proc-cli 2.0.0

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  test:
    name: Test
    timeout-minutes: 30
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Run tests
        run: cargo test --verbose

      - name: Run clippy
        run: cargo clippy -- -D warnings

  format:
    name: Format
    timeout-minutes: 5
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: Check formatting
        run: cargo fmt -- --check

  build:
    name: Build
    timeout-minutes: 10
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Same Linux targets as release.yml, so every push builds what a release ships
          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            artifact: proc-linux-x86_64
          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            artifact: proc-linux-aarch64
          - os: macos-latest
            target: x86_64-apple-darwin
            artifact: proc-darwin-x86_64
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact: proc-darwin-aarch64
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: proc-windows-x86_64.exe

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install cross-compilation tools (Linux ARM64)
        if: matrix.target == 'aarch64-unknown-linux-musl'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu
          echo '[target.aarch64-unknown-linux-musl]' >> ~/.cargo/config.toml
          echo 'linker = "aarch64-linux-gnu-gcc"' >> ~/.cargo/config.toml

      - name: Build release
        run: cargo build --release --target ${{ matrix.target }}

      - name: Rename binary (Unix)
        if: runner.os != 'Windows'
        run: cp target/${{ matrix.target }}/release/proc ${{ matrix.artifact }}

      - name: Rename binary (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: Copy-Item "target/${{ matrix.target }}/release/proc.exe" -Destination "${{ matrix.artifact }}"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: ${{ matrix.artifact }}
          if-no-files-found: error

  security-audit:
    name: Security Audit
    timeout-minutes: 10
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-audit
        run: cargo install cargo-audit

      - name: Run security audit
        run: cargo audit

  coverage:
    name: Coverage (${{ matrix.os }})
    timeout-minutes: 45
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-llvm-cov@0.9.1

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-coverage-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-coverage-

      # Plain `cargo test` under cargo-llvm-cov's environment, not `cargo llvm-cov`
      # itself: that runs `cargo test --tests`, which doesn't build the listener
      # example the flag matrix runs
      - name: Measure line coverage
        shell: bash
        run: |
          # eval, not `source <(...)`: macOS runs bash 3.2, where that reads nothing
          eval "$(cargo llvm-cov show-env --sh)"
          cargo llvm-cov clean --workspace
          cargo test -- --test-threads=4
          cargo llvm-cov report --lcov --output-path lcov-${{ matrix.os }}.info

      - name: Upload lcov
        uses: actions/upload-artifact@v4
        with:
          name: lcov-${{ matrix.os }}
          path: lcov-${{ matrix.os }}.info
          if-no-files-found: error

  coverage-gate:
    name: Coverage gate
    timeout-minutes: 5
    runs-on: ubuntu-latest
    needs: coverage
    if: ${{ !cancelled() }}
    steps:
      - uses: actions/checkout@v4

      - name: Download lcov files
        uses: actions/download-artifact@v4
        with:
          pattern: lcov-*
          path: lcov
          merge-multiple: true

      - name: Self-test the gate
        run: python3 -m unittest scripts/test_coverage_gate.py

      # --require: all three OS files must be present, so a failed OS job fails
      # the gate instead of passing as a partial merge
      - name: Enforce coverage
        run: >
          python3 scripts/coverage_gate.py lcov/*.info
          --exclusions coverage-exclusions.txt --enforce
          --require ubuntu-latest --require macos-latest --require windows-latest