ci.yml

name: CI

# Scoped so one push does one run: PR branches report via
# pull_request only (push-all would duplicate every PR run);
# main still verifies merges, tags and direct pushes.
on:
  push:
    branches: [main]
  pull_request:

# Rapid pushes supersede each other: cancel stale PR runs so only the
# latest push burns CI minutes. Main pushes and releases never cancel.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

# Least privilege: every job here only reads the repo (checkout, scan,
# build, test) — no uploads, no writes. Without this the token inherits
# the org/repo default instead of a declared scope.
permissions:
  contents: read

jobs:
  # Style-only signal in ~1 minute, no system deps: rustfmt needs
  # neither the Fedora container nor the GTK stack.
  fmt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # No job pushes or fetches; don't persist the token in git config.
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          components: rustfmt
      - run: cargo fmt --check
  check:
    runs-on: ubuntu-latest
    # ubuntu-latest ships GTK 4.14 / libadwaita 1.4, but the gtk4 (v4_18)
    # and libadwaita (v1_8) crate features need system libs >= 4.18 / 1.8,
    # so run inside Fedora instead of on the host runner.
    container: fedora:44
    steps:
      - name: Install system dependencies
        run: dnf install -y git gcc pkg-config gtk4-devel libadwaita-devel python3 ffmpeg-free xorg-x11-server-Xvfb
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # No job pushes or fetches; don't persist the token in git config.
          persist-credentials: false
      - name: Install pinned gallery-dl for reproducible integration tests
        run: python3 build-aux/install-gallery-dl-ci.py
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          components: clippy
      # Save this under the default-branch scope so tag-triggered release
      # workflows can restore it; caches created by one release tag are not
      # available to a different tag. The tarball job uses this exact key
      # and path for its in-SDK cargo vendor step.
      - name: Cache Cargo registry
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .cargo-home/registry
          key: tarball-cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            tarball-cargo-${{ runner.os }}-
      - name: Use shared Cargo registry path
        run: echo "CARGO_HOME=$GITHUB_WORKSPACE/.cargo-home" >> "$GITHUB_ENV"
      - run: cargo clippy --all-targets -- -D warnings
      # Serial: the suite shares one glib default MainContext across test
      # threads, and glib futures are bound to their spawning thread, so
      # parallel runs abort when one test's loop polls another's source.
      # --nocapture: show SKIP messages from gallery integration tests
      # (they skip gracefully when the port is busy or gallery-dl itself
      # errors internally; GRAB_REQUIRE_GALLERY_DL=1 turns skips into failures).
      # Native manifest integration tests generate HLS/DASH fMP4 fixtures,
      # fetch their resources over loopback, and verify FFmpeg/ffprobe output.
      # Both external-tool gates are mandatory in CI and may skip locally.
      # To enforce both gates locally: GRAB_REQUIRE_GALLERY_DL=1 GRAB_REQUIRE_FFMPEG_MANIFEST=1 cargo test
      - run: GRAB_REQUIRE_GALLERY_DL=1 GRAB_REQUIRE_FFMPEG_MANIFEST=1 cargo test -- --test-threads=1 --nocapture
      # Display-dependent picker and queue-view regressions are #[ignore]d
      # for the plain run. Xvfb supplies a display for both test filters.
      # The trailing grep guards the ignore: zero matching tests would exit 0.
      - name: UI tests (Xvfb)
        run: |
          set -o pipefail
          Xvfb :99 -screen 0 1280x800x24 &
          for _ in $(seq 1 20); do [ -S /tmp/.X11-unix/X99 ] && break; sleep 0.5; done
          # Fail at the readiness check, not later in cargo test, if it never came up.
          test -S /tmp/.X11-unix/X99
          export DISPLAY=:99
          export GSK_RENDERER=cairo
          # GTK initialization is thread-bound. Keep each ignored UI test
          # in its own process because the Rust test harness changes workers.
          cargo test picker_grid -- --ignored --test-threads=1 --nocapture | tee /tmp/ui-tests.log
          cargo test playlist_and_torrent_picker_wait_for_confirmation -- --ignored --test-threads=1 --nocapture | tee -a /tmp/ui-tests.log
          cargo test queue_row_resynced_after_picker_returns_to_form -- --ignored --test-threads=1 --nocapture | tee -a /tmp/ui-tests.log
          grep -Eq 'test result: ok\. [1-9][0-9]* passed' /tmp/ui-tests.log
          # A stray Gtk-CRITICAL (e.g. the measure flood from the drawn
          # warnings while the picker streams entries) must fail the step,
          # not just scroll past in the log.
          ! grep -q "Gtk-CRITICAL" /tmp/ui-tests.log
  # Guards the module structure: sentrux enforces the architectural rules
  # in .sentrux/rules.toml (currently: zero import cycles). Pinned to
  # v0.5.7 so an upstream release can't silently change the verdict; runs
  # in Fedora like the check job because the binary links libgtk-3.
  structure:
    runs-on: ubuntu-latest
    container: fedora:44
    steps:
      - name: Install system dependencies
        run: dnf install -y curl gtk3
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # No job pushes or fetches; don't persist the token in git config.
          persist-credentials: false
      - name: Install sentrux
        run: |
          # Pinned hash: a swapped release asset fails here instead of running unverified.
          curl -sSL --fail https://github.com/sentrux/sentrux/releases/download/v0.5.7/sentrux-linux-x86_64 -o /usr/local/bin/sentrux
          echo "3237f80fe20d54aad4deefa8a143f0d60543bb5d2d6ad891eb42432f155725a6  /usr/local/bin/sentrux" | sha256sum -c -
          chmod +x /usr/local/bin/sentrux
      - run: sentrux check
  # Guards the offline Flatpak build: a Cargo.lock stale against
  # Cargo.toml heals silently wherever cargo has network (local builds,
  # the tarball job) but is fatal under --offline, and an unregenerated
  # cargo-sources.json leaves the vendor dir short — the exact way
  # v4.0.0-beta.4 shipped without its bundle. Seconds, no system deps.
  vendor-sync:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # No job pushes or fetches; don't persist the token in git config.
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
      # --locked fails when the lock would need re-resolution; read-only otherwise.
      - run: cargo metadata --locked --format-version 1 >/dev/null
      # Run the release metadata gate on every PR, not only after a tag is published.
      - name: Check release metadata consistency
        run: ./build-aux/check-release-consistency.py
      - run: ./build-aux/gen-cargo-sources.py --check
  # Read-only secret and supply-chain scanning: gitleaks over the full
  # history plus cargo-audit against the RustSec advisory DB. No system
  # deps, no behavior risk — fails only when a secret or a
  # known-vulnerable dependency actually lands. Binaries are pinned like
  # sentrux above so an upstream release can't silently change the verdict.
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # gitleaks scans history; the default shallow checkout would
          # hide every commit but the last.
          fetch-depth: 0
          # Don't persist the token in git config: least privilege for a
          # read-only scan job.
          persist-credentials: false
      - name: Install gitleaks
        run: |
          # Scanner pins are NOT Dependabot-tracked: bump the version, URL and
          # sha256 together when a new gitleaks release lands (and the
          # [extend] useDefault pin in .gitleaks.toml if the ruleset changed).
          curl -sSL --fail https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz -o /tmp/gitleaks.tgz
          # Pinned hash, cross-checked against the vendor-published
          # gitleaks_8.30.1_checksums.txt: a swapped release asset fails here.
          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  /tmp/gitleaks.tgz" | sha256sum -c -
          tar -xzf /tmp/gitleaks.tgz -C /usr/local/bin gitleaks
          chmod +x /usr/local/bin/gitleaks
      - run: gitleaks detect --source . -v
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
      - name: Install cargo-audit
        run: |
          # Scanner pins are NOT Dependabot-tracked: bump the version, URL and
          # sha256 together when a new cargo-audit release lands.
          curl -sSL --fail https://github.com/RustSec/rustsec/releases/download/cargo-audit%2Fv0.22.2/cargo-audit-x86_64-unknown-linux-gnu-v0.22.2.tgz -o /tmp/cargo-audit.tgz
          # Pinned hash (no vendor checksums published for this asset; the
          # extracted binary was verified to report 0.22.2): a swapped
          # release asset fails here instead of running unverified.
          echo "ab28a1bdb54db4d5d8ad5981cf1f959410370b3d28250dbd35f6a44248620e39  /tmp/cargo-audit.tgz" | sha256sum -c -
          tar -xzf /tmp/cargo-audit.tgz -C /tmp
          install -m 755 /tmp/cargo-audit-x86_64-unknown-linux-gnu-v0.22.2/cargo-audit /usr/local/bin/cargo-audit
      - run: cargo audit