rust.yml

name: Rust

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

env:
  CARGO_TERM_COLOR: always
  # Disable incremental compilation.
  #
  # Incremental compilation is useful as part of an edit-build-test-edit cycle,
  # as it lets the compiler avoid recompiling code that hasn't changed. However,
  # on CI, we're not making small edits; we're almost always building the entire
  # project from scratch. Thus, incremental compilation on CI actually
  # introduces *additional* overhead to support making future builds
  # faster...but no future builds will ever occur in any given CI environment.
  #
  # See https://matklad.github.io/2021/09/04/fast-rust-builds.html#ci-workflow
  # for details.
  CARGO_INCREMENTAL: 0
  # Allow more retries for network requests in cargo (downloading crates) and
  # rustup (installing toolchains). This should help to reduce flaky CI failures
  # from transient network timeouts or other issues.
  CARGO_NET_RETRY: 10
  RUSTUP_MAX_RETRIES: 10
  # Don't emit giant backtraces in the CI logs.
  RUST_BACKTRACE: short

jobs:
  license-check:
    name: license-check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # pin@v3
      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # pin@v1
      - run: scripts/license_check.sh

  test:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os:
          - ubuntu-ghcloud
          - windows-ghcloud
      fail-fast: false
    env:
      RUSTFLAGS: -D warnings
    steps:
      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # pin@v3
      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # pin@v1
      - uses: taiki-e/install-action@d30f7ecb94d4d882276efb3967be14b8ef34d289 # pin@nextest
      # make sure benches don't bit-rot
      - name: build benches
        run: cargo build --benches --features experimental,copy_key,unsecure_schemes
      - name: cargo test
      # TODO: `cargo nextest run` doesn't work on windows, so we use `cargo test` instead
        run: cargo test --features experimental,copy_key,unsecure_schemes
      - name: Doctests
        run: |
          cargo test --doc --features experimental,copy_key,unsecure_schemes
      # Ensure there are no uncommitted changes in the repo after running tests
      - run: scripts/changed-files.sh

  clippy:
    runs-on: ubuntu-ghcloud
    steps:
      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # pin@v3
      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # pin@v1
        with:
          components: clippy
      # See '.cargo/config' for list of enabled/disabled clippy lints
      - name: cargo clippy
        run: cargo xclippy -D warnings

  rustfmt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # pin@v3
      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # pin@v1
        with:
          components: rustfmt
      - name: rustfmt
        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # pin@v1
        with:
          command: fmt
          args: --all --check

  cargo-deny:
    name: cargo-deny (advisories, licenses, bans, ...)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # pin@v3
      - uses: EmbarkStudios/cargo-deny-action@e0a440755b184aa50374330fa75cca0f84fcb59a # pin@v1