git-remote-object-store 0.2.4

# CI workflow
#
# Jobs:
#   1. commitsar         - validates commit messages against conventional commits
#   2. ci                - formatting checks (no auto-fix), linting, tests, build
#   3. integration-s3    - S3 backend integration tests via testcontainers (RustFS)
#   4. integration-azure - Azure Blob backend integration tests via testcontainers
#                          (Azurite)
#
# Tool versions are pinned in the env section below. Updating a version
# automatically invalidates the binary cache.
#
# See docs/development/ci.md for details, caching strategy, and troubleshooting.
name: CI

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:

# Cancel in-progress runs for the same ref (e.g. PR pushes) but not on
# main or tag builds — those should always complete.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/') }}

# Default to read-only for the workflow; jobs that need to post check runs
# (dorny/test-reporter) opt in to `checks: write` per-job below.
permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  # Pinned tool versions -- update here to roll forward.
  COMMITSAR_VERSION: "1.0.3"
  CARGO_DENY_VERSION: "0.18.9"
  SHELLSPEC_VERSION: "0.28.1"
  MARKDOWNLINT_CLI2_VERSION: "0.21.0"
  TAPLO_VERSION: "0.10.0"
  # taplo pre-built binary checksum (taplo-linux-x86_64.gz)
  TAPLO_SHA256_X86_64: "8fe196b894ccf9072f98d4e1013a180306e17d244830b03986ee5e8eabeb6156"
  SHFMT_VERSION: "3.13.0"
  # shfmt pre-built binary checksum (shfmt_v{ver}_linux_amd64)
  SHFMT_SHA256_AMD64: "70aa99784703a8d6569bbf0b1e43e1a91906a4166bf1a79de42050a6d0de7551"
  CHECKMAKE_VERSION: "0.3.2"
  # checkmake pre-built binary checksum (checkmake-v{ver}.linux.amd64)
  CHECKMAKE_SHA256_AMD64: "e2effb876913f3ee2caef0ba35f6202c5e8a3cd55a077d8d2b9ce2034257b6af"

jobs:
  # -------------------------------------------------------------------
  # Job 0: Derive the Rust toolchain version from Cargo.toml.
  #
  # `rust-version` in `[workspace.package]` is the single source of
  # truth for MSRV; every downstream job reads it from this job's
  # output via `${{ needs.derive-toolchain.outputs.toolchain }}` so a
  # bump in Cargo.toml propagates without manual workflow edits.
  #
  # `cargo metadata --no-deps` parses Cargo.toml only — it does not
  # need the MSRV toolchain installed, so the runner's pre-installed
  # rustup default is sufficient.
  # -------------------------------------------------------------------
  derive-toolchain:
    name: Derive toolchain
    runs-on: ubuntu-latest
    outputs:
      toolchain: ${{ steps.read.outputs.toolchain }}
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Read MSRV from Cargo.toml
        id: read
        run: |
          set -euo pipefail
          TOOLCHAIN=$(cargo metadata --no-deps --format-version 1 \
            | jq -r '.packages[] | select(.name == "git-remote-object-store") | .rust_version')
          if [[ -z "$TOOLCHAIN" || "$TOOLCHAIN" == "null" ]]; then
            echo "::error::Could not read rust-version from Cargo.toml"
            exit 1
          fi
          echo "toolchain=$TOOLCHAIN" >> "$GITHUB_OUTPUT"
          echo "Derived toolchain: $TOOLCHAIN"

  # -------------------------------------------------------------------
  # Job 1: Validate commit messages against conventional commits spec
  #
  # Uses a pre-built binary instead of the Docker action to avoid a
  # full Go compilation (~30-60s) on every run.
  # -------------------------------------------------------------------
  commitsar:
    name: Commit Messages
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0 # Full history for commit validation

      - name: Cache commitsar
        id: cache-commitsar
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.local/bin/commitsar
          key: commitsar-${{ env.COMMITSAR_VERSION }}-linux-amd64

      - name: Install commitsar
        if: steps.cache-commitsar.outputs.cache-hit != 'true'
        run: |
          mkdir -p ~/.local/bin
          curl -fsSL \
            "https://github.com/aevea/commitsar/releases/download/v${COMMITSAR_VERSION}/commitsar_${COMMITSAR_VERSION}_linux_amd64.tar.gz" \
            | tar -xz -C ~/.local/bin commitsar
          chmod +x ~/.local/bin/commitsar

      - name: Validate conventional commits
        run: ~/.local/bin/commitsar

  # -------------------------------------------------------------------
  # Job 2: Format checks, linting, tests, build verification.
  #
  # Wires up `make _ci-*` targets so local `make ci` matches the CI
  # pipeline byte-for-byte.
  # -------------------------------------------------------------------
  build-test:
    name: Build & Test
    needs: derive-toolchain
    runs-on: ubuntu-latest
    # `dorny/test-reporter` posts a check run with the shellspec results.
    permissions:
      contents: read
      checks: write
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install Ubuntu dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y shellcheck jq

      - name: Setup Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
        with:
          toolchain: ${{ needs.derive-toolchain.outputs.toolchain }}
          components: rustfmt, clippy
          # Built-in caching via Swatinem/rust-cache handles ~/.cargo
          # registry/git, target/, and (with cache-bin: true) ~/.cargo/bin
          # so `cargo install cargo-deny` is restored across runs.
          cache-key: ci
          cache-bin: "true"

      - name: Cache CI tools
        id: cache-tools
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.local/bin
            ~/.local/lib/shellspec
            ~/.npm-global
          # Include runner.os + runner.arch so a future macOS or arm64
          # runner does not silently restore wrong-platform binaries.
          key: >-
            ${{ runner.os }}-${{ runner.arch }}-ci-tools-taplo-${{ env.TAPLO_VERSION }}-shfmt-${{ env.SHFMT_VERSION }}-shellspec-${{ env.SHELLSPEC_VERSION }}-mdlint-${{ env.MARKDOWNLINT_CLI2_VERSION }}-checkmake-${{ env.CHECKMAKE_VERSION }}

      - name: Add tool directories to PATH
        run: |
          {
            echo "$HOME/.local/bin"
            echo "$HOME/.npm-global/bin"
          } >> "$GITHUB_PATH"

      # cargo-deny is cached automatically by the Rust toolchain action
      # (Swatinem/rust-cache covers ~/.cargo/bin). cargo install skips
      # work if the binary is already present at the requested version.
      - name: Install cargo-deny
        run: cargo install cargo-deny --version ${{ env.CARGO_DENY_VERSION }} --locked

      - name: Install taplo
        if: steps.cache-tools.outputs.cache-hit != 'true'
        run: |
          mkdir -p ~/.local/bin
          curl -fsSL -o /tmp/taplo.gz \
            "https://github.com/tamasfe/taplo/releases/download/${TAPLO_VERSION}/taplo-linux-x86_64.gz"
          echo "${TAPLO_SHA256_X86_64}  /tmp/taplo.gz" | sha256sum --check
          gunzip /tmp/taplo.gz
          chmod +x /tmp/taplo
          mv /tmp/taplo ~/.local/bin/taplo

      - name: Install shfmt
        if: steps.cache-tools.outputs.cache-hit != 'true'
        run: |
          mkdir -p ~/.local/bin
          curl -fsSL -o "$HOME/.local/bin/shfmt" \
            "https://github.com/mvdan/sh/releases/download/v${SHFMT_VERSION}/shfmt_v${SHFMT_VERSION}_linux_amd64"
          echo "${SHFMT_SHA256_AMD64}  $HOME/.local/bin/shfmt" | sha256sum --check
          chmod +x "$HOME/.local/bin/shfmt"

      - name: Install checkmake
        if: steps.cache-tools.outputs.cache-hit != 'true'
        run: |
          mkdir -p ~/.local/bin
          curl -fsSL -o "$HOME/.local/bin/checkmake" \
            "https://github.com/checkmake/checkmake/releases/download/v${CHECKMAKE_VERSION}/checkmake-v${CHECKMAKE_VERSION}.linux.amd64"
          echo "${CHECKMAKE_SHA256_AMD64}  $HOME/.local/bin/checkmake" | sha256sum --check
          chmod +x "$HOME/.local/bin/checkmake"

      - name: Install shellspec
        if: steps.cache-tools.outputs.cache-hit != 'true'
        run: |
          curl -fsSL "https://github.com/shellspec/shellspec/raw/${SHELLSPEC_VERSION}/install.sh" \
            | sh -s "${SHELLSPEC_VERSION}" --yes

      - name: Install markdownlint-cli2
        if: steps.cache-tools.outputs.cache-hit != 'true'
        run: |
          npm config set prefix ~/.npm-global
          npm install -g "markdownlint-cli2@${MARKDOWNLINT_CLI2_VERSION}"

      - name: Verify tools
        run: make check-tools

      # -- Formatting checks (must pass before lint/check steps) ----
      - name: Check formatting
        run: make _ci-fmt-check

      # -- Independent lint/check steps (sequential for UI visibility) ----
      - name: Clippy
        run: make _ci-clippy

      - name: ShellCheck
        run: make _ci-shellcheck

      - name: Markdown lint
        run: make _ci-markdown-check

      - name: TOML lint
        run: make _ci-toml-lint

      - name: Makefile lint
        run: make _ci-makefile-check

      - name: cargo-deny
        run: make _ci-deny

      - name: Man pages up to date
        run: make _ci-man-check

      - name: Run Rust tests
        id: rust-tests
        continue-on-error: true
        run: make _ci-test

      - name: Build binaries
        id: build
        run: make _ci-build

      - name: Run ShellSpec tests
        id: shellspec-tests
        if: steps.build.outcome == 'success'
        continue-on-error: true
        run: make _ci-shellspec

      - name: ShellSpec test results
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        if: always() && (steps.shellspec-tests.outcome == 'success' || steps.shellspec-tests.outcome == 'failure')
        with:
          name: ShellSpec Tests
          path: reports/results_junit.xml
          reporter: java-junit
          fail-on-error: true
          max-annotations: 10

      # Safety net: fail the job if any test step failed.
      - name: Fail on test failures
        if: always()
        run: |
          if [ "${{ steps.rust-tests.outcome }}" = "failure" ] || \
             [ "${{ steps.shellspec-tests.outcome }}" = "failure" ]; then
            echo "::error::One or more test steps failed"
            exit 1
          fi

  # -------------------------------------------------------------------
  # Job 3: S3 backend integration tests
  #
  # testcontainers spins up a RustFS (S3-compatible) container per test
  # binary. Docker is preinstalled on ubuntu-latest runners.
  # -------------------------------------------------------------------
  integration-s3:
    name: Integration (S3 / RustFS)
    needs: derive-toolchain
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
        with:
          toolchain: ${{ needs.derive-toolchain.outputs.toolchain }}
          cache-key: integration-s3

      - name: Run S3 integration tests
        run: cargo test --workspace --features integration-s3 --test s3_store_integration

      - name: Run packchain live S3 tests
        run: cargo test --workspace --features integration-s3 --test packchain_live_s3

  # -------------------------------------------------------------------
  # Job 4: Azure Blob backend integration tests
  #
  # testcontainers spins up an Azurite emulator container per test binary.
  # -------------------------------------------------------------------
  integration-azure:
    name: Integration (Azure / Azurite)
    needs: derive-toolchain
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
        with:
          toolchain: ${{ needs.derive-toolchain.outputs.toolchain }}
          cache-key: integration-azure

      - name: Run Azure integration tests
        run: cargo test --workspace --features integration-azure --test azure_store_integration

      - name: Run packchain live Azure tests
        run: cargo test --workspace --features integration-azure --test packchain_live_azure

  # -------------------------------------------------------------------
  # Job 5: rustdoc — fails on broken doclinks and missing-docs warnings.
  #
  # Delegates to `make _ci-doc-check` so the exact command (`-D warnings`
  # plus `--all-features --locked --no-deps --workspace`) lives in the
  # Makefile alongside the local `make pre-commit` hook. `--all-features`
  # is what activates the `test-util`-gated mock store so its doc
  # comments are also checked — the previous in-line `cargo doc` did not
  # set it and silently skipped those modules.
  # -------------------------------------------------------------------
  docs:
    name: rustdoc
    needs: derive-toolchain
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
        with:
          toolchain: ${{ needs.derive-toolchain.outputs.toolchain }}
          cache-key: docs

      - name: Build rustdoc
        run: make _ci-doc-check

  # -------------------------------------------------------------------
  # Job 6: MSRV — build-only on the declared minimum Rust version.
  #
  # Test is intentionally not run; dev-deps may legitimately require a
  # newer toolchain. MSRV is a compile-time promise about consumers,
  # not the test suite.
  # -------------------------------------------------------------------
  msrv:
    name: msrv
    needs: derive-toolchain
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
        with:
          toolchain: ${{ needs.derive-toolchain.outputs.toolchain }}
          cache-key: msrv

      - name: Build
        run: cargo build --workspace --locked

  # -------------------------------------------------------------------
  # Aggregate gate — single required check for branch protection.
  #
  # Branch-protection rules in GitHub track checks by name; depending
  # on every leaf job means we never have to update protection when
  # the matrix changes. Failing or cancelled dependencies fail this
  # job; skipped dependencies are treated as success.
  # -------------------------------------------------------------------
  ci:
    name: ci
    if: always()
    needs:
      - derive-toolchain
      - commitsar
      - build-test
      - integration-s3
      - integration-azure
      - docs
      - msrv
    runs-on: ubuntu-latest
    steps:
      - name: Fail if any dependency failed or was cancelled
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: exit 1