ci.yml

# Continuous Integration workflow for iggy-sample
#
# Runs on every push to main and on all pull requests.
# Includes: formatting, linting, testing, coverage, documentation, and security audit.

name: CI

on:
    push:
        branches: [main, develop]
    pull_request:
        branches: [main]
    schedule:
        # Run every Monday at 2:00 AM UTC to catch dependency issues early
        - cron: "0 2 * * 1"

env:
    CARGO_TERM_COLOR: always
    RUST_BACKTRACE: 1
    # Minimum supported Rust version
    MSRV: "1.93.0"

# Cancel in-progress runs for the same branch
concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true

jobs:
    # ==========================================================================
    # Formatting check (fast, run first)
    # ==========================================================================
    fmt:
        name: Rustfmt
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v4
            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
              with:
                  toolchain: nightly
                  components: rustfmt
            - name: Check formatting
              run: cargo fmt --all -- --check

    # ==========================================================================
    # Clippy linting
    # ==========================================================================
    clippy:
        name: Clippy
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v4
            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
              with:
                  toolchain: stable
                  components: clippy
            - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
            - name: Run Clippy
              run: cargo clippy --all-targets --all-features -- -D warnings

    # ==========================================================================
    # Test matrix across OS and Rust versions
    # ==========================================================================
    test:
        name: Test (${{ matrix.os }}, ${{ matrix.rust }})
        runs-on: ${{ matrix.os }}
        needs: [fmt]
        strategy:
            fail-fast: false
            matrix:
                os: [ubuntu-latest, macos-latest, windows-latest]
                rust: [stable, beta]
                include:
                    # MSRV check on Ubuntu only
                    - os: ubuntu-latest
                      rust: "1.93.0"
        steps:
            - uses: actions/checkout@v4
            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
              with:
                  toolchain: ${{ matrix.rust }}
            - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
              with:
                  key: ${{ matrix.os }}-${{ matrix.rust }}

            - name: Build
              run: cargo build --all-features

            - name: Run unit tests
              run: cargo test --lib --all-features

            - name: Run doc tests
              run: cargo test --doc --all-features

    # ==========================================================================
    # Integration tests (requires Docker for testcontainers)
    # ==========================================================================
    integration:
        name: Integration Tests
        runs-on: ubuntu-latest
        needs: [fmt, clippy]
        steps:
            - uses: actions/checkout@v4
            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
              with:
                  toolchain: stable
            - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

            - name: Run integration tests
              run: cargo test --test '*' --all-features
              env:
                  # Testcontainers will pull and run Iggy server automatically
                  TESTCONTAINERS: true

    # ==========================================================================
    # Code coverage
    # ==========================================================================
    coverage:
        name: Code Coverage
        runs-on: ubuntu-latest
        needs: [test]
        steps:
            - uses: actions/checkout@v4
            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
              with:
                  toolchain: stable
                  components: llvm-tools-preview
            - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

            - name: Install cargo-llvm-cov
              uses: taiki-e/install-action@4684b8405694ae9dd42c9f39ba901a70ae83f4a3 # v2.82.9
              with:
                  tool: cargo-llvm-cov

            - name: Generate coverage report
              run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info

            - name: Upload coverage to Codecov
              uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
              with:
                  files: lcov.info
                  fail_ci_if_error: false
              env:
                  CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

    # ==========================================================================
    # Documentation build
    # ==========================================================================
    docs:
        name: Documentation
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v4
            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
              with:
                  toolchain: stable
            - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

            - name: Build documentation
              run: cargo doc --no-deps --all-features
              env:
                  RUSTDOCFLAGS: -D warnings

    # ==========================================================================
    # Security audit
    # ==========================================================================
    audit:
        name: Security Audit
        runs-on: ubuntu-latest
        permissions:
            checks: write
            contents: read
            issues: write
        steps:
            - uses: actions/checkout@v4
            - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
              with:
                  token: ${{ secrets.GITHUB_TOKEN }}

    # ==========================================================================
    # Dependency policy check (advisories + licenses, gated by deny.toml)
    # ==========================================================================
    licenses:
        name: Dependency Policy (cargo-deny)
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v4
            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
              with:
                  toolchain: stable
            - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

            - name: Install cargo-deny
              uses: taiki-e/install-action@4684b8405694ae9dd42c9f39ba901a70ae83f4a3 # v2.82.9
              with:
                  tool: cargo-deny

            - name: Check dependency policy (advisories, bans, licenses, sources)
              run: cargo deny check

    # ==========================================================================
    # Final status check (for branch protection)
    # ==========================================================================
    ci-success:
        name: CI Success
        runs-on: ubuntu-latest
        needs: [fmt, clippy, test, integration, docs, audit, licenses]
        if: always()
        steps:
            - name: Check all jobs passed
              run: |
                  if [[ "${{ needs.fmt.result }}" != "success" ]] || \
                     [[ "${{ needs.clippy.result }}" != "success" ]] || \
                     [[ "${{ needs.test.result }}" != "success" ]] || \
                     [[ "${{ needs.integration.result }}" != "success" ]] || \
                     [[ "${{ needs.docs.result }}" != "success" ]] || \
                     [[ "${{ needs.audit.result }}" != "success" ]] || \
                     [[ "${{ needs.licenses.result }}" != "success" ]]; then
                    echo "One or more jobs failed"
                    exit 1
                  fi
                  echo "All CI checks passed!"