sapling-crypto 0.8.0

name: CI checks

permissions: {}

on: [push, pull_request]

jobs:
  test:
    name: Test on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macOS-latest]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - name: Run tests
        run: cargo test --all-features --verbose --release
      - name: Verify working directory is clean
        run: git diff --exit-code

  build-latest:
    name: Latest build on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macOS-latest]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
        id: toolchain
        with:
          toolchain: stable
      - run: rustup override set "${TOOLCHAIN}"
        # This job's matrix includes windows-latest, where the default shell is
        # PowerShell and "${TOOLCHAIN}" is not environment-variable syntax, so
        # it would expand to the empty string and rustup would reject it.
        shell: bash
        env:
          TOOLCHAIN: ${{steps.toolchain.outputs.name}}
      - name: Remove lockfile to build with latest dependencies
        run: rm Cargo.lock
      - name: Build crate
        run: cargo build --all-targets --all-features --verbose
      - name: Verify working directory is clean (excluding lockfile)
        run: git diff --exit-code ':!Cargo.lock'

  build-nostd:
    name: Build target ${{ matrix.target }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        target:
          - wasm32-wasip1
          - thumbv7em-none-eabihf
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          path: crate_root
          persist-credentials: false
      # We use a synthetic crate to ensure no dev-dependencies are enabled, which can
      # be incompatible with some of these targets.
      - name: Create synthetic crate for testing
        run: cargo init --edition 2021 --lib ci-build
      - name: Copy Rust version into synthetic crate
        run: cp crate_root/rust-toolchain.toml ci-build/
      - name: Copy patch directives into synthetic crate
        run: |
          echo "[patch.crates-io]" >> ./ci-build/Cargo.toml
          cat ./crate_root/Cargo.toml | sed "0,/.\+\(patch.crates.\+\)/d" >> ./ci-build/Cargo.toml
      - name: Add no_std pragma to lib.rs
        run: |
          echo "#![no_std]" > ./ci-build/src/lib.rs
      - name: Add sapling-crypto as a dependency of the synthetic crate
        working-directory: ./ci-build
        run: cargo add --no-default-features --path ../crate_root
      - name: Add lazy_static with the spin_no_std feature
        working-directory: ./ci-build
        run: cargo add lazy_static --no-default-features --features "spin_no_std"
      - name: Copy pinned dependencies into synthetic crate
        run: cp crate_root/Cargo.lock ci-build/
      - name: Show Cargo.toml for the synthetic crate
        working-directory: ./ci-build
        run: cat Cargo.toml
      - name: Copy pinned dependencies into synthetic crate
        run: cp crate_root/Cargo.lock ci-build/
      - name: Add target
        working-directory: ./ci-build
        run: rustup target add ${{ matrix.target }}
      - name: Build no_std for target
        working-directory: ./ci-build
        run: cargo build --verbose --target ${{ matrix.target }}

  bitrot:
    name: Bitrot check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      # Build benchmarks to prevent bitrot
      - name: Build benchmarks
        run: cargo build --all --benches

  clippy:
    name: Clippy (MSRV)
    runs-on: ubuntu-latest
    permissions:
      checks: write # Required for the clippy action to report its results as a check run.
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - name: Run Clippy
        uses: auguwu/clippy-action@9817d076b82df0194935be9db6154c56ac07b317 # 1.5.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          working-directory: ${{ inputs.target }}
          deny: warnings

  doc-links:
    name: Intra-doc links
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - run: cargo fetch
      # Requires #![deny(rustdoc::broken_intra_doc_links)] in crate.
      - name: Check intra-doc links
        run: cargo doc --all-features --document-private-items

  fmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - name: Check formatting
        run: cargo fmt -- --check