ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"

jobs:
  rust:
    name: cargo test (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Tauri Linux prerequisites
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            build-essential \
            curl \
            wget \
            file \
            libxdo-dev \
            libssl-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev
      # dtolnay/rust-toolchain hardcodes the version in the tag commit the SHA
      # pins (no `toolchain` input exists at it) — this is the `1.96.1` tag,
      # kept in sync with rust-toolchain.toml. Bump = new tag's SHA.
      - uses: dtolnay/rust-toolchain@2fe4ca74464c5902a4f6e302d0a619b4ea911ccc # 1.96.1
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@c8037a86dde8214a8310e9f54a8fc61ab362aa31 # v2
      - name: fmt
        run: cargo fmt --all -- --check
      - name: clippy
        run: cargo clippy --workspace --all-targets -- -D warnings
      - name: test
        run: cargo test --workspace --all-targets
      - name: doc
        run: cargo doc --workspace --no-deps

  # sc-forge conformance (P38): replays the recorded Gitea contract against the in-tree
  # server, bootstrapped the way Engine bootstraps Gitea (admin CLI, then serve). Only
  # the exchanges the built slices answer run; crates/forge/conformance/slice-pending.json
  # lists the rest and shrinks as slices land.
  forge-conformance:
    name: sc-forge conformance
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@2fe4ca74464c5902a4f6e302d0a619b4ea911ccc # 1.96.1
      - uses: Swatinem/rust-cache@c8037a86dde8214a8310e9f54a8fc61ab362aa31 # v2
      - name: check
        run: bash crates/forge/conformance/forge-check.sh

  # Advisory (not a required context): the sc-forge container image builds and works (git new
  # enough, boots, serves, clones, and exits 0 on SIGTERM). Only runs when the forge, its image
  # or the lockfile changed.
  forge-image:
    name: sc-forge image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: changed?
        id: changed
        run: |
          base="${{ github.event.pull_request.base.sha || github.event.before }}"
          if [ -z "$base" ] || ! git diff --quiet "$base" HEAD -- crates/forge crates/core crates/crypto Cargo.toml Cargo.lock .dockerignore rust-toolchain.toml 2>/dev/null; then
            echo "run=true" >> "$GITHUB_OUTPUT"
          else
            echo "run=false" >> "$GITHUB_OUTPUT"
          fi
      - name: build
        if: steps.changed.outputs.run == 'true'
        run: docker build -f crates/forge/Dockerfile -t sc-forge:ci .
      - name: smoke
        if: steps.changed.outputs.run == 'true'
        run: bash crates/forge/docker/smoke.sh sc-forge:ci

  # Advisory (not a required context): proves the Windows build and the owner-only
  # ACL on .sc/local-key, the `sc keygen` identity and the TLS serve key (#214,
  # #281). Deliberately not `cargo test --workspace`; the wider suite still has
  # unix-only assumptions.
  windows:
    name: windows (check + secret-file ACL tests)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@2fe4ca74464c5902a4f6e302d0a619b4ea911ccc # 1.96.1
        with:
          components: clippy
      - uses: Swatinem/rust-cache@c8037a86dde8214a8310e9f54a8fc61ab362aa31 # v2
      - name: check
        run: cargo check --workspace --all-targets --keep-going
      - name: clippy
        run: cargo clippy --workspace --all-targets -- -D warnings
      - name: owner-only helper tests (scl-core)
        run: cargo test -p scl-core --lib "owner_only::"
      - name: local-key ACL and cache tests
        run: cargo test -p scl-repo --lib "cache::"
      - name: TLS serve key ACL test
        run: cargo test -p scl-repo --lib "minted_serve_tls_key"
      - name: TLS identity injection tests (scl-tlsio)
        run: cargo test -p scl-tlsio --lib "identity::"
      - name: keygen identity ACL test
        run: cargo test -p scl-cli --test keygen_overwrite

  desktop:
    name: desktop (typecheck + test + audit)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/desktop
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: apps/desktop/package-lock.json
      - name: install (verifies lockfile integrity hashes)
        run: npm ci
      - name: audit
        run: npm audit --audit-level=high
      - name: typecheck
        run: npm run typecheck
      - name: test
        run: npm run test