forge-guard 0.2.1

name: CI

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always

jobs:
  check:
    name: Check & Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt

      - name: Generate Cargo.lock for deterministic cache key
        run: cargo generate-lockfile

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2
        with:
          key: forge-guard-${{ hashFiles('Cargo.lock') }}
          cache-on-failure: true

      - name: Check formatting
        run: cargo fmt --check

      - name: Clippy
        run: cargo clippy -- -D warnings

      - name: Run tests
        run: cargo test --workspace

  version-check:
    name: Version Consistency
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Check CHANGELOG.md has entry matching Cargo.toml version
        run: |
          CARGO_VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml)
          if grep -q "^## \[$CARGO_VERSION\]" CHANGELOG.md; then
            echo "✅ CHANGELOG.md has section for v$CARGO_VERSION"
          else
            echo "❌ CHANGELOG.md is missing section for v$CARGO_VERSION"
            echo "   Add: ## [$CARGO_VERSION] - $(date +%Y-%m-%d)"
            exit 1
          fi

      - name: Check README uses dynamic version badge
        run: |
          if grep -q 'shields\.io/crates/v/forge-guard' README.md; then
            echo "✅ README uses dynamic crates.io version badge"
          else
            echo "⚠️  README may use hardcoded version — consider dynamic badge"
          fi

      - name: Check milestone-based-roadmap has current version
        run: |
          CARGO_VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml)
          if grep -q "v$CARGO_VERSION" milestone-based-roadmap.md 2>/dev/null || grep -q "$CARGO_VERSION" CHANGELOG.md 2>/dev/null; then
            echo "✅ Version v$CARGO_VERSION referenced in project docs"
          else
            echo "ℹ️  Version v$CARGO_VERSION not found in roadmap (optional)"
          fi

  audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Generate Cargo.lock for deterministic cache key
        run: cargo generate-lockfile

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2
        with:
          key: forge-guard-audit-${{ hashFiles('Cargo.lock') }}
          cache-on-failure: true

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Audit Rust dependencies
        run: cargo audit

      - name: Install forge-audit
        run: cargo build --release && cp target/release/forge-guard /usr/local/bin/

      - name: Scan Solidity dependencies
        run: forge-guard scan --depth 1 || echo "⚠️  forge-guard scan completed with warnings"