rust-web-server 18.4.0

name: CI

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    # Weekly, so a newly published RustSec/npm advisory turns the badge red
    # even when nothing was pushed.
    - cron: "0 6 * * 1"

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    name: test (${{ matrix.name }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: default (http3)
            args: ""
          - name: http1 only
            args: --no-default-features --features http1
          - name: tls + auth + sso + serde
            args: --features "sso sso-server sso-saml auth-asymmetric http-client acme serde macros"
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.name }}
      - run: cargo test ${{ matrix.args }}

  msrv:
    name: msrv (1.88, all features)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.88
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --all-features

  # End-to-end checks against real external implementations — see ci/e2e/.
  e2e:
    name: e2e (${{ matrix.check }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        check: [acme-pebble, acme-dns01, acme-dns-api, acme-shared, acme-on-demand, h2spec, slow-clients, config-reload, access-log, grpc, proxy-protocol]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: e2e
      - run: cargo build --bin rws --features "acme auth mimalloc"
      - name: ACME against Pebble (Let's Encrypt's test CA)
        if: matrix.check == 'acme-pebble'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p "$RUNNER_TEMP/pebble/src"
          gh release download v2.10.1 --repo letsencrypt/pebble --pattern 'pebble-linux-amd64.tar.gz' --dir "$RUNNER_TEMP/pebble"
          tar xzf "$RUNNER_TEMP/pebble/pebble-linux-amd64.tar.gz" -C "$RUNNER_TEMP/pebble"
          gh api repos/letsencrypt/pebble/tarball/v2.10.1 | tar xz -C "$RUNNER_TEMP/pebble/src" --strip-components=1
          # The release archive ships the binary without the execute bit.
          pebble_bin="$RUNNER_TEMP/pebble/pebble-linux-amd64/linux/amd64/pebble"
          chmod +x "$pebble_bin"
          ci/e2e/acme_pebble.sh target/debug/rws "$pebble_bin" "$RUNNER_TEMP/pebble/src"
      - name: ACME DNS-01 against Pebble and BIND (RFC 2136 + TSIG, wildcard, exec hook)
        if: matrix.check == 'acme-dns01'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q bind9 bind9-dnsutils
          mkdir -p "$RUNNER_TEMP/pebble/src"
          gh release download v2.10.1 --repo letsencrypt/pebble --pattern 'pebble-linux-amd64.tar.gz' --dir "$RUNNER_TEMP/pebble"
          tar xzf "$RUNNER_TEMP/pebble/pebble-linux-amd64.tar.gz" -C "$RUNNER_TEMP/pebble"
          gh api repos/letsencrypt/pebble/tarball/v2.10.1 | tar xz -C "$RUNNER_TEMP/pebble/src" --strip-components=1
          pebble_bin="$RUNNER_TEMP/pebble/pebble-linux-amd64/linux/amd64/pebble"
          chmod +x "$pebble_bin"
          ci/e2e/acme_dns01.sh target/debug/rws "$pebble_bin" "$RUNNER_TEMP/pebble/src" "$(command -v named)" "$(command -v nsupdate)"
      - name: ACME DNS-01 through Cloudflare and Route 53 APIs (mocked into BIND), and DNS-PERSIST-01
        if: matrix.check == 'acme-dns-api'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q bind9 bind9-dnsutils
          mkdir -p "$RUNNER_TEMP/pebble/src"
          gh release download v2.10.1 --repo letsencrypt/pebble --pattern 'pebble-linux-amd64.tar.gz' --dir "$RUNNER_TEMP/pebble"
          tar xzf "$RUNNER_TEMP/pebble/pebble-linux-amd64.tar.gz" -C "$RUNNER_TEMP/pebble"
          gh api repos/letsencrypt/pebble/tarball/v2.10.1 | tar xz -C "$RUNNER_TEMP/pebble/src" --strip-components=1
          pebble_bin="$RUNNER_TEMP/pebble/pebble-linux-amd64/linux/amd64/pebble"
          chmod +x "$pebble_bin"
          ci/e2e/acme_dns_api.sh target/debug/rws "$pebble_bin" "$RUNNER_TEMP/pebble/src" "$(command -v named)" "$(command -v nsupdate)"
      - name: ACME with two replicas sharing certificates through Redis
        if: matrix.check == 'acme-shared'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q redis-server
          mkdir -p "$RUNNER_TEMP/pebble/src"
          gh release download v2.10.1 --repo letsencrypt/pebble --pattern 'pebble-linux-amd64.tar.gz' --dir "$RUNNER_TEMP/pebble"
          tar xzf "$RUNNER_TEMP/pebble/pebble-linux-amd64.tar.gz" -C "$RUNNER_TEMP/pebble"
          gh api repos/letsencrypt/pebble/tarball/v2.10.1 | tar xz -C "$RUNNER_TEMP/pebble/src" --strip-components=1
          pebble_bin="$RUNNER_TEMP/pebble/pebble-linux-amd64/linux/amd64/pebble"
          chmod +x "$pebble_bin"
          ci/e2e/acme_shared.sh target/debug/rws "$pebble_bin" "$RUNNER_TEMP/pebble/src" "$(command -v redis-server)"
      - name: On-demand TLS against Pebble and BIND
        if: matrix.check == 'acme-on-demand'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q bind9
          mkdir -p "$RUNNER_TEMP/pebble/src"
          gh release download v2.10.1 --repo letsencrypt/pebble --pattern 'pebble-linux-amd64.tar.gz' --dir "$RUNNER_TEMP/pebble"
          tar xzf "$RUNNER_TEMP/pebble/pebble-linux-amd64.tar.gz" -C "$RUNNER_TEMP/pebble"
          gh api repos/letsencrypt/pebble/tarball/v2.10.1 | tar xz -C "$RUNNER_TEMP/pebble/src" --strip-components=1
          pebble_bin="$RUNNER_TEMP/pebble/pebble-linux-amd64/linux/amd64/pebble"
          chmod +x "$pebble_bin"
          ci/e2e/acme_on_demand.sh target/debug/rws "$pebble_bin" "$RUNNER_TEMP/pebble/src" "$(command -v named)"
      - name: HTTP/2 conformance (h2spec)
        if: matrix.check == 'h2spec'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release download v2.6.0 --repo summerwind/h2spec --pattern 'h2spec_linux_amd64.tar.gz' --dir "$RUNNER_TEMP"
          tar xzf "$RUNNER_TEMP/h2spec_linux_amd64.tar.gz" -C "$RUNNER_TEMP"
          ci/e2e/h2spec.sh target/debug/rws "$RUNNER_TEMP/h2spec"
      - name: Idle / slow clients can't starve the server
        if: matrix.check == 'slow-clients'
        run: ci/e2e/slow_clients.sh target/debug/rws
      - name: rws --check and SIGHUP route reload
        if: matrix.check == 'config-reload'
        run: ci/e2e/config_reload.sh target/debug/rws
      - name: Access log to a file (SIGUSR1 reopen, size rotation)
        if: matrix.check == 'access-log'
        run: ci/e2e/access_log.sh target/debug/rws
      - name: gRPC against tonic (every call type, cleartext and mTLS upstreams; h2c with grpcurl)
        if: matrix.check == 'grpc'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q protobuf-compiler
          gh release download v1.9.4 --repo fullstorydev/grpcurl --pattern 'grpcurl_1.9.4_linux_x86_64.tar.gz' --dir "$RUNNER_TEMP"
          tar xzf "$RUNNER_TEMP/grpcurl_1.9.4_linux_x86_64.tar.gz" -C "$RUNNER_TEMP" grpcurl
          cargo build --locked --release --manifest-path ci/e2e/grpc/Cargo.toml --bins
          ci/e2e/grpc.sh target/debug/rws ci/e2e/grpc/target/release/server ci/e2e/grpc/target/release/client "$RUNNER_TEMP/grpcurl"
      - uses: actions/setup-node@v4
        if: matrix.check == 'grpc'
        with:
          node-version: 24
      - name: gRPC-web from a browser (headless Chromium, HTTP/1.1 and HTTP/2)
        if: matrix.check == 'grpc'
        run: |
          (cd ci/e2e/grpc_web && npm install --no-save --no-audit --no-fund playwright@1.64.0 && npx playwright install --with-deps chromium)
          ci/e2e/grpc_web.sh target/debug/rws ci/e2e/grpc/target/release/server
      - name: PROXY protocol v1/v2 behind HAProxy (plain and TLS)
        if: matrix.check == 'proxy-protocol'
        run: |
          sudo apt-get update -q && sudo apt-get install -y -q haproxy
          ci/e2e/proxy_protocol.sh target/debug/rws "$(command -v haproxy)"

  # Every parser that sees untrusted input — see fuzz/README.md. 30 s per
  # target on push; 10 minutes each in the weekly scheduled run.
  fuzz:
    name: fuzz
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: fuzz
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-fuzz
      - run: fuzz/run.sh ${{ github.event_name == 'schedule' && 600 || 30 }} 4
      - name: Keep crashing inputs
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: fuzz-artifacts
          path: |
            fuzz/artifacts
            fuzz/logs

  audit:
    name: cargo audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: taiki-e/install-action@cargo-audit
      # Reads ignores (with justifications) from .cargo/audit.toml
      - run: cargo audit

  deny:
    name: cargo deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: taiki-e/install-action@cargo-deny
      # Advisories, licenses (permissive only), banned sources (crates.io
      # only) — deny.toml.
      - run: cargo deny check

  docs:
    name: docs site
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: docs
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: docs/package-lock.json
      - run: npm ci
      - run: npm audit --audit-level=moderate
      - run: npm run build

  docs-check:
    name: docs links, settings and llms.txt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # Links between pages, links to repo files, every RWS_CONFIG_* on env-vars.md
      - run: python3 ci/check_docs.py
      # llms.txt / llms-full.txt are generated from docs/ — fails when not regenerated
      - run: python3 ci/gen_llms.py --check