ci.yml

name: CI
on:
  pull_request:
  push:
    branches:
      - main
    tags:
      - "*"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.ref_name == 'main' && github.sha || 'anysha' }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  compile:
    name: Compile and lint
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            run_on: macos-latest
          - target: x86_64-linux-gnu
            run_on: ubuntu-latest
          - target: x86_64-windows-msvc
            run_on: windows-latest
    runs-on: ${{ matrix.run_on }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          components: clippy
      - name: Install system dependencies
        if: ${{ matrix.run_on != 'windows-latest' }}
        run: script/bootstrap
      - name: Machete
        if: ${{ matrix.run_on == 'macos-latest' }}
        uses: bnjbvr/cargo-machete@7959c845782fed02ee69303126d4a12d64f1db18 # v0.9.1
      - name: Setup | Cache Cargo
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: compile-cargo-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
      - name: Typo check
        if: ${{ matrix.run_on == 'macos-latest' }}
        run: |
          # --locked for reproducibility; no `|| echo` mask — a failed install
          # must fail the step, not surface later as `typos: command not found`.
          which typos >/dev/null 2>&1 || cargo install typos-cli --locked
          typos
      - name: Lint (macOS)
        if: ${{ matrix.run_on == 'macos-latest' }}
        run: ./script/clippy --locked
      - name: Lint (Linux)
        if: ${{ matrix.run_on == 'ubuntu-latest' }}
        run: ./script/clippy --locked
      - name: Lint (Windows)
        if: ${{ matrix.run_on == 'windows-latest' }}
        run: ./script/clippy.ps1 --locked

  unit-and-headless:
    name: Unit, doctest, and headless tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
      - name: Install system dependencies
        run: script/bootstrap
      - name: Run maintained unit and headless tests
        run: cargo test --workspace --all-targets --locked --features test-support
      - name: Run doctests
        run: cargo test --workspace --doc --locked
      - name: Run Stage 1 tooling tests
        run: |
          python3 -m unittest discover -s tooling -p 'test_*.py'
          python3 -m unittest discover -s tooling/tests -p 'test_*.py'

  compatibility-and-packaging:
    name: Compatibility and package manifests
    needs: unit-and-headless
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
      - name: Install system dependencies
        run: script/bootstrap
      - name: Show publication prerequisites
        run: cargo xtask publish-plan
      - name: Validate compatibility and package artifacts
        run: cargo xtask release-check

  # Ordinary-CI build and legacy smoke coverage for the app-platform examples.
  # This job does not retain protocol evidence and is not the cross-platform
  # native acceptance matrix. `.github/workflows/stage1.yml` owns native macOS,
  # Windows WARP, Linux X11/lavapipe, and Linux Wayland/lavapipe execution,
  # validation, exact-source manifests, and artifacts. Keep this build matrix in
  # sync with `compile`; keep runtime claims in Stage 1 only.
  native-launch-smoke:
    name: Native launch smoke
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            run_on: macos-latest
          - target: x86_64-linux-gnu
            run_on: ubuntu-latest
          - target: x86_64-windows-msvc
            run_on: windows-latest
    runs-on: ${{ matrix.run_on }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
      - name: Install system dependencies
        if: ${{ matrix.run_on != 'windows-latest' }}
        run: script/bootstrap
      # Build on every OS: this exercises the full D4 identity chain (build.rs +
      # include_identity!) cross-platform, even where we do not launch a
      # GPU-backed window below.
      - name: Build conformance examples
        run: cargo build --locked -p app_shell -p app_shell_background
      # Retain the established macOS example smoke as a fast ordinary-CI
      # regression. Linux and Windows example binaries are compiled here, while
      # their configured native runtime coverage belongs to Stage 1's dedicated
      # lavapipe and WARP jobs. Do not infer Stage 1 evidence from this step.
      - name: Native launch smoke (macOS)
        if: ${{ matrix.run_on == 'macos-latest' }}
        run: |
          cargo run --locked -p app_shell -- --asset-smoke
          cargo run --locked -p app_shell -- --smoke
          cargo run --locked -p app_shell_background -- --smoke
      # This ordinary-CI regression opens no window and checks the legacy example
      # exit contract. Stage 1 separately validates the protocol startup-failure
      # scenario on every maintained native profile.
      - name: Transactional startup failure smoke (macOS)
        if: ${{ matrix.run_on == 'macos-latest' }}
        shell: bash
        run: |
          set +e
          output="$(cargo run --locked -p app_shell -- --fail-start 2>&1)"
          exit_code=$?
          set -e
          printf '%s\n' "$output"
          if [ "$exit_code" -ne 2 ]; then
            echo "expected transactional startup failure to exit 2, got $exit_code"
            exit 1
          fi
          grep -Fq APP_SHELL_FAIL_START_REACHED <<<"$output"
      - name: Transactional startup failure smoke (Windows)
        if: ${{ matrix.run_on == 'windows-latest' }}
        shell: pwsh
        run: |
          # This step expects the binary to fail, so cargo exits non-zero and
          # writes to stderr. Both trip pwsh: a native command's stderr through
          # a 2>&1 pipeline can raise a terminating NativeCommandError, and the
          # runner appends `exit $LASTEXITCODE`, which would propagate cargo's
          # exit 2 as a step failure even when the assertions pass.
          #
          # So: redirect all streams to a file rather than piping, suppress
          # native-error promotion, and exit explicitly.
          $ErrorActionPreference = 'Continue'
          $PSNativeCommandUseErrorActionPreference = $false
          cargo run --locked -p app_shell -- --fail-start *> app_shell_fail_start.log
          $exitCode = $LASTEXITCODE
          $output = Get-Content app_shell_fail_start.log -Raw
          Write-Output $output
          if ($exitCode -ne 2) {
            Write-Output "expected transactional startup failure to exit 2, got $exitCode"
            exit 1
          }
          if (-not $output.Contains("APP_SHELL_FAIL_START_REACHED")) {
            Write-Output "transactional start callback marker was not emitted"
            exit 1
          }
          exit 0