macp-runtime 0.5.0

name: MACP Runtime CI

on:
  pull_request:
  push:
    branches: [ main ]

env:
  CARGO_TERM_COLOR: always
  # Main jobs run on stable; MSRV_TOOLCHAIN gates the minimum supported
  # version via the `check` job (previously EVERYTHING ran only on the pin,
  # so latest-stable regressions surfaced first at publish time).
  RUST_TOOLCHAIN: "stable"
  MSRV_TOOLCHAIN: "1.89.0"
  # The repo pins the MSRV via rust-toolchain.toml (channel = "1.89.0"), and
  # that file wins over the installed default for plain `cargo` — without
  # this, every "stable" job silently resolves to a minimal auto-installed
  # 1.89.0 (no rustfmt/clippy components) and fails. RUSTUP_TOOLCHAIN has
  # higher precedence than the file (same pattern as publish.yml); the MSRV
  # job overrides it back to the pin at job level.
  RUSTUP_TOOLCHAIN: "stable"

jobs:
  check:
    name: Check (MSRV)
    runs-on: ubuntu-latest
    env:
      # Job-level override: the MSRV gate must run on the pin, not stable.
      # (Hardcoded because workflow env isn't referencable in job-level env;
      # keep in sync with MSRV_TOOLCHAIN above.)
      RUSTUP_TOOLCHAIN: "1.89.0"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.MSRV_TOOLCHAIN }}

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Cargo check
        run: cargo check --all-targets

  fmt:
    name: Format
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          components: rustfmt

      - name: Check formatting
        run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          components: clippy

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Run clippy
        run: cargo clippy --all-targets -- -D warnings

  test:
    name: Test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Run tests
        run: cargo test --all-targets
        env:
          MACP_MEMORY_ONLY: "1"

      - name: Run conformance tests
        run: cargo test conformance
        env:
          MACP_MEMORY_ONLY: "1"

      - name: Run policy tests
        run: cargo test policy
        env:
          MACP_MEMORY_ONLY: "1"

  build:
    name: Build
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Build release
        run: cargo build --release

  deps-isolation:
    name: Crate Dependency Isolation
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      # Enforce the workspace's layering invariants: the transport-free
      # vocabulary and logic crates must not pull in transport, storage, auth,
      # or any concrete policy engine. A regression here defeats the split.
      - name: macp-core is transport/runtime-free
        run: |
          deps=$(cargo tree -p macp-core --edges normal)
          echo "$deps"
          # Strip the parenthesized manifest path before grepping so the check
          # matches crate names only — the checkout directory itself is named
          # "macp-runtime" and would otherwise trip the forbidden pattern.
          if echo "$deps" | sed 's/ ([^)]*)//' | grep -qiE "tonic|tokio|rocksdb|redis|reqwest|macp-storage|macp-auth|macp-modes|macp-runtime"; then
            echo "::error::macp-core pulled a forbidden dependency"; exit 1
          fi

      - name: macp-modes has no concrete policy / transport
        run: |
          deps=$(cargo tree -p macp-modes --edges normal)
          echo "$deps"
          if echo "$deps" | sed 's/ ([^)]*)//' | grep -qiE "tonic|macp-policy|macp-storage|macp-auth|macp-runtime|reqwest|rocksdb|redis"; then
            echo "::error::macp-modes pulled a forbidden dependency"; exit 1
          fi

      - name: auth deps stay out of the vocabulary crates
        run: |
          for crate in macp-core macp-modes macp-policy macp-storage; do
            deps=$(cargo tree -p "$crate" --edges normal)
            if echo "$deps" | sed 's/ ([^)]*)//' | grep -qiE "jsonwebtoken|reqwest"; then
              echo "::error::$crate pulled an auth-only dependency"; exit 1
            fi
          done

  audit:
    name: Security Audit (advisory)
    runs-on: ubuntu-latest
    # Advisory: a new upstream RUSTSEC entry must not fail unrelated PRs.
    # Findings surface as annotations; not part of the required gate.
    continue-on-error: true

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run cargo audit
        uses: rustsec/audit-check@v2.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  coverage:
    name: Coverage
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Install cargo-tarpaulin
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-tarpaulin

      - name: Generate coverage
        run: cargo tarpaulin --all-targets --out xml
        env:
          MACP_MEMORY_ONLY: "1"

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: cobertura.xml
          fail_ci_if_error: false

  features:
    name: Feature-gated backends (rocksdb, redis)
    runs-on: ubuntu-latest
    services:
      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          components: clippy

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-features-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-features-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      # These backends were previously never compiled in CI — clippy had
      # never seen the code and a broken backend could not fail a build.
      - name: Clippy (feature-gated code)
        run: cargo clippy -p macp-storage --features rocksdb-backend,redis-backend --all-targets -- -D warnings

      - name: Test rocksdb backend
        run: cargo test -p macp-storage --features rocksdb-backend

      - name: Test redis backend (live service)
        run: cargo test -p macp-storage --features redis-backend
        env:
          MACP_TEST_REDIS_URL: redis://127.0.0.1:6379

  integration-tier1:
    name: Tier-1 integration (real gRPC boundary)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
            integration_tests/target
          key: ${{ runner.os }}-cargo-tier1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-tier1-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Build runtime binary
        run: cargo build

      - name: Run tier-1 protocol suite
        working-directory: integration_tests
        run: cargo test --test tier1 --test tier1_jwt -- --test-threads=1
        env:
          MACP_TEST_BINARY: ../target/debug/macp-runtime

  # Conformance oracle: the spec repo's schemas/conformance/ is the single
  # canonical fixture source; this repo vendors byte-identical copies under
  # tests/conformance/ for hermetic local runs. This job (a) byte-compares
  # the vendored copies against canonical and (b) re-runs the conformance
  # suite directly against the canonical files — spec and runtime cannot
  # drift silently (master plan §5.7 step 4, upstream issue #44).
  conformance-oracle:
    name: Conformance oracle (spec-repo fixtures)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Checkout spec repo (canonical fixtures)
        uses: actions/checkout@v4
        with:
          repository: multiagentcoordinationprotocol/multiagentcoordinationprotocol
          path: spec-repo

      - name: Vendored fixtures are byte-identical to canonical
        run: |
          status=0
          for f in tests/conformance/*.json; do
            b=$(basename "$f")
            if ! diff -u "spec-repo/schemas/conformance/$b" "$f"; then
              echo "DRIFT: $b differs from the canonical spec-repo copy" >&2
              status=1
            fi
          done
          exit $status

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Run conformance suite against canonical fixtures
        env:
          MACP_CONFORMANCE_FIXTURES_DIR: ${{ github.workspace }}/spec-repo/schemas/conformance
        run: cargo test --test conformance_loader

  # Build-only Docker gate: proves the published image still builds without
  # pushing anything. The push happens in docker.yml on main/tags. Added after
  # the A-E merge broke the main image build while its (non-required) check
  # was red — this job is in ci-pass, so image breakage now blocks merges.
  docker-build:
    name: Docker Image Build (gate)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build image (no push)
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          cache-from: type=gha
          cache-to: type=gha,mode=max

  ci-pass:
    name: All Checks Passed
    runs-on: ubuntu-latest
    needs: [check, fmt, clippy, test, build, deps-isolation, features, integration-tier1, docker-build, conformance-oracle]

    steps:
      - name: Summary
        run: |
          echo "All checks passed successfully"
          echo "  - cargo check (MSRV)"
          echo "  - cargo fmt"
          echo "  - cargo clippy"
          echo "  - cargo test"
          echo "  - cargo build --release"
          echo "  - crate dependency isolation"
          echo "  - feature-gated backends (rocksdb, redis)"
          echo "  - tier-1 integration suite"
          echo "  - docker image build"