ci.yml

name: CI

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"
  CARGO_PROFILE_DEV_DEBUG: "0"
  CARGO_PROFILE_TEST_DEBUG: "0"
  # Cargo 1.97+ can make build-script/linker warnings fatal without changing
  # RUSTFLAGS and invalidating otherwise reusable compiler artifacts.
  CARGO_BUILD_WARNINGS: deny

jobs:
  strict-rust:
    name: Strict Rust
    uses: codeandsolder/rust-skills2/.github/workflows/strict-rust.yml@ad9cb37d6c4d93864321717c303d966fdfb01831 # main

  lockfile:
    name: Lockfile consistency
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Install current Rust toolchain
        run: rustup toolchain install 1.99.0 --profile minimal
      - name: Verify lockfile is current
        run: cargo +1.99.0 metadata --locked --format-version 1 >/dev/null

  msrv:
    name: MSRV (Rust 1.94.1)
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-26.04
    timeout-minutes: 30
    # Rust 1.94 remains the compatibility contract. Keep this lane separate
    # from the current-stable lane so new language/library features cannot
    # silently raise the floor.
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Setup mandatory sccache
        uses: codeandsolder/ci-workflows/.github/actions/setup-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main
        with:
          rust-toolchain: "1.94.1"
      - name: Install patched MSRV toolchain
        run: |
          rustup toolchain install 1.94.1 --profile minimal --target wasm32-unknown-unknown
          rustc +1.94.1 --version
          cargo +1.94.1 --version
      - name: Check native workspace at MSRV
        run: cargo +1.94.1 check --locked --workspace --all-targets
      - name: Check hydration crates at MSRV
        run: |
          cargo +1.94.1 check --locked -p live-search --target wasm32-unknown-unknown --features hydrate --lib
          cargo +1.94.1 check --locked -p i18n-demo --target wasm32-unknown-unknown --features hydrate --lib
      - name: Finalize mandatory sccache
        if: always()
        uses: codeandsolder/ci-workflows/.github/actions/finalize-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main

  format:
    name: Format
    runs-on: ubuntu-26.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Setup mandatory sccache
        uses: codeandsolder/ci-workflows/.github/actions/setup-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main
        with:
          rust-toolchain: "1.99.0"
      - name: Install current Rust toolchain
        run: |
          rustup toolchain install 1.99.0 --profile minimal --component rustfmt
          rustc +1.99.0 --version
          cargo +1.99.0 --version
      - name: Restore leptosfmt
        id: leptosfmt-cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ~/.cargo/bin/leptosfmt
          key: ci-tool-${{ runner.os }}-leptosfmt-0.1.33-rust-1.99.0
      - name: Install Leptos formatter
        if: steps.leptosfmt-cache.outputs.cache-hit != 'true'
        run: cargo +1.99.0 install leptosfmt --version 0.1.33 --locked
      - name: Generate canonical formatting
        id: format
        run: |
          cargo +1.99.0 fmt --all
          while IFS= read -r -d '' f; do
            leptosfmt --rustfmt --stdin --quiet < "$f" > "$f.tmp"
            mv "$f.tmp" "$f"
          done < <(find live-search i18n-demo -name '*.rs' -print0)
          cargo +1.99.0 fmt --all

          if git diff --quiet; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
            git diff --name-only -- '*.rs' > /tmp/formatted-files.txt
            tar -czf /tmp/formatted-rust.tar.gz -T /tmp/formatted-files.txt
            git diff --stat
          fi
      - name: Upload formatter output
        if: steps.format.outputs.changed == 'true'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: formatted-rust
          path: /tmp/formatted-rust.tar.gz
          retention-days: 1
      - name: Verify formatting
        if: steps.format.outputs.changed == 'true'
        run: git diff --exit-code
      - name: Finalize mandatory sccache
        if: always()
        uses: codeandsolder/ci-workflows/.github/actions/finalize-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main

  clippy:
    name: Clippy (native)
    runs-on: ubuntu-26.04
    timeout-minutes: 30
    env:
      RUSTFLAGS: "-C target-cpu=x86-64-v2"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Setup mandatory sccache
        uses: codeandsolder/ci-workflows/.github/actions/setup-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main
        with:
          rust-toolchain: "1.99.0"
      - name: Install current Rust toolchain
        run: |
          rustup toolchain install 1.99.0 --profile minimal --component clippy
          rustc +1.99.0 --version
          cargo +1.99.0 --version
      - name: Clippy
        run: |
          lint_args=(-D warnings -D clippy::pedantic -D clippy::nursery)
          cargo +1.99.0 clippy --locked --workspace --all-targets -- "${lint_args[@]}"
          cargo +1.99.0 clippy --locked -p live-search --features ssr --all-targets -- "${lint_args[@]}"
          cargo +1.99.0 clippy --locked -p live-search --features ssr,otel --all-targets -- "${lint_args[@]}"
          cargo +1.99.0 clippy --locked -p gateway-example --features otel --all-targets -- "${lint_args[@]}"
          cargo +1.99.0 clippy --locked -p i18n-demo --features ssr --all-targets -- "${lint_args[@]}"
      - name: Report Clippy cache footprint
        if: always()
        run: du -sh target/debug 2>/dev/null || true
      - name: Finalize mandatory sccache
        if: always()
        uses: codeandsolder/ci-workflows/.github/actions/finalize-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main

  wasm-check:
    name: WASM link (${{ matrix.package }})
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-26.04
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        package:
          - live-search
          - i18n-demo
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Setup mandatory sccache
        uses: codeandsolder/ci-workflows/.github/actions/setup-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main
        with:
          rust-toolchain: "1.99.0"
      - name: Install current Rust toolchain
        run: |
          rustup toolchain install 1.99.0 --profile minimal --target wasm32-unknown-unknown
          rustc +1.99.0 --version
          cargo +1.99.0 --version
      # Use `build`, not `check`: Rust 1.96 stopped passing wasm-ld's
      # --allow-undefined implicitly, so only a real link exercises that policy.
      - name: Link hydration build
        run: cargo +1.99.0 build --locked -p "${{ matrix.package }}" --target wasm32-unknown-unknown --features hydrate --lib
      - name: Finalize mandatory sccache
        if: always()
        uses: codeandsolder/ci-workflows/.github/actions/finalize-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main

  unit-tests:
    name: Unit tests
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-26.04
    timeout-minutes: 30
    env:
      RUSTFLAGS: "-C target-cpu=x86-64-v2"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Setup mandatory sccache
        uses: codeandsolder/ci-workflows/.github/actions/setup-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main
        with:
          rust-toolchain: "1.99.0"
      - name: Install current Rust toolchain
        run: |
          rustup toolchain install 1.99.0 --profile minimal
          rustc +1.99.0 --version
          cargo +1.99.0 --version
      - name: Run library tests
        run: cargo +1.99.0 test --locked --workspace --lib
      - name: Show sccache stats
        if: always()
        run: ${SCCACHE_PATH} --show-stats
      - name: Finalize mandatory sccache
        if: always()
        uses: codeandsolder/ci-workflows/.github/actions/finalize-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main

  unit-tests-shared-cache:
    name: Unit tests (GHA sccache)
    if: github.event_name != 'pull_request'
    permissions:
      contents: read
    uses: codeandsolder/ci-workflows/.github/workflows/rust-sccache.yml@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main
    with:
      command: cargo +1.99.0 test --locked --workspace --lib
      rust-toolchain: "1.99.0"
      rustflags: "-C target-cpu=x86-64-v2"

  audit:
    name: Dependency audit
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-26.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Setup mandatory sccache
        uses: codeandsolder/ci-workflows/.github/actions/setup-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main
        with:
          rust-toolchain: "1.99.0"
      - name: Install current Rust toolchain
        run: |
          rustup toolchain install 1.99.0 --profile minimal
          rustc +1.99.0 --version
          cargo +1.99.0 --version
      - name: Restore cargo-audit
        id: cargo-audit-cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ~/.cargo/bin/cargo-audit
          key: ci-tool-${{ runner.os }}-cargo-audit-0.22.2-rust-1.99.0
      - name: Install cargo-audit
        if: steps.cargo-audit-cache.outputs.cache-hit != 'true'
        run: cargo +1.99.0 install cargo-audit --version 0.22.2 --locked
      - name: Audit dependencies
        run: cargo audit
      - name: Finalize mandatory sccache
        if: always()
        uses: codeandsolder/ci-workflows/.github/actions/finalize-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main

  leptos-build:
    name: Leptos production builds
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-26.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Setup mandatory sccache
        uses: codeandsolder/ci-workflows/.github/actions/setup-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main
        with:
          rust-toolchain: "1.99.0"
      - name: Install current Rust toolchain
        run: |
          rustup toolchain install 1.99.0 --profile minimal --target wasm32-unknown-unknown
          rustc +1.99.0 --version
          cargo +1.99.0 --version
      - name: Restore Leptos build tools
        id: leptos-tools-cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: |
            ~/.cargo/bin/cargo-leptos
            ~/.cargo/bin/stylance
          key: ci-tools-${{ runner.os }}-cargo-leptos-0.3.7-stylance-0.8.4-rust-1.99.0
      - name: Install build tools
        if: steps.leptos-tools-cache.outputs.cache-hit != 'true'
        run: |
          cargo +1.99.0 install cargo-leptos --version 0.3.7 --locked
          cargo +1.99.0 install stylance-cli --version 0.8.4 --locked
      - name: Build live-search
        run: |
          cargo +1.99.0 leptos build --release -p live-search
          mkdir -p target/site/pkg
          stylance live-search --output-file target/site/pkg/live-search.css
          find target/site/pkg -maxdepth 1 -type f -name '*.js' -size +0c -print -quit | grep -q .
          find target/site/pkg -maxdepth 1 -type f -name '*.wasm' -size +0c -print -quit | grep -q .
          test -s target/site/pkg/live-search.css
      - name: Build i18n-demo
        run: cargo +1.99.0 leptos build --release -p i18n-demo
      - name: Show sccache stats
        if: always()
        run: ${SCCACHE_PATH} --show-stats
      - name: Finalize mandatory sccache
        if: always()
        uses: codeandsolder/ci-workflows/.github/actions/finalize-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main

  docker-build:
    name: Docker image (${{ matrix.image }})
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-26.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - image: live-search
            dockerfile: live-search.Dockerfile
            tag: rwf-live-search:test
          - image: i18n-demo
            dockerfile: i18n-demo.Dockerfile
            tag: rwf-i18n-demo:test
          - image: gateway
            dockerfile: gateway.Dockerfile
            tag: rwf-gateway:test
    env:
      DOCKER_BUILD_RECORD_UPLOAD: "false"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
      - name: Build image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          tags: ${{ matrix.tag }}
          load: true
          cache-from: type=gha,scope=docker-${{ matrix.image }}
          cache-to: type=gha,mode=max,scope=docker-${{ matrix.image }}

  e2e-tests:
    name: Browser + integration E2E
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-26.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Setup mandatory sccache
        uses: codeandsolder/ci-workflows/.github/actions/setup-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main
        with:
          rust-toolchain: "1.99.0"
      - name: Install current Rust toolchain
        run: |
          rustup toolchain install 1.99.0 --profile minimal --target wasm32-unknown-unknown
          rustc +1.99.0 --version
          cargo +1.99.0 --version
      - name: Restore E2E build tools
        id: e2e-tools-cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: |
            ~/.cargo/bin/wasm-bindgen
            ~/.cargo/bin/stylance
          key: ci-tools-${{ runner.os }}-wasm-bindgen-cli-0.2.128-stylance-0.8.4-rust-1.99.0
      - name: Install E2E build tools
        if: steps.e2e-tools-cache.outputs.cache-hit != 'true'
        run: |
          cargo +1.99.0 install wasm-bindgen-cli --version 0.2.128 --locked
          cargo +1.99.0 install stylance-cli --version 0.8.4 --locked
      - name: Configure Chrome
        shell: bash
        run: |
          CHROME_PATH="$(command -v google-chrome || command -v chromium || true)"
          if [ -z "$CHROME_PATH" ]; then
            echo "No Chrome/Chromium executable found on the GitHub-hosted runner" >&2
            exit 1
          fi
          echo "CHROME_PATH=$CHROME_PATH" >> "$GITHUB_ENV"
          "$CHROME_PATH" --version
      - name: Verify Docker
        run: docker version
      - name: Run E2E suite
        run: bash scripts/test-e2e.sh
      - name: Verify SQLx OpenTelemetry span parenting
        run: >-
          cargo +1.99.0 test --release --locked -p e2e-tests --test otel_db_test
          --features otel-tests -- --test-threads=1 --nocapture
      - name: Show sccache stats
        if: always()
        run: ${SCCACHE_PATH} --show-stats
      - name: Finalize mandatory sccache
        if: always()
        uses: codeandsolder/ci-workflows/.github/actions/finalize-sccache@e7e29ed9109c2450c2a9f1f0310de9bd0000de3d # main