mpp 0.12.0

Rust SDK for the Machine Payments Protocol (MPP)
Documentation
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_call:
    inputs:
      ref:
        type: string
        required: false

env:
  CARGO_TERM_COLOR: always

permissions: {}

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.ref || '' }}
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        with:
          toolchain: stable
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - run: cargo update -p native-tls
      - run: cargo fmt --all -- --check
      - run: cargo clippy --workspace --all-targets --all-features -- -D warnings
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
      - name: Pin pnpm for Tempo Lints
        run: corepack prepare pnpm@10.28.1 --activate
      - name: Run Tempo Lints
        uses: tempoxyz/lints@f9268eb2b828dbacf9f4b5d4bf6ad4541826567f # main
        with:
          language: rust
          path: "."
          post-comment: false
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Install ast-grep
        uses: jaxxstorm/action-install-gh-release@25e24d2d23ae098373794ef1d6faecb48ee52da8 # v3.0.0
        with:
          repo: ast-grep/ast-grep
          tag: "0.45.0"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Run ast-grep lint
        run: sg scan -c sgconfig.yml src/
      - name: Run ast-grep tests
        run: sg test -c sgconfig.yml

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.ref || '' }}
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - run: cargo update -p native-tls
      - uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
        with:
          tool: cargo-hack
      - name: Tests
        run: cargo test --features tempo,stripe,ws,server,client,axum,middleware,tower,utils,integration-stripe,integration-ws
        env:
          STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
      - name: Check Ring transport dependency graph
        run: |
          tree=$(cargo tree -p alloy-transport-mpp --no-default-features --features ring --edges normal --prefix none)
          if grep -q '^aws-lc-sys ' <<< "$tree"; then
            echo "Ring-only transport unexpectedly includes aws-lc-sys"
            exit 1
          fi
      - run: cargo hack check --each-feature --no-dev-deps --skip integration,integration-stripe,integration-ws
      - name: Check examples
        run: cargo check --workspace --exclude mpp

  integration:
    name: Integration Test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.ref || '' }}
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - run: cargo update -p native-tls

      - name: Start Tempo localnet
        run: docker compose up -d --wait

      - name: Run integration tests
        run: cargo test --features integration --test integration_charge -- --nocapture

      - name: Stop Tempo localnet
        if: always()
        run: docker compose down

  deny:
    uses: tempoxyz/ci/.github/workflows/deny.yml@09f481293feb726bcd5c94853063b224a9b2ff24 # main
    permissions:
      contents: read

  ci-gate:
    name: CI Gate
    if: always()
    needs: [lint, test, integration, deny]
    runs-on: ubuntu-latest
    steps:
      - run: |
          if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            echo "One or more required jobs failed or were cancelled"
            exit 1
          fi