mermaid-cli 0.17.0

name: Rust CI

on:
  push:
    branches: [ "main" ]
  # No base-branch filter on pull_request: stacked PRs (base = another feature
  # branch) must get the same gate as PRs to main — the Windows jobs
  # especially, since a local Linux gate can't catch cfg(windows) breakage.
  pull_request:

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  # Format checking
  fmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
        with:
          toolchain: stable
          components: rustfmt
      - name: Check formatting
        run: cargo fmt -- --check

  # Linting with Clippy — `-D warnings` makes lint regressions fail CI.
  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
        with:
          toolchain: stable
          components: clippy
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Run clippy
        # `--workspace` so the `mermaid-runtime` crate (safety classifier,
        # approvals store) is linted too — a bare `cargo clippy` only covers the
        # root package and silently skipped it.
        run: cargo clippy --workspace --all-targets -- -D warnings

  # Build and test on multiple Rust versions and OS
  test:
    name: Test Suite
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        rust: [stable, beta]
        include:
          # Test nightly only on Linux to save CI time
          - os: ubuntu-latest
            rust: nightly
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
        with:
          toolchain: ${{ matrix.rust }}

      # Cache dependencies for faster builds
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          # Cache key includes OS and Rust version
          key: ${{ matrix.os }}-${{ matrix.rust }}

      - name: Install cargo-nextest
        uses: taiki-e/install-action@v2
        with:
          tool: nextest

      - name: Build
        run: cargo build --workspace --verbose

      - name: Run tests
        # nextest runs the same test binaries as `cargo test`, but applies the
        # `.config/nextest.toml` retry policy that auto-heals the documented
        # Windows cancellation flake. `--workspace` covers the mermaid-runtime
        # crate (safety classifier, approvals store). No doctests exist, so
        # nextest skipping them loses nothing.
        run: cargo nextest run --workspace

      # Only check documentation on stable Linux
      - name: Check documentation
        if: matrix.rust == 'stable' && matrix.os == 'ubuntu-latest'
        run: cargo doc --no-deps --document-private-items

  # Security audit
  security:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  # Dependency-free source guards: no emoji in user-facing output, and the pure
  # `src/domain` MVU core stays free of I/O + the wall clock.
  guards:
    name: Source Guards
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: No emoji in source
        run: python3 .github/scripts/check_no_emoji.py
      - name: domain/ purity (no I/O, no wall clock)
        run: python3 .github/scripts/check_domain_purity.py

  # Heavier integration coverage that CI's default suite skips: the daemon
  # `#[ignore]`d tests (spawn a real mermaidd) and the deterministic, model-free
  # `mermaid self-test`. Linux-only — enough to catch daemon/self-test breakage.
  integration:
    name: Daemon + Self-Test (Linux)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Build binaries
        run: cargo build --workspace
      - name: Daemon integration tests (ignored)
        run: cargo test --test daemon_integration -- --ignored
      - name: Sandbox network kill-switch (ignored, Linux)
        run: cargo test --test sandbox_network -- --ignored
      - name: Sandbox filesystem confinement (ignored, Linux)
        run: cargo test --test sandbox_fs -- --ignored
      - name: Self-test (deterministic, model-free)
        run: cargo run --bin mermaid -- self-test --format json

  # OS-sandbox enforcement on the non-Linux platforms with a real backend
  # (the Linux `integration` job above already runs these tests). macOS-only
  # for now; the Windows AppContainer port adds windows-latest. The
  # `#[ignore]`d tests include the Seatbelt profile-compile canary, so an SBPL
  # grammar change in a new macOS release fails this job loudly.
  sandbox-integration:
    name: OS Sandbox
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          key: sandbox-${{ matrix.os }}
      - name: Build binaries
        run: cargo build --workspace
      - name: Sandbox network denial (ignored)
        run: cargo test --test sandbox_network -- --ignored
      - name: Sandbox filesystem confinement (ignored)
        run: cargo test --test sandbox_fs -- --ignored
      - name: Self-test (real sandbox availability probes)
        run: cargo run --bin mermaid -- self-test --format json