lzo 0.1.0

Safe, dependency-free, pure-Rust LZO1X decompressor — the GPL-free, MIT-licensed alternative for reading lzo1x_1 / lzo1x_999 streams.
Documentation
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"
  RUSTFLAGS: -Dwarnings

jobs:
  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          components: rustfmt
      - run: cargo fmt --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
      - run: cargo clippy --all-targets -- -D warnings
      # The lean `no_std` build (no `alloc` convenience) must stay warning-clean.
      - run: cargo clippy --all-targets --no-default-features -- -D warnings

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
      - run: cargo test
      - run: cargo test --no-default-features

  deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15

  msrv:
    name: MSRV (1.85)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: dtolnay/rust-toolchain@c56a35af9328d0bc581dc86c05e58f97f7c38a0e # 1.85
      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
      - run: cargo test
      - run: cargo build --no-default-features

  fuzz-check:
    name: Fuzz (build check)
    runs-on: ubuntu-latest
    # The workflow-wide RUSTFLAGS=-Dwarnings must NOT leak into the nightly fuzz
    # build (nightly warns more freely) or cargo-fuzz's own build.
    env:
      RUSTFLAGS: ""
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      # cargo-fuzz needs nightly (-Z sanitizer=address); override the channel on
      # the pinned toolchain action rather than pinning a separate @nightly ref
      # (a SHA-pinned nightly ref leaves the toolchain name empty).
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: nightly
          components: rust-src
      # Install without --locked: cargo-fuzz's pinned Cargo.lock holds an old
      # rustix whose attributes current nightly rejects.
      - run: cargo install cargo-fuzz
      - run: cargo fuzz build

  secrets:
    name: Secret Scan (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - name: Install gitleaks
        # renovate: datasource=github-releases depName=gitleaks/gitleaks
        run: |
          VERSION=8.30.1
          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \
            | tar xz -C /tmp gitleaks
      - name: Run gitleaks
        run: /tmp/gitleaks detect --source .

  coverage:
    name: Coverage (100% lines)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          components: llvm-tools-preview
      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
      - run: cargo install cargo-llvm-cov --locked
      # 100% line coverage: any `DA:<line>,0` record fails the gate.
      - name: Enforce 100% line coverage
        run: |
          cargo llvm-cov --lcov --output-path lcov.info
          if grep -qE '^DA:[0-9]+,0$' lcov.info; then
            echo "::error::uncovered lines:"; grep -nE '^(SF:|DA:[0-9]+,0$)' lcov.info
            exit 1
          fi
          echo "100% line coverage ✓"
      # The whole public API is exercised through the integration tests (tests/),
      # so the e2e suite alone must also reach 100% — no line is reachable only
      # via white-box unit tests.
      - name: Enforce 100% e2e (public-API) coverage
        run: |
          cargo llvm-cov --test roundtrip --test errors --lcov --output-path e2e.info
          if grep -qE '^DA:[0-9]+,0$' e2e.info; then
            echo "::error::e2e leaves public-API lines uncovered:"; grep -nE '^(SF:|DA:[0-9]+,0$)' e2e.info
            exit 1
          fi
          echo "100% e2e coverage ✓"

  geiger:
    name: Unsafe Audit (cargo-geiger)
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
      - run: cargo install cargo-geiger --locked
      - run: cargo geiger 2>&1 || true