ci.yml

name: CI

on:
  push:
    # train/** carries the CI-gated train flow: work rides a train branch,
    # CI runs there, and main only ever fast-forwards to an already-green
    # sha. Required status checks on main depend on this trigger existing -
    # without it a train push gets no run and main becomes unpushable.
    branches: [main, 'train/**']
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  actions: read

concurrency:
  group: ci-${{ github.event_name }}-${{ github.ref }}
  # Main's own run is independent of the train run and must finish.
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

env:
  CARGO_TERM_COLOR: always
  # GitHub-hosted runners have little free disk, and a full workspace test
  # build with debug info can run out of space. Debug info is most of the
  # target directory and CI never reads it, and incremental state is useless
  # in a fresh checkout.
  CARGO_PROFILE_DEV_DEBUG: 0
  CARGO_PROFILE_TEST_DEBUG: 0
  CARGO_INCREMENTAL: 0
  # Official nats-io/nats-server v2.15.0 linux-amd64 release asset digest:
  # https://api.github.com/repos/nats-io/nats-server/releases/assets/570234667
  NATS_SERVER_VERSION: '2.15.0'
  NATS_SERVER_LINUX_AMD64_SHA256: 5d2c51caca950333aba84911df7d377f826f3a59ec36061c6539105084f65c92

jobs:
  plan:
    name: Train preconditions
    runs-on: ubuntu-24.04
    outputs:
      skip-test: ${{ steps.main-duplicate.outputs.skip-test }}
    defaults:
      run:
        working-directory: plexus
    steps:
      - name: Checkout plexus with train comparison base
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
        with:
          path: plexus
          fetch-depth: 0
          persist-credentials: false

      # Keep train-flow checks independent of the long compile/test job, so a
      # main push that reuses a proven train result still checks workflow drift.
      - name: Train preconditions
        run: ./scripts/check-train-preconditions.sh

      - name: Check for an already successful train run
        id: main-duplicate
        env:
          GH_TOKEN: ${{ github.token }}
        run: python3 scripts/skip_main_tests.py

  # Linux-only: plexus has no platform-specific code paths (catalog + store +
  # subc wire). Every dependency comes from crates.io at an exact version, so
  # the job checks out this repository alone.
  #
  # Runners are GitHub-hosted, so the workflow needs no third-party runner
  # provider and runs the same way in any fork.
  test:
    name: Test (ubuntu)
    needs: plan
    # The active main ruleset requires Test (ubuntu), and accepts the successful
    # check on this exact sha from any app. A successful train run already
    # supplies that required context, so its skipped duplicate main check stays green.
    if: needs.plan.outputs.skip-test != 'true'
    runs-on: ubuntu-24.04
    # A wedged test must surface as a fast red run, not burn the runner for
    # the 6-hour Actions default. Healthy runs finish well under 15 minutes.
    timeout-minutes: 40
    defaults:
      run:
        working-directory: plexus
    steps:
      # The hosted image ships toolchains plexus never uses; removing them
      # frees the disk the Rust build needs.
      - name: Free runner disk
        working-directory: /
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/.ghcup /opt/hostedtoolcache/CodeQL
          df -h /

      - name: Checkout plexus
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
        with:
          path: plexus
          fetch-depth: 0
          persist-credentials: false

      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
        with:
          components: clippy, rustfmt

      - name: Rust compiler identity
        id: rust-identity
        run: echo "version=$(rustc -Vv | sha256sum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"

      # Cache only public compiler inputs and build artifacts, never credentials,
      # Cargo configuration or the whole home directory. Fork caches are scoped
      # to their PR ref by Actions and cannot overwrite the default branch cache.
      - name: Cache Rust build
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git/db
            plexus/target
          key: rust-${{ runner.os }}-${{ runner.arch }}-${{ steps.rust-identity.outputs.version }}-${{ hashFiles('plexus/Cargo.lock') }}-${{ github.sha }}
          restore-keys: |
            rust-${{ runner.os }}-${{ runner.arch }}-${{ steps.rust-identity.outputs.version }}-${{ hashFiles('plexus/Cargo.lock') }}-

      - name: Install pinned nats-server
        run: bash scripts/install-nats-server.sh

      - name: Rust test gate (fmt, clippy -D warnings, workspace tests)
        run: ./scripts/rust-test-gate.sh

      # Conformance harness: list every known fixture, then run each. Fixtures
      # are discovered from the binary so newly registered names are covered
      # without editing this workflow.
      #
      # `--locked` matters MORE here than in the gate, because of the
      # `!cancelled()` guard below: this step runs even when the gate failed,
      # including when the gate failed BECAUSE the lock was stale. Without the
      # flag, cargo would silently re-resolve and the fixtures would pass
      # against the dependency set the gate had just rejected — a green
      # connector result attesting a build nobody chose.
      #
      # `!cancelled()` runs this even when the gate above failed. Without it,
      # GitHub skips every later step on a failure, so a formatting slip in the
      # gate suppresses the conformance answer entirely and the job shows one
      # red mark indistinguishable from "style problem, connectors fine". The
      # setup steps above stay unguarded on purpose: a failed checkout or
      # toolchain install makes this step impossible rather than skipped by
      # policy, and running it anyway would report a fixture failure whose real
      # cause is a missing dependency.
      - name: Conformance fixtures
        if: ${{ !cancelled() }}
        run: bash scripts/run-conformance-fixtures.sh

  guest:
    name: Embedded probe guest
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable action, explicit guest compiler
        with:
          toolchain: '1.99.0'
          targets: wasm32-wasip1
      - name: Rebuild and compare embedded guest
        run: bash scripts/build-probe-guest.sh --check