git-cache-proxy 0.1.10

name: CI

on:
  push:
    branches: [main]
  pull_request:

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  # Gate the Rust jobs on Rust changes, so docs-only changes skip lint and test.
  changes:
    name: Detect changes
    runs-on: ubuntu-latest
    outputs:
      rust: ${{ steps.filter.outputs.rust }}
      helm: ${{ steps.filter.outputs.helm }}
    steps:
      - uses: actions/checkout@v7
      - uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
            rust:
              - '**/*.rs'
              - '**/Cargo.toml'
              - 'Cargo.lock'
              - 'deny.toml'
              - '.github/workflows/ci.yml'
            helm:
              - 'chart/**'
              - '.github/workflows/ci.yml'

  lint:
    name: Lint
    needs: changes
    if: needs.changes.outputs.rust == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      - uses: Swatinem/rust-cache@v2
      - name: Check formatting
        run: cargo fmt --all --check
      - name: Run clippy
        run: cargo clippy --all-targets --all-features --locked -- -D warnings

  test:
    name: Test and coverage
    needs: changes
    if: needs.changes.outputs.rust == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-llvm-cov
      - name: Test and collect coverage
        # Exclude the thin binary shim (src/main.rs: arg parsing, wiring, serve) from
        # the coverage number - it is not unit-testable and the logic it wires up is
        # covered via the library by the integration tests. Fail if under 80%.
        run: |
          cargo llvm-cov --all-features --locked --ignore-filename-regex 'src/main\.rs' --lcov --output-path lcov.info
          cargo llvm-cov report --ignore-filename-regex 'src/main\.rs' --summary-only --fail-under-lines 80
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          files: lcov.info
          token: ${{ secrets.CODECOV_TOKEN }}

  # Scan the dependency tree for security advisories, disallowed licenses, and
  # non-crates.io sources (config in deny.toml).
  deny:
    name: Dependencies
    needs: changes
    if: needs.changes.outputs.rust == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-deny
      - name: Check dependencies
        run: cargo deny check

  helm:
    name: Lint and validate Helm chart
    needs: changes
    if: needs.changes.outputs.helm == 'true'
    runs-on: ubuntu-latest
    env:
      # kubeconform release used to validate rendered manifests against the
      # Kubernetes schemas.
      KUBECONFORM_VERSION: v0.6.7
    steps:
      - uses: actions/checkout@v7
      - uses: azure/setup-helm@v5
      - name: Install kubeconform
        run: |
          curl -sSL "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/kubeconform-linux-amd64.tar.gz" \
            | tar -xz -C /usr/local/bin kubeconform
      - name: Lint, render, and validate the chart
        shell: bash
        run: |
          set -euo pipefail
          helm lint chart
          # Render under a few value combinations so the conditional templates
          # (Ingress, emptyDir, ServiceMonitor, CA trust, auth secrets) are all
          # exercised, then validate each render against the Kubernetes schemas.
          # -strict rejects unknown fields; -ignore-missing-schemas skips CRDs
          # (the ServiceMonitor).
          for args in \
            "" \
            "--set ingress.enabled=true" \
            "--set persistence.enabled=false" \
            "--set serviceMonitor.enabled=true" \
            "--set caTrust.enabled=true,caTrust.configMapName=ca" \
            "--set upstreamAuth.existingSecret=up,serveToken.existingSecret=srv"; do
            echo "-- helm template chart $args"
            helm template release chart $args \
              | kubeconform -strict -summary -ignore-missing-schemas
          done

  # Spelling runs on everything, including docs.
  typos:
    name: Typos
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: crate-ci/typos@v1

  # Conventional Commits check for pull requests (advisory; direct pushes to main are
  # covered by a local commit-msg hook - see CONTRIBUTING.md).
  commits:
    name: Commit messages
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      # Dependabot commit messages are auto-generated: long changelog and URL
      # lines in the body exceed line_length and long dep names exceed
      # subject_length, neither of which is configurable. Exempt them (keyed on
      # PR author so maintainer re-runs stay stable); the job still runs green.
      - if: github.event.pull_request.user.login != 'dependabot[bot]'
        uses: crate-ci/committed@v1.1.11