name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    name: Test
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, ubuntu-24.04-arm]
        rust: [stable, beta]
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921 # master
      with:
        toolchain: ${{ matrix.rust }}
        targets: x86_64-unknown-linux-musl,aarch64-unknown-linux-musl
    - name: Install cross-compilation tools for both architectures
      run: |
        sudo apt-get update
        sudo apt-get install -y musl-tools gcc-aarch64-linux-gnu gcc-x86-64-linux-gnu
    - name: Cache cargo registry
      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
      with:
        path: ~/.cargo/registry
        key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
    - name: Cache cargo index
      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
      with:
        path: ~/.cargo/git
        key: ${{ runner.os }}-cargo-index-${{ hashFiles('**/Cargo.lock') }}
    - name: Cache cargo build
      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
      with:
        path: target
        key: ${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}

    - name: Setup cargo config for CI cross-compilation
      run: |
        mkdir -p .cargo
        cat > .cargo/config.toml << 'EOF'
        [target.x86_64-unknown-linux-musl]
        linker = "musl-gcc"

        [target.aarch64-unknown-linux-musl]
        linker = "aarch64-linux-gnu-gcc"
        EOF

    - run: make verify-cross-compile
    - run: make build
    - run: make test
    - run: make test-e2e
    # Only run cross-compilation integration test on x86_64 runners
    - name: Run integration test (cross-compilation)
      if: matrix.os == 'ubuntu-latest'
      run: make run-built-image

  fmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Install Rust
      uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921 # stable
      with:
        toolchain: stable
        components: rustfmt
    - name: Check formatting
      run: make check-fmt

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Install Rust
      uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921 # stable
      with:
        toolchain: stable
        components: clippy
    - name: Run clippy
      run: make lint

  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Install Rust
      uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921 # stable
      with:
        toolchain: stable
    - name: Install cargo-audit
      run: cargo install cargo-audit
    - name: Run security audit
      run: cargo audit

  # Takes too long to run on CI, so it's commented out for now.
  # coverage:
  #   name: Code coverage
  #   runs-on: ubuntu-latest
  #   steps:
  #   - uses: actions/checkout@v4
  #   - name: Install Rust
  #     uses: dtolnay/rust-toolchain@stable
  #   - name: Install cargo-tarpaulin
  #     run: cargo install cargo-tarpaulin
  #   - name: Generate code coverage
  #     run: cargo tarpaulin --verbose --workspace