rust-web-server 18.10.0

name: CI

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    # Weekly, so a newly published RustSec/npm advisory turns the badge red
    # even when nothing was pushed.
    - cron: "0 6 * * 1"

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    name: test (${{ matrix.name }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: default (http3)
            args: ""
          - name: http1 only
            args: --no-default-features --features http1
          - name: tls + auth + sso + serde
            args: --features "sso sso-server sso-saml auth-asymmetric http-client acme serde macros openapi tower gateway-api"
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.name }}
      - run: cargo test ${{ matrix.args }}

  msrv:
    name: msrv (1.99, all features)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.99
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --all-features

  # End-to-end checks against real external implementations — see ci/e2e/.
  e2e:
    name: e2e (${{ matrix.check }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        check: [acme-pebble, acme-dns01, acme-dns-api, acme-shared, acme-on-demand, h2spec, slow-clients, config-reload, access-log, proxy-policies, mcp-gateway, llm-proxy, admin, admin-ui, wasm-plugins, native-histograms, otlp, grpc, proxy-protocol, realtime, openapi, tower, starters]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: e2e
      - run: cargo build --bin rws --features "acme auth mimalloc"
      - name: ACME against Pebble (Let's Encrypt's test CA)
        if: matrix.check == 'acme-pebble'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p "$RUNNER_TEMP/pebble/src"
          gh release download v2.10.1 --repo letsencrypt/pebble --pattern 'pebble-linux-amd64.tar.gz' --dir "$RUNNER_TEMP/pebble"
          tar xzf "$RUNNER_TEMP/pebble/pebble-linux-amd64.tar.gz" -C "$RUNNER_TEMP/pebble"
          gh api repos/letsencrypt/pebble/tarball/v2.10.1 | tar xz -C "$RUNNER_TEMP/pebble/src" --strip-components=1
          # The release archive ships the binary without the execute bit.
          pebble_bin="$RUNNER_TEMP/pebble/pebble-linux-amd64/linux/amd64/pebble"
          chmod +x "$pebble_bin"
          ci/e2e/acme_pebble.sh target/debug/rws "$pebble_bin" "$RUNNER_TEMP/pebble/src"
      - name: ACME DNS-01 against Pebble and BIND (RFC 2136 + TSIG, wildcard, exec hook)
        if: matrix.check == 'acme-dns01'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q bind9 bind9-dnsutils
          mkdir -p "$RUNNER_TEMP/pebble/src"
          gh release download v2.10.1 --repo letsencrypt/pebble --pattern 'pebble-linux-amd64.tar.gz' --dir "$RUNNER_TEMP/pebble"
          tar xzf "$RUNNER_TEMP/pebble/pebble-linux-amd64.tar.gz" -C "$RUNNER_TEMP/pebble"
          gh api repos/letsencrypt/pebble/tarball/v2.10.1 | tar xz -C "$RUNNER_TEMP/pebble/src" --strip-components=1
          pebble_bin="$RUNNER_TEMP/pebble/pebble-linux-amd64/linux/amd64/pebble"
          chmod +x "$pebble_bin"
          ci/e2e/acme_dns01.sh target/debug/rws "$pebble_bin" "$RUNNER_TEMP/pebble/src" "$(command -v named)" "$(command -v nsupdate)"
      - name: ACME DNS-01 through Cloudflare and Route 53 APIs (mocked into BIND), and DNS-PERSIST-01
        if: matrix.check == 'acme-dns-api'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q bind9 bind9-dnsutils
          mkdir -p "$RUNNER_TEMP/pebble/src"
          gh release download v2.10.1 --repo letsencrypt/pebble --pattern 'pebble-linux-amd64.tar.gz' --dir "$RUNNER_TEMP/pebble"
          tar xzf "$RUNNER_TEMP/pebble/pebble-linux-amd64.tar.gz" -C "$RUNNER_TEMP/pebble"
          gh api repos/letsencrypt/pebble/tarball/v2.10.1 | tar xz -C "$RUNNER_TEMP/pebble/src" --strip-components=1
          pebble_bin="$RUNNER_TEMP/pebble/pebble-linux-amd64/linux/amd64/pebble"
          chmod +x "$pebble_bin"
          ci/e2e/acme_dns_api.sh target/debug/rws "$pebble_bin" "$RUNNER_TEMP/pebble/src" "$(command -v named)" "$(command -v nsupdate)"
      - name: ACME with two replicas sharing certificates through Redis
        if: matrix.check == 'acme-shared'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q redis-server
          mkdir -p "$RUNNER_TEMP/pebble/src"
          gh release download v2.10.1 --repo letsencrypt/pebble --pattern 'pebble-linux-amd64.tar.gz' --dir "$RUNNER_TEMP/pebble"
          tar xzf "$RUNNER_TEMP/pebble/pebble-linux-amd64.tar.gz" -C "$RUNNER_TEMP/pebble"
          gh api repos/letsencrypt/pebble/tarball/v2.10.1 | tar xz -C "$RUNNER_TEMP/pebble/src" --strip-components=1
          pebble_bin="$RUNNER_TEMP/pebble/pebble-linux-amd64/linux/amd64/pebble"
          chmod +x "$pebble_bin"
          ci/e2e/acme_shared.sh target/debug/rws "$pebble_bin" "$RUNNER_TEMP/pebble/src" "$(command -v redis-server)"
      - name: On-demand TLS against Pebble and BIND
        if: matrix.check == 'acme-on-demand'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q bind9
          mkdir -p "$RUNNER_TEMP/pebble/src"
          gh release download v2.10.1 --repo letsencrypt/pebble --pattern 'pebble-linux-amd64.tar.gz' --dir "$RUNNER_TEMP/pebble"
          tar xzf "$RUNNER_TEMP/pebble/pebble-linux-amd64.tar.gz" -C "$RUNNER_TEMP/pebble"
          gh api repos/letsencrypt/pebble/tarball/v2.10.1 | tar xz -C "$RUNNER_TEMP/pebble/src" --strip-components=1
          pebble_bin="$RUNNER_TEMP/pebble/pebble-linux-amd64/linux/amd64/pebble"
          chmod +x "$pebble_bin"
          ci/e2e/acme_on_demand.sh target/debug/rws "$pebble_bin" "$RUNNER_TEMP/pebble/src" "$(command -v named)"
      - name: HTTP/2 conformance (h2spec)
        if: matrix.check == 'h2spec'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release download v2.6.0 --repo summerwind/h2spec --pattern 'h2spec_linux_amd64.tar.gz' --dir "$RUNNER_TEMP"
          tar xzf "$RUNNER_TEMP/h2spec_linux_amd64.tar.gz" -C "$RUNNER_TEMP"
          ci/e2e/h2spec.sh target/debug/rws "$RUNNER_TEMP/h2spec"
      - name: Idle / slow clients can't starve the server
        if: matrix.check == 'slow-clients'
        run: ci/e2e/slow_clients.sh target/debug/rws
      - name: rws --check and SIGHUP route reload
        if: matrix.check == 'config-reload'
        run: ci/e2e/config_reload.sh target/debug/rws
      - name: Every config the site's playground can build passes rws --check
        if: matrix.check == 'config-reload'
        run: node site/scripts/check-playground.js target/debug/rws
      - name: Access log to a file (SIGUSR1 reopen, size rotation)
        if: matrix.check == 'access-log'
        run: ci/e2e/access_log.sh target/debug/rws
      - name: Upstream weights, stickiness, retries, circuit breaker, metrics
        if: matrix.check == 'proxy-policies'
        run: ci/e2e/proxy_policies.sh target/debug/rws
      - name: MCP gateway from the config file (two upstreams, ACLs, limits, audit log)
        if: matrix.check == 'mcp-gateway'
        run: ci/e2e/mcp_gateway.sh target/debug/rws
      - name: Admin API on its own listener
        if: matrix.check == 'admin'
        run: ci/e2e/admin.sh target/debug/rws
      - name: WebAssembly plugins (unit tests with the feature; the example plugin through the binary)
        if: matrix.check == 'wasm-plugins'
        run: |
          rustup target add wasm32-unknown-unknown
          cargo test --lib --features wasm-plugins -- wasm_plugin stack_depth
          cargo build --bin rws --features "acme auth wasm-plugins"
          cargo build --release --target wasm32-unknown-unknown --manifest-path examples/wasm_plugin/Cargo.toml
          ci/e2e/wasm_plugin.sh target/debug/rws examples/wasm_plugin/target/wasm32-unknown-unknown/release/rws_wasm_plugin_example.wasm
      - uses: actions/setup-node@v4
        if: matrix.check == 'admin-ui'
        with:
          node-version: 24
      - name: Admin UI (embedded bundle up to date; headless Chromium against the binary)
        if: matrix.check == 'admin-ui'
        run: |
          admin-ui/build.sh --check
          (cd ci/e2e/admin_ui && npm install --no-save --no-audit --no-fund playwright@1.64.0 && npx playwright install --with-deps chromium)
          ci/e2e/admin_ui.sh target/debug/rws
      - name: LLM proxy from the config file (fallback, usage, budgets, Redis-shared budgets)
        if: matrix.check == 'llm-proxy'
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q redis-server
          ci/e2e/llm_proxy.sh target/debug/rws "$(command -v redis-server)"
      - name: Native histograms scraped by Prometheus 3 (protobuf /metrics)
        if: matrix.check == 'native-histograms'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release download v3.15.0 --repo prometheus/prometheus --pattern 'prometheus-3.15.0.linux-amd64.tar.gz' --dir "$RUNNER_TEMP"
          tar xzf "$RUNNER_TEMP/prometheus-3.15.0.linux-amd64.tar.gz" -C "$RUNNER_TEMP"
          ci/e2e/native_histograms.sh target/debug/rws "$RUNNER_TEMP/prometheus-3.15.0.linux-amd64/prometheus"
      - name: OTLP metrics and traces into an OpenTelemetry Collector
        if: matrix.check == 'otlp'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release download v0.162.0 --repo open-telemetry/opentelemetry-collector-releases --pattern 'otelcol-contrib_0.162.0_linux_amd64.tar.gz' --dir "$RUNNER_TEMP"
          tar xzf "$RUNNER_TEMP/otelcol-contrib_0.162.0_linux_amd64.tar.gz" -C "$RUNNER_TEMP"
          ci/e2e/otlp.sh target/debug/rws "$RUNNER_TEMP/otelcol-contrib"
      - name: gRPC against tonic (every call type, cleartext and mTLS upstreams; h2c with grpcurl)
        if: matrix.check == 'grpc'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q protobuf-compiler
          gh release download v1.9.4 --repo fullstorydev/grpcurl --pattern 'grpcurl_1.9.4_linux_x86_64.tar.gz' --dir "$RUNNER_TEMP"
          tar xzf "$RUNNER_TEMP/grpcurl_1.9.4_linux_x86_64.tar.gz" -C "$RUNNER_TEMP" grpcurl
          cargo build --locked --release --manifest-path ci/e2e/grpc/Cargo.toml --bins
          ci/e2e/grpc.sh target/debug/rws ci/e2e/grpc/target/release/server ci/e2e/grpc/target/release/client "$RUNNER_TEMP/grpcurl"
      - uses: actions/setup-node@v4
        if: matrix.check == 'grpc'
        with:
          node-version: 24
      - name: gRPC-web from a browser (headless Chromium, HTTP/1.1 and HTTP/2)
        if: matrix.check == 'grpc'
        run: |
          (cd ci/e2e/grpc_web && npm install --no-save --no-audit --no-fund playwright@1.64.0 && npx playwright install --with-deps chromium)
          ci/e2e/grpc_web.sh target/debug/rws ci/e2e/grpc/target/release/server
      - name: PROXY protocol v1/v2 behind HAProxy (plain and TLS)
        if: matrix.check == 'proxy-protocol'
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q haproxy
          ci/e2e/proxy_protocol.sh target/debug/rws "$(command -v haproxy)"
      - uses: actions/setup-node@v4
        if: matrix.check == 'realtime'
        with:
          node-version: 24
      - name: WebSocket routes and streaming SSE (Node clients; plain/TLS, shared/per-core, SSE over HTTP/2)
        if: matrix.check == 'realtime'
        run: |
          cargo build --example realtime
          ci/e2e/realtime.sh target/debug/examples/realtime
      - name: Starters build and pass their own tests against this checkout
        if: matrix.check == 'starters'
        run: ci/e2e/starters.sh
      - name: Tower interop — tonic-health over h2c (grpcurl) and a tower-http layer
        if: matrix.check == 'tower'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          cargo build --example tower --features tower
          gh release download v1.9.4 --repo fullstorydev/grpcurl --pattern 'grpcurl_1.9.4_linux_x86_64.tar.gz' --dir "$RUNNER_TEMP"
          tar xzf "$RUNNER_TEMP/grpcurl_1.9.4_linux_x86_64.tar.gz" -C "$RUNNER_TEMP" grpcurl
          ci/e2e/tower.sh target/debug/examples/tower "$RUNNER_TEMP/grpcurl"
      - name: OpenAPI 3.1 document validated by openapi-spec-validator
        if: matrix.check == 'openapi'
        run: |
          cargo build --example mcp_inventory --features "macros serde sso openapi"
          python3 -m venv "$RUNNER_TEMP/oasv"
          "$RUNNER_TEMP/oasv/bin/pip" install --quiet openapi-spec-validator==0.9.0
          ci/e2e/openapi.sh target/debug/examples/mcp_inventory "$RUNNER_TEMP/oasv/bin/python"

  # Every parser that sees untrusted input — see fuzz/README.md. 30 s per
  # target on push; 10 minutes each in the weekly scheduled run.
  fuzz:
    name: fuzz
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: fuzz
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-fuzz
      - run: fuzz/run.sh ${{ github.event_name == 'schedule' && 600 || 30 }} 4
      - name: Keep crashing inputs
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: fuzz-artifacts
          path: |
            fuzz/artifacts
            fuzz/logs

  audit:
    name: cargo audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: taiki-e/install-action@cargo-audit
      # Reads ignores (with justifications) from .cargo/audit.toml
      - run: cargo audit

  deny:
    name: cargo deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: taiki-e/install-action@cargo-deny
      # Advisories, licenses (permissive only), banned sources (crates.io
      # only) — deny.toml.
      - run: cargo deny check

  docs:
    name: site (rws8.tech)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: site
    steps:
      - uses: actions/checkout@v4
        with:
          # Older docs versions are built from their release tags.
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: site/package-lock.json
      - run: npm ci
      - run: npm audit --audit-level=moderate
      - run: npm run build

  docs-mcp:
    name: docs MCP server (site/mcp)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: site/mcp
      - run: cargo test --locked --manifest-path site/mcp/Cargo.toml
      - run: cargo clippy --locked --manifest-path site/mcp/Cargo.toml --all-targets

  install-script:
    name: install.sh (${{ matrix.os }})
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      # The latest release, as `curl … | sh` runs it, and a pinned one.
      - run: sh install.sh --dir "$RUNNER_TEMP/latest" && "$RUNNER_TEMP/latest/rws" --version
      - run: cat install.sh | sh -s -- --version 18.8.3 --dir "$RUNNER_TEMP/pinned" && "$RUNNER_TEMP/pinned/rws" --version | grep -q 18.8.3
      - run: "! sh install.sh --version 0.0.1 --dir \"$RUNNER_TEMP/none\""
      # The copy the site serves, as users run it.
      - run: curl -fsSL https://rws8.tech/install.sh | sh -s -- --dir "$RUNNER_TEMP/site" && "$RUNNER_TEMP/site/rws" --version

  docs-check:
    name: docs links, settings and llms.txt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # Links between pages, links to repo files, every RWS_CONFIG_* on env-vars.md
      - run: python3 ci/check_docs.py
      # llms.txt / llms-full.txt are generated from docs/ — fails when not regenerated
      - run: python3 ci/gen_llms.py --check
      # The Cursor rule and Copilot instructions are generated from the agent skill
      - run: python3 ci/gen_agents.py --check