ci.yml

name: CI

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]
  workflow_dispatch:

# Cancel in-progress runs for the same ref when a new push arrives
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

# Minimum permissions required by all jobs
permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUSTUP_TOOLCHAIN: nightly

jobs:
  # ---------------------------------------------------------------------------
  # fmt — formatting only; rustfmt parses source, never compiles or links.
  # ---------------------------------------------------------------------------
  fmt:
    name: rustfmt
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: false
      - name: Install nightly toolchain
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt
      - name: Check formatting
        run: cargo fmt --all -- --check

  # ---------------------------------------------------------------------------
  # deny — license + bans + sources + advisories.
  # ---------------------------------------------------------------------------
  deny:
    name: cargo deny
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: false
      - name: cargo deny check
        uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check
          arguments: --all-features

  # ---------------------------------------------------------------------------
  # clippy — compiles the whole workspace for the host so build breaks and lint
  # regressions fail CI. Host pkg-config paths override the aarch64 sysroot set
  # in .cargo/config.toml ([env] never overrides variables already set).
  # ---------------------------------------------------------------------------
  clippy:
    name: clippy
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      PKG_CONFIG_SYSROOT_DIR: /
      PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/share/pkgconfig
      PKG_CONFIG_LIBDIR: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/share/pkgconfig
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: false
      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev
      - name: Install nightly toolchain
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      # The app embeds crates/rkvm-web/dist at compile time; web.yml builds the
      # real frontend, so a placeholder is enough to type-check the backend.
      - name: Stub frontend dist
        run: mkdir -p crates/rkvm-web/dist && touch crates/rkvm-web/dist/index.html
      - name: cargo clippy
        run: cargo clippy --workspace --release --all-targets --locked -- -D warnings

  # ---------------------------------------------------------------------------
  # clippy-aarch64 — type-checks the device target so cfg(target_arch) and
  # cross-compile breaks surface before deploy. No link step, so host .pc
  # files plus PKG_CONFIG_ALLOW_CROSS stand in for the buildroot sysroot; the
  # Ubuntu cross gcc only compiles ring's C/asm.
  # ---------------------------------------------------------------------------
  clippy-aarch64:
    name: clippy (aarch64)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      PKG_CONFIG_ALLOW_CROSS: "1"
      PKG_CONFIG_SYSROOT_DIR: /
      PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/share/pkgconfig
      PKG_CONFIG_LIBDIR: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/share/pkgconfig
      CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
      CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: false
      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev \
            gcc-aarch64-linux-gnu libc6-dev-arm64-cross
      - name: Install nightly toolchain
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: clippy
          targets: aarch64-unknown-linux-gnu
      - uses: Swatinem/rust-cache@v2
        with:
          key: aarch64
      - name: Stub frontend dist
        run: mkdir -p crates/rkvm-web/dist && touch crates/rkvm-web/dist/index.html
      - name: cargo clippy (aarch64-unknown-linux-gnu)
        run: cargo clippy --workspace --release --all-targets --locked --target aarch64-unknown-linux-gnu -- -D warnings

  # ---------------------------------------------------------------------------
  # test — protocol, RPC dispatch and RPC method-set tests (crate tests/ dirs).
  # ---------------------------------------------------------------------------
  test:
    name: cargo test
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      PKG_CONFIG_SYSROOT_DIR: /
      PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/share/pkgconfig
      PKG_CONFIG_LIBDIR: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/share/pkgconfig
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: false
      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev
      - name: Install nightly toolchain
        uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
      - name: Stub frontend dist
        run: mkdir -p crates/rkvm-web/dist && touch crates/rkvm-web/dist/index.html
      - name: cargo test
        run: cargo test --workspace --locked

  # ---------------------------------------------------------------------------
  # actionlint — a broken workflow only fails when it runs (release, buildkit,
  # device health), so lint them all on every PR.
  # ---------------------------------------------------------------------------
  actionlint:
    name: actionlint
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: false
      - name: Lint workflows
        run: docker run --rm -v "$PWD:/repo" --workdir /repo rhysd/actionlint:1.7.7 -color

  # ---------------------------------------------------------------------------
  # Summary gate — required status check for branch protection
  # ---------------------------------------------------------------------------
  ci-success:
    name: CI Success
    runs-on: ubuntu-latest
    needs: [fmt, deny, clippy, clippy-aarch64, test, actionlint]
    if: always()
    steps:
      - name: Verify all jobs succeeded
        run: |
          if [[ "${{ needs.fmt.result }}" != "success" || \
                "${{ needs.deny.result }}" != "success" || \
                "${{ needs.clippy.result }}" != "success" || \
                "${{ needs.clippy-aarch64.result }}" != "success" || \
                "${{ needs.test.result }}" != "success" || \
                "${{ needs.actionlint.result }}" != "success" ]]; then
            echo "::error::One or more CI jobs failed"
            exit 1
          fi
          echo "All CI jobs passed."