asx-rs 0.14.0

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  check-test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        features:
          - "as2,client"
          - "as4,server"
          - "as2,as4,client,server,trace"
          # `testing` without `interop-relaxed`: this combination is reachable
          # by any downstream integration-test build and was silently broken
          # because every prior job enabled both together.
          - "as2,as4,testing"
          - "as2,as4,testing,interop-relaxed"
          - "as2,as4,compression"
          # Participant discovery pulls a DNS client; it is off by default, so
          # nothing else in this matrix compiles it.
          - "as4,client,dns"
    steps:
      - uses: actions/checkout@v4
      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
      # `-D warnings` here and not only at `--all-features`: dead code behind a
      # feature gate is invisible to a build that enables every feature, which
      # is exactly where a `#[cfg]` drifts out of step with its callers.
      - name: Cargo check
        env:
          RUSTFLAGS: "-D warnings"
        run: cargo check --no-default-features --features "${{ matrix.features }}"
      - name: Cargo test
        run: cargo test --no-default-features --features "${{ matrix.features }}"

  # A hand-written matrix only covers combinations someone thought of. This
  # walks the powerset so a `#[cfg]` branch that no listed combination compiles
  # cannot reach main unnoticed.
  feature-powerset:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-hack
        uses: taiki-e/install-action@cargo-hack
      # `--at-least-one-of as2,as4` encodes the crate's own invariant: without a
      # protocol feature there is nothing to build but shared infrastructure,
      # and `server` deliberately `compile_error!`s in that state.
      - name: Check feature powerset
        run: |
          cargo hack check --feature-powerset --depth 2 \
            --at-least-one-of as2,as4 \
            --exclude-features prometheus,opentelemetry \
            --lib --tests

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Cargo fmt
        run: cargo fmt --all -- --check
      - name: Cargo clippy
        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
      # A broken intra-doc link ships to docs.rs as a dead reference. Four of
      # them were live, one pointing at a bypass verifier that is not exported.
      - name: Rustdoc links
        env:
          RUSTDOCFLAGS: "-D warnings"
        run: cargo doc --all-features --no-deps

  perf-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Run Performance Gate
        run: |
          cargo run --release -p xtask --no-default-features --features "as2,as4,client,server,trace,compression,async-ocsp,interop-strict" -- perf-gate \
            --iterations 2000 \
            --check-baseline benches/perf-baseline.txt \
            --max-regression 0.25

  perf-matrix-smoke:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        features:
          - "as2,client"
          - "as4,server"
          - "as2,as4,client,server"
    steps:
      - uses: actions/checkout@v4
      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Benchmark Harness Smoke
        run: |
          cargo run --release -p xtask --no-default-features --features "${{ matrix.features }}" -- perf-gate --iterations 500

  interop-fixtures-required:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Run Required Interop Fixtures
        run: |
          cargo test --all-features --test as2_send_golden
          cargo test --all-features --test as2_receive_mdn
          cargo test --all-features --test as4_push_flow
          cargo test --all-features --test as4_pull_flow
          cargo test --all-features --test wssec_c14n_vectors
          cargo test --all-features --test wssec_strict_matrix

  property-and-fuzz-smoke:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Run Property Test Suite
        run: cargo test --all-features --test property_protocol_invariants
      - name: Run Profile Property Invariants
        run: cargo test --all-features --test profile_property_invariants
      - name: Run Fuzz Smoke Suite
        run: cargo test --all-features --test fuzz_protocol_ingress

  interop-matrix-and-vector-required:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Run Interop Matrix Gate
        run: bash scripts/run_interop_matrix.sh
      - name: Run WS-Security Vector Gate
        run: bash scripts/run_wssec_vector_gate.sh

  fuzz-adversarial-required:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Run Adversarial Fuzz Gate
        run: bash scripts/run_fuzz_gate.sh 4000 2500 artifacts/fuzz
      - name: Upload Fuzz Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: fuzz-artifacts
          path: artifacts/fuzz

  session-isolation-required:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Run Session Isolation Integration Suite
        run: cargo test --all-features --test session_isolation_concurrency

  coverage-profile-interop:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov
      - name: Enforce Profile/Interop Coverage Threshold
        run: bash scripts/check_profile_coverage.sh 85 src/interop.rs

  # `rust-version` in Cargo.toml is a promise to embedders pinned to an older
  # toolchain. It was declared and unchecked; a build on the exact floor is what
  # makes it a fact rather than a claim.
  msrv:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Read declared MSRV
        id: msrv
        run: |
          echo "version=$(grep -m1 '^rust-version' Cargo.toml | cut -d'"' -f2)" >> "$GITHUB_OUTPUT"
      - name: Install the declared toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ steps.msrv.outputs.version }}
      - name: Build on the MSRV floor
        run: cargo check --all-features --all-targets

  # An example that does not compile is worse than none: it looks checked.
  # The budget only ever goes down.
  doctest-ratchet:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Ratchet uncompiled doctests
        run: bash scripts/check_doctest_ratchet.sh 39