc=0
          git grep --text -niE "$ADMIN_API_PATTERN" -- ':!.github/workflows/ci.yml' || rc=$?
          if [ "$rc" -eq 0 ]; then
            echo "::error::admin API reference found in the source"
            exit 1
          elif [ "$rc" -ne 1 ]; then
            echo "::error::git grep failed with exit code $rc"
            exit "$rc"
          fi

      - name: Dependencies come from crates.io only
        run: |
          # cargo-deny misses both of these. A committed Cargo config can
          # replace the crates.io source, and a path dependency that declares
          # a version is not a wildcard.
          configs=$(git ls-files -- ':(glob)**/.cargo/config' ':(glob)**/.cargo/config.toml')
          if [ -n "$configs" ]; then
            echo "::error::committed Cargo config found: $configs"
            exit 1
          fi
          cargo metadata --locked --format-version 1 \
            | jq -e '([.packages[] | select(.source == null) | .id] - .workspace_members) == []' > /dev/null \
            || { echo "::error::path dependency outside the workspace"; exit 1; }

      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1

      - name: Format
        run: cargo fmt --all -- --check

      - name: Clippy
        run: cargo clippy --locked --all-targets -- -D warnings

  test:
    name: test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Test
        run: cargo test --locked

      - name: Build release binary
        run: cargo build --locked --release

      - name: No admin API references in the binary
        run: |
          # grep exits 0 on a match, 1 on none, and 2 on error (a missing binary included).
          rc=0
          grep -aoiE "$ADMIN_API_PATTERN" target/release/ck || rc=$?
          if [ "$rc" -eq 0 ]; then
            echo "::error::admin API reference found in the release binary"
            exit 1
          elif [ "$rc" -ne 1 ]; then
            echo "::error::grep failed with exit code $rc"
            exit "$rc"
          fi

      - name: Hit-path budget
        # ck run -- true may add at most 5 ms over true, against a cache
        # directory of about 10,000 entries.
        run: cargo test --locked --release --test bench -- --ignored --nocapture

  msrv:
    name: msrv (1.85)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install the rust-version toolchain
        run: rustup toolchain install 1.85 --profile minimal

      - name: Build on rust-version
        run: cargo +1.85 check --locked --all-targets