rust.yml

name: Rust

on:
  push:
  pull_request:

env:
  CARGO_TERM_COLOR: always

defaults:
  run:
    shell: bash

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: Build (required for E2E tests)
        run: cargo build
      - name: Run tests
        run: cargo test --verbose

  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - TARGET: x86_64-unknown-linux-musl
            OS: ubuntu-latest
          - TARGET: x86_64-unknown-linux-gnu
            OS: ubuntu-latest
          - TARGET: x86_64-apple-darwin
            OS: macos-latest
          - TARGET: x86_64-pc-windows-msvc
            OS: windows-latest
    needs: test
    runs-on: ${{ matrix.OS }}
    env:
      NAME: fluent
      TARGET: ${{ matrix.TARGET }}
      OS: ${{ matrix.OS }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.TARGET }}
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: Install and configure dependencies
        run: |
          if [[ $OS =~ ^ubuntu.*$ ]]; then
            sudo apt-get update
            sudo apt-get install -qq crossbuild-essential-arm64 crossbuild-essential-armhf
          fi

      - name: Add musl target
        if: ${{ matrix.TARGET == 'x86_64-unknown-linux-musl' }}
        run: sudo apt-get update && sudo apt-get install -y musl-dev musl-tools

      - name: Run build
        run: cargo build --release --verbose --target $TARGET
      - name: Run tests
        run: cargo test --release --verbose --target $TARGET
      - name: Compress
        run: |
          mkdir -p ./artifacts
          if [[ $OS =~ ^windows.*$ ]]; then
              EXEC=$NAME.exe
          else
              EXEC=$NAME
          fi
          if [[ $GITHUB_REF_TYPE =~ ^tag$ ]]; then
            TAG=$GITHUB_REF_NAME
          else
            TAG=$GITHUB_SHA
          fi
          mv ./target/$TARGET/release/$EXEC $EXEC
          tar -czf ./artifacts/$NAME-$TARGET-$TAG.tar.gz $EXEC default_config_test.json amber.yaml amber-x86_64-apple-darwin amber-x86_64-pc-windows-gnu.exe amber-x86_64-unknown-linux-musl fluent_autocomplete.ps1 fluent_autocomplete.sh
      - name: Archive artifact
        uses: actions/upload-artifact@v4
        with:
          name: result
          path: ./artifacts

  deploy:
    if: startsWith(github.ref, 'refs/tags/')
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: result
          path: ./artifacts
      - name: Release
        uses: softprops/action-gh-release@v1
        with:
          files: ./artifacts/*.tar.gz

  fmt:
    name: Format Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - name: Check formatting
        run: cargo fmt --all -- --check

  clippy:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: Run clippy
        run: cargo clippy --all-targets -- -W clippy::all

  audit:
    runs-on: ubuntu-latest
    continue-on-error: true  # Don't block PRs on audit failures
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: Install cargo-audit
        run: cargo install cargo-audit --locked
      - name: cargo audit
        run: cargo audit || echo "::warning::Security audit found vulnerabilities - please review"