ci.yml

name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  fmt:
    name: Format Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - name: Check formatting
        run: cargo fmt --all --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - name: Run Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, macos-latest, windows-latest ]
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Run tests
        run: cargo test --workspace --all-features

  build:
    name: Build (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, macos-latest, windows-latest ]
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Build
        run: cargo build --workspace --release

  doc:
    name: Documentation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Build documentation
        run: cargo doc --workspace --no-deps
        env:
          RUSTDOCFLAGS: -D warnings

  integration:
    name: Integration Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Start RustFS
        run: |
          docker run -d --name rustfs \
            -p 9000:9000 -p 9001:9001 \
            -e RUSTFS_ROOT_USER=accesskey \
            -e RUSTFS_ROOT_PASSWORD=secretkey \
            -e RUSTFS_CONSOLE_ENABLE=true \
            -e RUSTFS_CONSOLE_ADDRESS=:9001 \
            rustfs/rustfs:latest
      - name: Wait for RustFS
        run: |
          for i in {1..30}; do
            curl -sf http://localhost:9000/health && break
            echo "Waiting for RustFS... ($i/30)"
            sleep 2
          done
          curl -sf http://localhost:9000/health || exit 1
      - name: Run integration tests
        run: cargo test --workspace --features integration
        env:
          TEST_S3_ENDPOINT: http://localhost:9000
          TEST_S3_ACCESS_KEY: accesskey
          TEST_S3_SECRET_KEY: secretkey

  # Golden tests to verify output format stability
  golden:
    name: Golden Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Start RustFS
        run: |
          docker run -d --name rustfs \
            -p 9000:9000 \
            -e RUSTFS_ROOT_USER=accesskey \
            -e RUSTFS_ROOT_PASSWORD=secretkey \
            rustfs/rustfs:latest
      - name: Wait for RustFS
        run: |
          for i in {1..30}; do
            curl -sf http://localhost:9000/health && break
            echo "Waiting for RustFS... ($i/30)"
            sleep 2
          done
          curl -sf http://localhost:9000/health || exit 1
      - name: Run golden tests
        run: cargo test --workspace --features golden
        env:
          TEST_S3_ENDPOINT: http://localhost:9000
          TEST_S3_ACCESS_KEY: accesskey
          TEST_S3_SECRET_KEY: secretkey

  # Ensure protected files are not modified without proper process
  protected-files:
    name: Protected Files Check
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Check protected files
        run: |
          PROTECTED_FILES=(
            "docs/SPEC.md"
            "schemas/output_v1.json"
            "crates/cli/src/exit_code.rs"
          )

          CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)

          for file in "${PROTECTED_FILES[@]}"; do
            if echo "$CHANGED_FILES" | grep -q "^$file$"; then
              echo "::warning::Protected file modified: $file"
              echo "This change requires the Breaking Change process. See AGENTS.md."

              # Check if PR body contains BREAKING marker
              if ! echo "${{ github.event.pull_request.body }}" | grep -q "BREAKING"; then
                echo "::error::Protected file $file modified without BREAKING marker in PR description"
                exit 1
              fi
            fi
          done
          echo "Protected files check passed"

  msrv:
    name: Minimum Supported Rust Version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.92"
      - uses: Swatinem/rust-cache@v2
      - name: Build with MSRV
        run: cargo build --workspace