ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Deny all permissions by default — grant per-job as needed.
permissions: {}

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  check:
    name: Check (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-26.04, macos-latest, windows-latest]

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
        with:
          components: clippy, rustfmt
      - uses: Swatinem/rust-cache@c8037a86dde8214a8310e9f54a8fc61ab362aa31 # v2

      - name: Run tests
        run: cargo test --workspace --lib --bins --tests --examples

      - name: Compile all targets
        run: cargo check --workspace --all-targets

      - name: Run doc-tests
        run: cargo test --workspace --doc
      
      - name: Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

      - name: Format
        run: cargo fmt --all --check

      - name: Check for uncommitted changes
        run: git diff --exit-code

  parallel-features:
    name: Parallel features
    runs-on: ubuntu-26.04
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
      - uses: Swatinem/rust-cache@c8037a86dde8214a8310e9f54a8fc61ab362aa31 # v2
      - name: Test codec parallel feature
        run: cargo test -p srcmap-codec --features parallel
      - name: Test generator parallel feature
        run: cargo test -p srcmap-generator --features parallel

  doc:
    name: Documentation
    runs-on: ubuntu-26.04
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
      - name: Check documentation
        env:
          RUSTDOCFLAGS: "-D warnings"
        run: cargo doc --workspace --no-deps --document-private-items

  msrv:
    name: MSRV
    runs-on: ubuntu-26.04
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Read MSRV from Cargo.toml
        id: msrv
        run: |
          MSRV=$(sed -n 's/^rust-version = "\(.*\)"/\1/p' Cargo.toml | head -1)
          echo "version=$MSRV" >> "$GITHUB_OUTPUT"
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
        with:
          toolchain: ${{ steps.msrv.outputs.version }}
      - name: Check MSRV
        run: cargo check --workspace

  typos:
    name: Typos
    runs-on: ubuntu-26.04
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1

  audit:
    name: Security Audit
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: taiki-e/install-action@1919c4a95903d2c33e4a221102edca87309fc14b # v2.89.0
        with:
          tool: cargo-audit
      - run: cargo audit

  deny:
    name: Cargo Deny
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
        with:
          arguments: --all-features

  shear:
    name: Unused Dependencies
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: taiki-e/install-action@1919c4a95903d2c33e4a221102edca87309fc14b # v2.89.0
        with:
          tool: cargo-shear
      - run: cargo shear

  zizmor:
    name: Actions Security
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
      - run: uvx zizmor --config .github/zizmor.yml --min-confidence medium --format plain .

  js-hygiene:
    name: JS Hygiene
    runs-on: ubuntu-26.04
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 26
      - name: Enable Corepack
        run: corepack enable
      - name: Install JS dependencies
        run: corepack pnpm install --ignore-scripts --frozen-lockfile
      - name: Run JS lint and format checks
        run: corepack pnpm run lint:js
      - name: Run JS formatter check
        run: corepack pnpm run fmt:js:check
      - name: Test the comment quality check
        run: node --test scripts/check-comment-quality.test.mjs
      - name: Check comments for narration and edit history
        run: node scripts/check-comment-quality.mjs --all

  js-runtime:
    name: JS Runtime
    runs-on: ubuntu-26.04
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 26
      - name: Enable Corepack
        run: corepack enable
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
        with:
          targets: wasm32-unknown-unknown
      - uses: Swatinem/rust-cache@c8037a86dde8214a8310e9f54a8fc61ab362aa31 # v2
      - name: Install JS dependencies
        run: corepack pnpm install --ignore-scripts --frozen-lockfile
      - name: Install wasm-pack
        uses: taiki-e/install-action@1919c4a95903d2c33e4a221102edca87309fc14b # v2.89.0
        with:
          tool: wasm-pack@0.13.1
      - name: Build JavaScript test artifacts
        run: corepack pnpm run build:test-artifacts
      - name: Check N-API declarations
        run: node .github/scripts/check-napi-declarations.mjs
      - name: Run JS tests
        run: corepack pnpm run test:js

  conformance:
    name: Conformance (tc39/source-map-tests)
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
      - uses: Swatinem/rust-cache@c8037a86dde8214a8310e9f54a8fc61ab362aa31 # v2
      - name: Run conformance tests
        run: cargo test -p srcmap-sourcemap --test conformance

  examples:
    name: Examples (compile check)
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
      - uses: Swatinem/rust-cache@c8037a86dde8214a8310e9f54a8fc61ab362aa31 # v2
      - name: Compile examples
        run: cargo build --examples --workspace

  bench:
    name: Benchmarks (compile check)
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
      - uses: Swatinem/rust-cache@c8037a86dde8214a8310e9f54a8fc61ab362aa31 # v2
      - name: Compile benchmarks
        run: cargo bench --workspace --no-run