millwright 2.2.1

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

# One in-flight run per ref; a new push cancels the previous.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  # Every job builds against the committed Cargo.lock. `--locked` turns a stale
  # or drifted lockfile into a hard error — the reproducibility guarantee that
  # pairs with the exact-version engine pins in Cargo.toml.
  CARGO_NET_RETRY: "3"
  RUSTFLAGS: "-D warnings"

jobs:
  consistency:
    name: version & links
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.x"
      - name: verify every public version marker
        run: python scripts/sync-version.py --check
      - name: check local and external HTML links
        uses: lycheeverse/lychee-action@v2
        with:
          args: >-
            --no-progress
            --accept 200,204,206,429
            --retry-wait-time 2
            index.html guide.html docs/*.html README.md CONTRIBUTING.md RELEASING.md
          fail: true

  fmt:
    name: rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all --check

  clippy:
    name: clippy (${{ matrix.features }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - features: "--no-default-features"
          - features: "" # default features
          - features: "--features full"
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --locked --all-targets ${{ matrix.features }}

  docs:
    name: doc
    runs-on: ubuntu-latest
    env:
      RUSTDOCFLAGS: "-D warnings"
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      # `full` is every Rust-facing feature (python is a cdylib, doc'd separately
      # by maturin/pyo3), so this exercises the whole documented surface.
      - run: cargo doc --locked --no-deps --features full

  test:
    name: test (${{ matrix.name }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          # The spine, minimal: no backend at all, then the smartcore spine.
          - { name: "core-only", features: "--no-default-features" }
          - { name: "spine", features: "--no-default-features --features smartcore-backend" }
          # The default install.
          - { name: "default", features: "" }
          # Each feature in isolation. Dependencies declared by that feature are
          # enabled transitively; unrelated defaults cannot hide a bad edge.
          - { name: "eda", features: "--no-default-features --features eda" }
          - { name: "calibration", features: "--no-default-features --features calibration" }
          - { name: "anomaly", features: "--no-default-features --features anomaly" }
          - { name: "linfa", features: "--no-default-features --features linfa-backend" }
          - { name: "hpo", features: "--no-default-features --features hpo" }
          - { name: "diagnostics", features: "--no-default-features --features diagnostics" }
          - { name: "explain", features: "--no-default-features --features explain" }
          - { name: "viz", features: "--no-default-features --features viz" }
          - { name: "onnx", features: "--no-default-features --features onnx" }
          - { name: "registry", features: "--no-default-features --features registry" }
          - { name: "monitor", features: "--no-default-features --features monitor" }
          - { name: "serve", features: "--no-default-features --features serve" }
          - { name: "timeseries", features: "--no-default-features --features timeseries" }
          - { name: "incremental", features: "--no-default-features --features incremental" }
          - { name: "automl", features: "--no-default-features --features automl" }
          # Everything at once — the superset build, including both ndarray worlds.
          - { name: "full", features: "--features full" }
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.name }}
      - run: cargo test --locked ${{ matrix.features }}

  # Cross-platform confidence on the default install, without multiplying the
  # whole feature matrix across three operating systems.
  os:
    name: test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --locked

  msrv:
    name: minimum Rust 1.95
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.95"
      - uses: Swatinem/rust-cache@v2
      - run: cargo check --locked --all-targets --features full

  supply-chain:
    name: advisories
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - run: cargo install cargo-audit --locked
      - run: cargo audit

  dependency-policy:
    name: dependency policy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: taiki-e/install-action@cargo-deny
      - run: cargo deny check

  coverage:
    name: coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview
      - uses: taiki-e/install-action@cargo-llvm-cov
      - uses: Swatinem/rust-cache@v2
      - name: measure full-feature Rust coverage
        run: cargo llvm-cov --locked --features full --workspace --lcov --output-path lcov.info
      - name: enforce coverage floor
        run: >-
          cargo llvm-cov report --summary-only
          --fail-under-lines 82
          --fail-under-functions 75
          --fail-under-regions 84
      - uses: actions/upload-artifact@v7
        with:
          name: rust-coverage
          path: lcov.info
          if-no-files-found: error

  branch-coverage:
    name: branch coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      # LLVM branch instrumentation remains a nightly-only cargo-llvm-cov mode.
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: llvm-tools-preview
      - uses: taiki-e/install-action@cargo-llvm-cov
      - uses: Swatinem/rust-cache@v2
        with:
          key: branch-coverage
      - name: measure decision coverage
        run: >-
          cargo +nightly llvm-cov --locked --features full --workspace --branch
          --cobertura --output-path branch-coverage.xml
      - uses: actions/upload-artifact@v7
        with:
          name: rust-branch-coverage
          path: branch-coverage.xml
          if-no-files-found: error

  semver:
    name: public API compatibility
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - run: cargo install cargo-semver-checks --locked
      - run: cargo semver-checks check-release

  # Compile and *run* the examples (the `test` jobs only build the library and
  # its tests), plus a compile-check of the benchmarks. The dedicated `msrv`
  # job above proves the declared Rust 1.95 floor independently.
  examples:
    name: examples & benches
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: run every example
        run: |
          for ex in spine explore trust workflow backends insight portability operations specialized automl; do
            echo "::group::$ex"
            cargo run --locked --features full --example "$ex"
            echo "::endgroup::"
          done
      - name: compile benchmarks
        run: cargo bench --locked --features full --no-run

  package:
    name: package (publish dry-run)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      # No rust-cache here: `cargo publish` builds a copy under target/package,
      # which the cache action's post-step chokes on.
      # Prove the crate packages and builds from its packaged form as it would on
      # crates.io — catches missing files, bad metadata, and path/dev-dep leaks.
      - run: cargo publish --dry-run --locked

  python:
    name: python wheel
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: actions/setup-python@v7
        with:
          python-version: "3.9"
      - uses: Swatinem/rust-cache@v2
      # The `python` feature can't be linked by `cargo test` (pyo3's
      # extension-module defers libpython), so it is built the way it ships:
      # as an abi3 wheel via maturin, then smoke-imported.
      - run: pip install maturin pytest
      - run: maturin build --locked --release
      - run: pip install --find-links target/wheels millwright
      - run: pytest -q tests/python