ci.yml

# SPDX-FileCopyrightText: The Ferrocene Developers
# SPDX-License-Identifier: MIT OR Apache-2.0

---

name: CI
on:
  push:
    branches: [staging, trying]
  pull_request: {}

permissions:
  # Allow write access to the source code to enable GitHub Pages publishing.
  contents: read

jobs:
  build-test:
    name: Build and test
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      # Windows seems to have an existing non-RustUp tools in `~/.cargo/bin/` which have to be removed
      - if: ${{ matrix.os == 'windows-latest' }}
        shell: bash
        run: |
          rm -rv C://Users/runneradmin/.cargo/bin/rust-analyzer.exe
          rm -rv C://Users/runneradmin/.cargo/bin/rustfmt.exe
          rm -rv C://Users/runneradmin/.cargo/bin/cargo-fmt.exe
      - name: Make sure Rust stable is installed
        shell: bash
        run: |
          rustup update stable --no-self-update
          rustup default stable

      - name: Cache Rust dependencies
        uses: ferrous-systems/shared-github-actions/cache-rust@main

      - name: Check formatting
        if: ${{ matrix.os == 'ubuntu-latest' }}  
        shell: bash
        run: cargo fmt --all --check

      - name: Check Clippy warnings
        shell: bash
        run: cargo clippy --workspace --tests --locked -- -Dwarnings

      - name: Prepare file to record snapshots used by insta
        shell: bash
        run: echo "INSTA_SNAPSHOT_REFERENCES_FILE=$(mktemp)" >> "${GITHUB_ENV}"

      - name: Run the test suite (Without AWS KMS)
        if: ${{ runner.os != 'Linux' }}
        shell: bash
        run: cargo test --timings --workspace --locked

      - name: Run the test suite (With AWS KMS)
        if: ${{ runner.os == 'Linux' }}
        shell: bash
        run: cargo test --timings --workspace --locked --features aws-kms -- --test-threads=1

      # Incompatible with Windows, insta snapshots output Windows paths
      # Incompatible with Mac, find does not have `-n`, diff does not have `--color`
      - if: ${{ matrix.os == 'ubuntu-latest' }}
        name: Ensure there are no unused insta snapshots
        shell: bash
        run: diff -u --color <(find -name "*.snap" | xargs realpath | sort | uniq) <(cat "${INSTA_SNAPSHOT_REFERENCES_FILE}" | xargs realpath | sort | uniq)

      - name: Build debug builds
        shell: bash
        run: cargo build --workspace

      - name: Upload criticalup debug build
        uses: actions/upload-artifact@v4
        with:
          name: criticalup-${{ matrix.os }}
          path: target/debug/criticalup${{ (runner.os == 'Windows' && '.exe') || '' }}
          retention-days: 7

      - name: Upload upload criticalup-dev debug build
        uses: actions/upload-artifact@v4
        with:
          name: criticalup-dev-${{ matrix.os }}
          path: target/debug/criticalup-dev${{ (runner.os == 'Windows' && '.exe') || '' }}
          retention-days: 7

      - name: Upload cargo timings
        uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-${{ matrix.os }}
          path: target/cargo-timings/cargo-timing.html
          retention-days: 7

  runner-test:
    name: Test CriticalUp on GHA Runners
    needs: [build-test]
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    env:
      CRITICALUP_TOKEN: ${{ secrets.CRITICALUP_TOKEN }}
    steps:
      - name: "Define toolchain"
        shell: bash # Powershell does not do heredocs
        run: |
          mkdir -p crab-boil
          cd crab-boil
          cat <<- EOF > criticalup.toml
            manifest-version = 1

            [products.ferrocene]
            release = "stable-24.11.0"
            packages = [
                "cargo-\${rustc-host}",
                "rustc-\${rustc-host}",
                "rust-std-\${rustc-host}",
            ]
          EOF

      - uses: actions/download-artifact@v4
        with:
          name: criticalup-${{ matrix.os }}
          path: crab-boil

      - name: Make executable
        if: ${{ runner.os != 'Windows' }}
        working-directory: crab-boil
        run: chmod +x ./criticalup

      - name: Auth Criticalup
        working-directory: crab-boil
        run: ./criticalup auth set $CRITICALUP_TOKEN


      - name: Install toolchain
        working-directory: crab-boil
        run: |
          ./criticalup install

      - name: Run test workflow
        working-directory: crab-boil
        run: |
          ./criticalup run -- cargo init
          
          ./criticalup run -- cargo build
          
          ./criticalup run -- cargo run

          ./criticalup which rustc

          ./criticalup remove

          ./criticalup clean

      # Windows allows the `.exe` or not, at the users option.
      - name: Run Windows exclusive commands
        if: ${{ runner.os == 'Windows' }}
        working-directory: crab-boil
        run: |
            ./criticalup.exe run -- cargo --version
            ./criticalup run -- cargo.exe --version
            ./criticalup.exe run -- cargo.exe --version

  license:
    name: Check licenses
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install REUSE
        run: pipx install reuse

      - name: Check compliance with REUSE
        run: reuse lint

  docs:
    name: Build documentation
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout the source code
        uses: actions/checkout@v4

      - name: Build documentation and check links
        working-directory: ./docs
        run: ./make.py --check-links

      - name: Install Python dependencies
        working-directory: ./docs
        run: python3 -m pip install reuse black flake8

      - name: Verify Python code formatting
        working-directory: ./docs
        run: black . --check --diff --color

      - name: Lint Python code with flake8
        working-directory: ./docs
        run: flake8 . --exclude .venv

      - name: Upload GitHub Pages artifact
        uses: actions/upload-pages-artifact@v3
        with:
          path: docs/build/html

  deploy-docs:
    if: github.event_name == 'push' && github.ref == 'refs/heads/staging'
    needs:
      - docs
    environment:
      name: github-pages
      url: ${{ steps.github-pages.outputs.page_url }}
    # Grant GITHUB_TOKEN the permissions required to make a Pages deployment
    permissions:
      pages: write      # to deploy to Pages
      id-token: write   # to verify the deployment originates from an appropriate source
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to GitHub Pages
        uses: actions/deploy-pages@v4
        id: github-pages

  build-finished:
    name: CI build successful
    runs-on: ubuntu-latest
    if: success()
    needs:
      - build-test
      - runner-test
      - docs
      - deploy-docs
    steps:
      - name: Mark the build as successful
        run: exit 0