ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:
  workflow_call:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  build-test:
    name: fmt · clippy · build · unit + fixture tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - uses: Swatinem/rust-cache@v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Format check
        run: cargo fmt --all -- --check

      - name: Clippy (deny warnings)
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Unit + golden-fixture tests
        run: cargo test --workspace --all-features

      - name: Doc (deny warnings)
        run: RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --all-features

      - name: Build worker (release)
        run: cargo build --release --bin x12-worker

  # Resolve the latest published haybarn release once, so the whole matrix tests
  # the same version (and we never hardcode/pin it).
  resolve-haybarn:
    runs-on: ubuntu-latest
    outputs:
      release: ${{ steps.r.outputs.release }}
    steps:
      - id: r
        run: |
          REL=$(gh release view --repo Query-farm-haybarn/haybarn --json tagName --jq .tagName)
          echo "release=$REL" >> "$GITHUB_OUTPUT"
          echo "Latest haybarn release: $REL"
        env:
          GH_TOKEN: ${{ github.token }}

  integration:
    # SQL end-to-end across every transport the vgi extension supports. The SAME
    # test/sql/*.test suite runs three ways — the only difference is the LOCATION
    # the .test files ATTACH (ci/run-integration.sh sets VGI_X12_WORKER per
    # transport): subprocess = the stdio worker binary DuckDB spawns; http =
    # `x12-worker --http`; unix = `x12-worker --unix <sock>`.
    name: SQL E2E (${{ matrix.transport }}) · ${{ matrix.os }}
    needs: resolve-haybarn
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
        transport: [subprocess, http, unix]
        include:
          - { os: ubuntu-latest, asset: haybarn_unittest-linux-amd64.zip }
          - { os: macos-latest,  asset: haybarn_unittest-osx-arm64.zip }
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Build worker (release)
        run: cargo build --release --bin x12-worker

      - name: Download haybarn-unittest
        run: |
          gh release download "$HAYBARN_RELEASE" \
            --repo Query-farm-haybarn/haybarn \
            --pattern '${{ matrix.asset }}' \
            --output haybarn-unittest.zip --clobber
          mkdir -p hb && unzip -o -q haybarn-unittest.zip -d hb
        env:
          GH_TOKEN: ${{ github.token }}
          HAYBARN_RELEASE: ${{ needs.resolve-haybarn.outputs.release }}

      - name: Resolve runner + worker paths
        run: |
          UNITTEST="$PWD/$(find hb -name 'haybarn-unittest' -type f | head -1)"
          chmod +x "$UNITTEST"
          echo "HAYBARN_UNITTEST=$UNITTEST" >> "$GITHUB_ENV"
          echo "WORKER_BIN=$PWD/target/release/x12-worker" >> "$GITHUB_ENV"

      - name: Run extension integration suite (${{ matrix.transport }})
        run: ci/run-integration.sh
        env:
          TRANSPORT: ${{ matrix.transport }}

  metadata-quality:
    name: metadata quality (vgi-lint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Build worker (release)
        run: cargo build --release --bin x12-worker

      - name: vgi-lint
        uses: Query-farm/vgi-lint-check@v1
        with:
          version: "0.37.0"
          location: "${{ github.workspace }}/target/release/x12-worker"
          fail-on: info

  # Supply-chain advisory scan over the locked dependency tree. Lightweight: no
  # compile, just reads Cargo.lock against the RustSec advisory DB.
  audit:
    name: supply-chain audit (cargo-audit)
    runs-on: ubuntu-latest
    # rustsec/audit-check posts results as a check-run, which needs checks:write.
    # The top-level `permissions: contents: read` alone yields
    # "Resource not accessible by integration - create-a-check-run".
    permissions:
      contents: read
      checks: write
    steps:
      - uses: actions/checkout@v4
      - name: cargo audit
        uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  # Verify the declared MSRV (rust-version = "1.90") actually builds.
  msrv:
    name: MSRV check (rust 1.90)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust toolchain (pinned MSRV)
        uses: dtolnay/rust-toolchain@1.90
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: msrv
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: cargo check (workspace, all features)
        run: cargo check --workspace --all-features