code.yml

name: Code

on:
  # Run workflow on every PR.
  pull_request:
  # Run workflow on the main branch after every merge.
  # This is important to fill the GitHub Actions cache in a way that PRs can see it.
  push:
    branches:
      - main
  # Run workflow on the main branch every Sunday.
  schedule:
    - cron: "14 3 * * 0"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CLICOLOR_FORCE: 1
  # Incremental compilation is useful as part of an edit-build-test-edit cycle, as it lets the
  # compiler avoid recompiling code that hasn't changed. The setting does not improve the current
  # compilation but instead saves additional information to speed up future compilations (see
  # https://doc.rust-lang.org/cargo/reference/profiles.html#incremental). Thus, this is only useful
  # in CI if the result is cached, which we only do on the `main` branch.
  CARGO_INCREMENTAL: ${{ github.ref == 'refs/heads/main' && '1' || '0' }}
  # Allow more retries for network requests in cargo (downloading crates) and
  # rustup (installing toolchains). This should help to reduce flaky CI failures
  # from transient network timeouts or other issues.
  CARGO_NET_RETRY: 10
  RUSTUP_MAX_RETRIES: 10
  # Don't emit giant backtraces in the CI logs.
  RUST_BACKTRACE: short
  RUSTDOCFLAGS: -D warnings

jobs:
  diff:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      code: ${{ steps.diff.outputs.code }}
    steps:
      - uses: actions/checkout@v4
      - name: Detect Changes
        uses: dorny/paths-filter@v3.0.2
        id: diff
        with:
          filters: |
            code:
              - 'crates/**'
              - 'Cargo.toml'
              - 'Cargo.lock'
              - 'rust-toolchain'
              - 'deny.toml'
              - '.github/workflows/code.yml'

  dependencies:
    name: Check dependencies
    needs: diff
    if: needs.diff.outputs.code == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Remove rust-toolchain to avoid conflict in cargo-deny container
        run: rm -f rust-toolchain
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          # do not check advisories on PRs to prevent sudden failure due to new announcement
          command: check bans licenses sources
          rust-version: "1.85.0"

  dependencies-schedule:
    name: Check dependencies (including vulnerabilities)
    needs: diff
    if: github.event_name == 'schedule'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Remove rust-toolchain to avoid conflict in cargo-deny container
        run: rm -f rust-toolchain
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          rust-version: "1.85.0"

  test-coverage:
    name: Run all Rust tests and report coverage
    needs: diff
    if: needs.diff.outputs.code == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    env:
      RUSTC_BOOTSTRAP: 1
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2.7.3
        with:
          save-if: ${{ github.ref == 'refs/heads/main' && 'true' || 'false' }}
      - run: cargo install cargo-tarpaulin@0.30.0
      - name: Run tests and record coverage
        run: cargo tarpaulin -- --skip smoke_tests
      - name: Run smoke tests (sequential, with per-test retry)
        run: |
          set +e
          cargo test -p starfish-core -- validator::smoke_tests \
            --test-threads=1 2>&1 | tee /tmp/smoke-output.log
          FIRST_EXIT=${PIPESTATUS[0]}

          if [ "$FIRST_EXIT" -eq 0 ]; then
            echo "All smoke tests passed"
            exit 0
          fi

          echo "Some smoke tests failed — retrying failures only..."
          FAILED=$(grep ' \.\.\. FAILED$' /tmp/smoke-output.log \
            | awk '{print $2}')
          if [ -z "$FAILED" ]; then
            echo "Could not parse failed test names"
            exit 1
          fi

          ALL_PASSED=true
          for test in $FAILED; do
            echo "::group::Retry: $test"
            PASSED=false
            for attempt in 1 2; do
              echo "  Attempt $attempt"
              if cargo test -p starfish-core -- "$test" --exact \
                  --test-threads=1; then
                PASSED=true
                break
              fi
            done
            echo "::endgroup::"
            if [ "$PASSED" = false ]; then
              echo "FAIL: $test exhausted retries"
              ALL_PASSED=false
            fi
          done
          [ "$ALL_PASSED" = true ]
        shell: bash
      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        with:
          name: Coverage report
          path: tarpaulin-report.html
      - name: Code-coverage report
        uses: irongut/CodeCoverageSummary@v1.3.0
        with:
          filename: cobertura.xml
          badge: true
          fail_below_min: false
          format: markdown
          hide_branch_rate: false
          hide_complexity: true
          indicators: true
          output: both
          thresholds: "50 75"
      - name: Add coverage PR comment
        uses: marocchino/sticky-pull-request-comment@v2
        if: ${{ github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' }}
        with:
          path: code-coverage-results.md

  lint:
    name: Lint Rust code
    needs: diff
    if: needs.diff.outputs.code == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2.7.3
        with:
          save-if: ${{ github.ref == 'refs/heads/main' && 'true' || 'false' }}
      - run: cargo install cargo-sort@1.0.9

      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt
      - name: Check formatting with rustfmt
        run: cargo +nightly fmt --all --check
      - name: Check sorting of dependencies
        run: cargo sort -w -c
      - name: Lint using clippy (w/o tests)
        run: cargo clippy --all-features --no-deps -- -D warnings
      - name: Lint using clippy (w/ tests)
        run: cargo clippy --all-features --tests --no-deps -- -D warnings
      - name: Check documentation
        run: cargo doc --no-deps --workspace

  build:
    name: Build Rust code
    needs: diff
    if: needs.diff.outputs.code == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2.7.3
        with:
          save-if: ${{ github.ref == 'refs/heads/main' && 'true' || 'false' }}
      - name: Build Rust code
        run: cargo build --all-features --verbose

  check-all:
    name: Check if all code checks succeeded
    if: always()
    needs:
      - diff
      - dependencies
      - test-coverage
      - lint
      - build
    runs-on: ubuntu-latest
    steps:
      - name: Decide whether all needed jobs succeeded
        uses: re-actors/alls-green@v1.2.2
        with:
          allowed-skips: ${{ toJSON(needs) }}
          jobs: ${{ toJSON(needs) }}