opencrabs 0.5.1

name: CI

# Trigger model (single-maintainer OSS, GitHub Flow):
#   - pull_request: full gate on contributions — required to review
#     external PRs safely.
#   - push to main: catch direct pushes and keep main provably green.
#     Docs-only commits are skipped via paths-ignore so they don't burn
#     the matrix; rapid pushes cancel older runs via `concurrency`. The
#     heavy cross-platform BUILD job is gated off routine main pushes
#     (see its `if:`) so a normal commit only pays for lint + Linux test
#     + audit (~5-8 min, cached, cancellable). This replaces the old
#     opt-out `[skip ci]`-on-every-commit toil with sensible defaults.
#   - workflow_dispatch: run the build matrix on demand (e.g. to verify
#     macOS before cutting a release tag; Windows is validated by release.yml).
# CI deliberately does NOT run on tags — the release workflow owns tags
# and trusts the commit already passed CI on its way to main. That also
# kills the old double-build where ci.yml and release.yml both compiled
# Windows/macOS on the same tag event.
on:
  pull_request:
  push:
    branches: [main]
    paths-ignore:
      - '**.md'
      - 'LICENSE*'
      - '.gitignore'
      - 'docs/**'
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  CARGO_INCREMENTAL: 0

jobs:
  # ── Stage 1: Lint (fast gate — fails early before burning compute) ────────
  # Pattern lifted from ZeroClaw: run fmt + clippy first. If either fails,
  # every downstream job is skipped. Avoids burning ~25 min on the
  # cross-platform build/test matrix for a PR that won't lint anyway.
  lint:
    name: Lint
    runs-on: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) && 'ubuntu-latest' || 'self-hosted' }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v5

      - name: Refuse to administer the host's rustup
        # dtolnay/rust-toolchain manages rustup on whatever machine it runs
        # on, and defaults CARGO_HOME to ~/.cargo when it is unset. On a
        # self-hosted runner that is somebody's workstation, so CI installs
        # toolchains into their installation: it removed the rustup binary
        # itself once, leaving every shim in ~/.cargo/bin dangling and no
        # working cargo for the machine owner (#1162).
        #
        # The runner sets CARGO_HOME and RUSTUP_HOME to its own directories.
        # This fails the job if that ever stops being true, rather than
        # letting the damage be discovered at the owner's next build.
        if: runner.environment == 'self-hosted'
        shell: bash
        run: |
          for var in CARGO_HOME RUSTUP_HOME; do
            value="${!var}"
            if [ -z "$value" ]; then
              echo "::error::$var is unset, so rustup would manage the host's own installation. Set it in the runner service environment."
              exit 1
            fi
            case "$value" in
              "$HOME/.cargo"|"$HOME/.rustup")
                echo "::error::$var points at the host's own installation ($value). CI must not administer it."
                exit 1
                ;;
            esac
            echo "$var=$value"
          done

      - name: Install Rust (from rust-toolchain.toml)
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
          components: rustfmt, clippy

      - uses: swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Install ALSA dev (for local-stt feature)
        # Linux-only: ALSA does not exist on macOS, where cpal uses CoreAudio.
        # Left ungated, this ran `apt-get` on the self-hosted Mac and failed on
        # sudo before any Rust work started.
        if: runner.os == 'Linux'
        run: sudo apt-get update -qq && sudo apt-get install -y libasound2-dev

      - name: Check formatting
        # Soft-fail: legacy un-formatted code blocks shouldn't block PRs
        # yet. Promote to hard-fail once a fmt sweep lands on main.
        continue-on-error: true
        run: cargo fmt --all -- --check

      - name: Clippy
        run: cargo clippy --locked --lib --bins --tests --all-features -- -D warnings

  # ── Stage 2: Build verification (parallel, gated on lint + audit) ────────
  # Cross-platform BUILD on macOS confirms target compatibility without
  # running tests there (tests run on Linux only — see `test` below).
  # Windows is not built here (#627) — it chronically hit the 40m cap and
  # release.yml already validates it at tag time. Most of our test surface
  # is platform-independent; if a macOS-specific test ever regresses we can
  # promote it via the matrix.
  build:
    name: Build (${{ matrix.target }})
    needs: [lint, audit]
    # Cross-platform build verification. Runs where it pays off — on PRs
    # (gate contributions) and on-demand (workflow_dispatch, e.g. before a
    # release tag) — but NOT on every routine push to main. Direct main
    # pushes still get lint + Linux test + audit.
    #
    # Windows is intentionally NOT built here (#627): it builds --all-features
    # with rust-cache skipped (always cold), so it chronically hit the 40m cap
    # and blocked otherwise-green PRs. It is build-only (no tests) and
    # release.yml's build-release matrix already builds + validates Windows
    # before any tag is published, so a platform regression cannot reach a
    # release unnoticed.
    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
    runs-on: ${{ matrix.os }}
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: self-hosted
            target: aarch64-apple-darwin
            features: --all-features
    steps:
      - uses: actions/checkout@v5

      - name: Refuse to administer the host's rustup
        # dtolnay/rust-toolchain manages rustup on whatever machine it runs
        # on, and defaults CARGO_HOME to ~/.cargo when it is unset. On a
        # self-hosted runner that is somebody's workstation, so CI installs
        # toolchains into their installation: it removed the rustup binary
        # itself once, leaving every shim in ~/.cargo/bin dangling and no
        # working cargo for the machine owner (#1162).
        #
        # The runner sets CARGO_HOME and RUSTUP_HOME to its own directories.
        # This fails the job if that ever stops being true, rather than
        # letting the damage be discovered at the owner's next build.
        if: runner.environment == 'self-hosted'
        shell: bash
        run: |
          for var in CARGO_HOME RUSTUP_HOME; do
            value="${!var}"
            if [ -z "$value" ]; then
              echo "::error::$var is unset, so rustup would manage the host's own installation. Set it in the runner service environment."
              exit 1
            fi
            case "$value" in
              "$HOME/.cargo"|"$HOME/.rustup")
                echo "::error::$var points at the host's own installation ($value). CI must not administer it."
                exit 1
                ;;
            esac
            echo "$var=$value"
          done

      - name: Install Rust (from rust-toolchain.toml)
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
          targets: ${{ matrix.target }}

      - uses: swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Build (macOS)
        env:
          CFLAGS: -march=armv8-a+crypto
          CXXFLAGS: -march=armv8-a+crypto
        run: cargo build --locked --profile ci --target ${{ matrix.target }} ${{ matrix.features }}

  # ── Stage 3: Test on Linux (gated on lint + audit, parallel with build) ──
  # Tests run on Linux only — macOS gets build verification via
  # the `build` job above. ZeroClaw uses the same split because the
  # cross-platform matrix triples wall-clock for little extra coverage
  # on this codebase (most tests are platform-independent).
  #
  # Stays on `cargo test` for now: a few timing-sensitive tests
  # (rate_limiter pacing) rely on cargo test's threadpool semantics
  # and fail under nextest's process-per-test isolation. nextest
  # migration is a follow-up once those tests are made portable.
  # Runs on the Mac only. Linux is covered where it costs nothing: the
  # release matrix builds both Linux targets at tag time, and the suite runs
  # locally on demand. Paying for a hosted Linux run on every push buys very
  # little, since almost the entire suite is platform independent.
  test:
    name: Test
    needs: [lint, audit]
    runs-on: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) && 'ubuntu-latest' || 'self-hosted' }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v5

      - name: Refuse to administer the host's rustup
        # dtolnay/rust-toolchain manages rustup on whatever machine it runs
        # on, and defaults CARGO_HOME to ~/.cargo when it is unset. On a
        # self-hosted runner that is somebody's workstation, so CI installs
        # toolchains into their installation: it removed the rustup binary
        # itself once, leaving every shim in ~/.cargo/bin dangling and no
        # working cargo for the machine owner (#1162).
        #
        # The runner sets CARGO_HOME and RUSTUP_HOME to its own directories.
        # This fails the job if that ever stops being true, rather than
        # letting the damage be discovered at the owner's next build.
        if: runner.environment == 'self-hosted'
        shell: bash
        run: |
          for var in CARGO_HOME RUSTUP_HOME; do
            value="${!var}"
            if [ -z "$value" ]; then
              echo "::error::$var is unset, so rustup would manage the host's own installation. Set it in the runner service environment."
              exit 1
            fi
            case "$value" in
              "$HOME/.cargo"|"$HOME/.rustup")
                echo "::error::$var points at the host's own installation ($value). CI must not administer it."
                exit 1
                ;;
            esac
            echo "$var=$value"
          done

      - name: Install Rust (from rust-toolchain.toml)
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable

      - uses: swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Install mold + ALSA dev (Linux)
        # Linux-only toolchain extras; macOS uses the Xcode linker.
        if: runner.os == 'Linux'
        run: sudo apt-get update -qq && sudo apt-get install -y mold clang libasound2-dev

      - name: Run tests
        env:
          CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER: clang
          CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS: "-C link-arg=-fuse-ld=mold"
        run: cargo test --locked --profile ci --all-features --verbose

  # ── Stage 1b: Security (fast gate — runs alongside lint, before build/test)
  # cargo-audit only scans Cargo.lock; it needs no compile, so it runs in
  # PARALLEL with lint as a second fast gate rather than after it. build/test/
  # coverage all `needs: [lint, audit]`, so a fresh advisory (this fails in
  # ~4s) skips the ~22-min Linux test and the cross-platform build matrix
  # instead of racing them. Lockfile-only fix → no recompile to re-gate.

  audit:
    name: Cargo Audit
    runs-on: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) && 'ubuntu-latest' || 'self-hosted' }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v5

      - name: Refuse to administer the host's rustup
        # dtolnay/rust-toolchain manages rustup on whatever machine it runs
        # on, and defaults CARGO_HOME to ~/.cargo when it is unset. On a
        # self-hosted runner that is somebody's workstation, so CI installs
        # toolchains into their installation: it removed the rustup binary
        # itself once, leaving every shim in ~/.cargo/bin dangling and no
        # working cargo for the machine owner (#1162).
        #
        # The runner sets CARGO_HOME and RUSTUP_HOME to its own directories.
        # This fails the job if that ever stops being true, rather than
        # letting the damage be discovered at the owner's next build.
        if: runner.environment == 'self-hosted'
        shell: bash
        run: |
          for var in CARGO_HOME RUSTUP_HOME; do
            value="${!var}"
            if [ -z "$value" ]; then
              echo "::error::$var is unset, so rustup would manage the host's own installation. Set it in the runner service environment."
              exit 1
            fi
            case "$value" in
              "$HOME/.cargo"|"$HOME/.rustup")
                echo "::error::$var points at the host's own installation ($value). CI must not administer it."
                exit 1
                ;;
            esac
            echo "$var=$value"
          done

      - name: Install Rust (from rust-toolchain.toml)
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable

      - name: Install cargo-audit
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit

      - name: Run cargo audit
        # Ignored advisories. Every one is a TRANSITIVE dependency: none is
        # declared in our Cargo.toml, so the lever is always an upstream crate,
        # never a version bump we can make here. Re-checked 2026-09-04 (#1344).
        #
        # Six of the nine trace to ONE dependency, `rwhisper` (the local-stt
        # feature), whose tree is still on reqwest 0.11 / hyper 0.14 / candle
        # 0.8. rwhisper 0.4.1 is the latest published release, so there is
        # nothing to move to. If local-stt is ever dropped or rwhisper updates,
        # most of this list goes with it.
        #
        #   RUSTSEC-2026-0258  h2 — VULNERABILITY (low, DoS): unbounded empty
        #                      DATA frames. Our direct h2 is patched (0.4.17);
        #                      the hit is h2 0.3.27 via rwhisper -> kalosm-common
        #                      -> reqwest 0.11 -> hyper 0.14. The 0.3 line has no
        #                      fixed release. We are an HTTP *client*, so the
        #                      described flood requires a hostile endpoint we are
        #                      already talking to. Drop when rwhisper moves to a
        #                      reqwest on hyper 1.x.
        #   RUSTSEC-2026-0253  lru — unsound pop() panic safety   \
        #   RUSTSEC-2026-0002  lru — unsound IterMut               | via rwhisper
        #   RUSTSEC-2025-0134  rustls-pemfile — unmaintained       | ->kalosm
        #   RUSTSEC-2025-0119  number_prefix — unmaintained        | (indicatif
        #   RUSTSEC-2024-0436  paste — unmaintained (candle/gemm)  /  -> hf-hub)
        #
        #   RUSTSEC-2025-0141  bincode — unmaintained. Two paths, both needed:
        #                      syntect's `dump-load` (how we load the bundled
        #                      syntax/theme dumps) and printpdf -> azul-layout
        #                      -> hyphenation.
        #   RUSTSEC-2026-0192  ttf-parser — unmaintained, via pdf-extract -> lopdf.
        #                      pdf-extract 0.12.0 is the latest release.
        #   RUSTSEC-2026-0173  proc-macro-error2 — unmaintained, via
        #                      teloxide -> aquamarine. teloxide 0.17.0 is latest.
        #
        # Cleared 2026-09-04, do not re-add without evidence:
        #   RUSTSEC-2024-0320  yaml-rust — gone. syntect no longer pulls it: we
        #                      only ever load the bundled binary dumps, so the
        #                      YAML syntax loader was dead weight and the feature
        #                      set was narrowed off `default-fancy`.
        #   RUSTSEC-2026-0187  lopdf — gone. printpdf 0.12.7 moved off lopdf 0.39;
        #                      the ignore had been stale.
        #   chacha20 (yanked)  gone. `cargo update` moved it 0.10.1 -> 0.10.2.
        #                      It never had an ignore: audit does not fail on
        #                      yanked, so it had been passing silently.
        #
        # The nine below are each at their upstream's LATEST published release,
        # verified against crates.io on 2026-09-04, so there is no version to
        # move to from here. A routine `cargo update` will not shift them; only
        # an upstream release or dropping the dependency will.
        run: cargo audit --ignore RUSTSEC-2024-0436 --ignore RUSTSEC-2025-0119 --ignore RUSTSEC-2025-0134 --ignore RUSTSEC-2025-0141 --ignore RUSTSEC-2026-0002 --ignore RUSTSEC-2026-0173 --ignore RUSTSEC-2026-0192 --ignore RUSTSEC-2026-0253 --ignore RUSTSEC-2026-0258

  # ── Stage 5: Coverage (on-demand only) ───────────────────────────────────
  # Tarpaulin is the slowest job (~12 min). Running it on every main push
  # would re-add the cost we just trimmed, so it's on-demand: trigger the
  # CI workflow manually (workflow_dispatch) when you want a fresh coverage
  # report. PRs and pushes still get full test coverage via the `test` job;
  # this job only publishes the percentage report.
  coverage:
    name: Code Coverage
    needs: [lint, audit]
    if: github.event_name == 'workflow_dispatch'
    # On the Mac, where tarpaulin finishes the whole suite in ~15 min. A
    # hosted runner needed well over 30 for the same work and cost minutes
    # for it, which is not a trade worth making for a metric job.
    runs-on: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) && 'ubuntu-latest' || 'self-hosted' }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v5

      - uses: swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Refuse to administer the host's rustup
        # dtolnay/rust-toolchain manages rustup on whatever machine it runs
        # on, and defaults CARGO_HOME to ~/.cargo when it is unset. On a
        # self-hosted runner that is somebody's workstation, so CI installs
        # toolchains into their installation: it removed the rustup binary
        # itself once, leaving every shim in ~/.cargo/bin dangling and no
        # working cargo for the machine owner (#1162).
        #
        # The runner sets CARGO_HOME and RUSTUP_HOME to its own directories.
        # This fails the job if that ever stops being true, rather than
        # letting the damage be discovered at the owner's next build.
        if: runner.environment == 'self-hosted'
        shell: bash
        run: |
          for var in CARGO_HOME RUSTUP_HOME; do
            value="${!var}"
            if [ -z "$value" ]; then
              echo "::error::$var is unset, so rustup would manage the host's own installation. Set it in the runner service environment."
              exit 1
            fi
            case "$value" in
              "$HOME/.cargo"|"$HOME/.rustup")
                echo "::error::$var points at the host's own installation ($value). CI must not administer it."
                exit 1
                ;;
            esac
            echo "$var=$value"
          done

      - name: Install Rust (from rust-toolchain.toml)
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable

      - name: Install ALSA dev
        if: runner.os == 'Linux'
        run: sudo apt-get update -qq && sudo apt-get install -y libasound2-dev

      - name: Install tarpaulin
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-tarpaulin

      - name: Generate coverage
        run: cargo tarpaulin --locked --out Xml --no-default-features --features "telegram,whatsapp,discord,slack,trello"
        # Note: local-stt excluded — tarpaulin uses rust-lld which can't handle
        # duplicate ggml symbols from whisper-rs-sys + llama-cpp-sys-2.
        # local-tts added when feature lands on main.

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          files: ./cobertura.xml

  # ── Required gate ────────────────────────────────────────────────────────
  # Single status check for branch protection. Internal job structure
  # can change without touching branch protection settings.
  # Coverage is intentionally excluded — it's main-only.
  ci-gate:
    name: CI Required Gate
    if: always()
    needs: [lint, build, test, audit]
    runs-on: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) && 'ubuntu-latest' || 'self-hosted' }}
    steps:
      - name: Check results
        run: |
          if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            echo "::error::One or more CI jobs failed or were cancelled"
            exit 1
          fi