synta 0.1.3

---
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  # Package sets used across jobs (update key suffix when changing packages)
  DNF_PACKAGES_DEV: >-
    tar gzip cbindgen cargo-c gcc gcc-c++ make openssl-devel llvm
    pkgconf-pkg-config clang python3-devel nodejs22 /usr/bin/node /usr/bin/npm
  DNF_PACKAGES_BENCH: >-
    tar gzip cbindgen cargo-c gcc gcc-c++ make openssl-devel nss-devel llvm
    pkgconf-pkg-config clang nodejs22 /usr/bin/node /usr/bin/npm

jobs:
  # ── Build ──────────────────────────────────────────────────────────────────
  # Compiles the full workspace (debug + release) once on stable and saves
  # the resulting artifacts to cache. All downstream jobs restore from this
  # cache instead of recompiling from scratch.
  build:
    name: Build
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore cargo registry cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/registry
          key: cargo-registry-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-registry-v1-
      - name: Restore cargo git cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/git
          key: cargo-git-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-git-v1-
      - name: Build workspace
        run: ./contrib/ci/local-ci.sh --no-deps build
      - name: Prune incremental artifacts before caching
        run: rm -rf target/debug/incremental
      - name: Save debug build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/debug/deps
            target/debug/build
            target/debug/examples
          key: cargo-target-debug-stable-v1-${{ github.sha }}
      - name: Save release build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/release
            include/
          key: cargo-target-release-stable-v1-${{ github.sha }}

  # ── Format ─────────────────────────────────────────────────────────────────
  # Runs in parallel with build — rustfmt needs no compiled artifacts.
  fmt:
    name: Rustfmt
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Check formatting
        run: ./contrib/ci/local-ci.sh --no-deps fmt

  # ── Ruff ───────────────────────────────────────────────────────────────────
  # Runs in parallel with build — checking Python files needs no compiled artefacts.
  ruff:
    name: Ruff
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Setup uv
        uses: https://github.com/astral-sh/setup-uv@v7
        with:
          enable-cache: true
          prune-cache: false
      - name: Cache uv packages
        uses: actions/cache@v5
        with:
          path: ~/.cache/uv
          key: uv-v1-ruff
      - name: Check Python files with ruff
        run: ./contrib/ci/local-ci.sh --no-deps ruff

  # ── Markdown TOC ───────────────────────────────────────────────────────────
  # Verifies every workspace .md file has an up-to-date doctoc-compatible TOC.
  # Pure Python — needs no compiled artifacts; runs in parallel with build.
  toc:
    name: Markdown TOC
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Setup uv
        uses: https://github.com/astral-sh/setup-uv@v7
        with:
          enable-cache: true
          prune-cache: false
      - name: Cache uv packages
        uses: actions/cache@v5
        with:
          path: ~/.cache/uv
          key: uv-v1-toc
      - name: Check Markdown table of contents
        run: ./contrib/ci/local-ci.sh --no-deps toc

  # ── Clippy ─────────────────────────────────────────────────────────────────
  clippy:
    name: Clippy
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore cargo registry cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/registry
          key: cargo-registry-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-registry-v1-
      - name: Restore debug build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/debug/deps
            target/debug/build
            target/debug/examples
          key: cargo-target-debug-stable-v1-${{ github.sha }}
      - name: Run clippy
        run: ./contrib/ci/local-ci.sh --no-deps clippy

  # ── Documentation ──────────────────────────────────────────────────────────
  doc:
    name: Documentation
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore cargo registry cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/registry
          key: cargo-registry-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-registry-v1-
      - name: Restore debug build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/debug/deps
            target/debug/build
            target/debug/examples
          key: cargo-target-debug-stable-v1-${{ github.sha }}
      - name: Build documentation
        run: ./contrib/ci/local-ci.sh --no-deps doc

  # ── C/C++ documentation samples ────────────────────────────────────────────
  # Type-checks every C and C++ code block in docs/ against the real synta.h.
  # Uses -fsyntax-only (no linking), so only the generated header is needed
  # from the release cache — libcsynta.so is not required.
  doc-c:
    name: C/C++ Doc Samples
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore release build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/release
            include/
          key: cargo-target-release-stable-v1-${{ github.sha }}
      - name: Validate C/C++ documentation samples
        run: ./contrib/ci/local-ci.sh --no-deps doc-c

  # ── Rust documentation samples ─────────────────────────────────────────────
  # Type-checks every Rust code block in docs/ via a temporary Cargo project
  # that depends on synta as a path dependency.  The shared target/ directory
  # lets cargo reuse the already-compiled synta rlib from the build cache.
  doc-rust:
    name: Rust Doc Samples
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore cargo registry cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/registry
          key: cargo-registry-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-registry-v1-
      - name: Restore debug build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/debug/deps
            target/debug/build
            target/debug/examples
          key: cargo-target-debug-stable-v1-${{ github.sha }}
      - name: Validate Rust documentation samples
        run: ./contrib/ci/local-ci.sh --no-deps doc-rust

  # ── Python documentation samples ───────────────────────────────────────────
  # Syntax-checks every Python code block in docs/ with python3 -m py_compile.
  # No Rust toolchain or compiled artifacts are needed — pure syntax validation.
  doc-python:
    name: Python Doc Samples
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Setup uv
        uses: https://github.com/astral-sh/setup-uv@v7
        with:
          enable-cache: true
          prune-cache: false
      - name: Cache uv packages
        uses: actions/cache@v5
        with:
          path: ~/.cache/uv
          key: uv-v1-python
      - name: Validate Python documentation samples
        run: ./contrib/ci/local-ci.sh --no-deps doc-python

  # ── Python bindings ────────────────────────────────────────────────────────
  # uv manages the venv; maturin develop still invokes cargo, but with the
  # workspace deps already compiled in the cache it only links the final cdylib.
  python-test:
    name: Python Bindings Tests
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore cargo registry cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/registry
          key: cargo-registry-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-registry-v1-
      - name: Restore debug build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/debug/deps
            target/debug/build
            target/debug/examples
          key: cargo-target-debug-stable-v1-${{ github.sha }}
      - name: Setup uv
        uses: https://github.com/astral-sh/setup-uv@v7
        with:
          enable-cache: true
          prune-cache: false
      - name: Cache uv packages
        uses: actions/cache@v5
        with:
          path: ~/.cache/uv
          key: uv-v1-maturin-pytest
      - name: Run Python binding tests
        run: ./contrib/ci/local-ci.sh --no-deps python-test

  # ── C FFI tests ────────────────────────────────────────────────────────────
  # Uses only the cached release library — no Rust toolchain needed.
  c-test:
    name: C FFI Tests
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore release build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/release
            include/
          key: cargo-target-release-stable-v1-${{ github.sha }}
      - name: Build and run C tests
        run: ./contrib/ci/local-ci.sh --no-deps c-test

  # ── synta-codegen tests ─────────────────────────────────────────────────────
  # Pure-Rust crate; no native packages needed.
  test-codegen:
    name: synta-codegen Tests
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore cargo registry cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/registry
          key: cargo-registry-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-registry-v1-
      - name: Restore debug build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/debug/deps
            target/debug/build
            target/debug/examples
          key: cargo-target-debug-stable-v1-${{ github.sha }}
      - name: Run synta-codegen tests
        run: ./contrib/ci/local-ci.sh --no-deps test-codegen

  # ── synta-certificate tests ─────────────────────────────────────────────────
  # Needs a C toolchain for linking but not Python (python feature excluded).
  test-certificate:
    name: synta-certificate Tests
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore cargo registry cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/registry
          key: cargo-registry-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-registry-v1-
      - name: Restore debug build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/debug/deps
            target/debug/build
            target/debug/examples
          key: cargo-target-debug-stable-v1-${{ github.sha }}
      - name: Run synta-certificate tests
        run: ./contrib/ci/local-ci.sh --no-deps test-certificate

  # ── synta-krb5 tests ────────────────────────────────────────────────────────
  # Pure-Rust crate with a build.rs code-generation step; no native packages
  # required beyond the Rust toolchain.
  test-krb5:
    name: synta-krb5 Tests
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore cargo registry cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/registry
          key: cargo-registry-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-registry-v1-
      - name: Restore debug build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/debug/deps
            target/debug/build
            target/debug/examples
          key: cargo-target-debug-stable-v1-${{ github.sha }}
      - name: Run synta-krb5 tests
        run: ./contrib/ci/local-ci.sh --no-deps test-krb5

  # ── synta-mtc tests ─────────────────────────────────────────────────────────
  # Pure-Rust crate with a build.rs code-generation step; no native packages
  # required beyond the Rust toolchain.
  test-mtc:
    name: synta-mtc Tests
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore cargo registry cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/registry
          key: cargo-registry-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-registry-v1-
      - name: Restore debug build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/debug/deps
            target/debug/build
            target/debug/examples
          key: cargo-target-debug-stable-v1-${{ github.sha }}
      - name: Run synta-mtc tests
        run: ./contrib/ci/local-ci.sh --no-deps test-mtc

  # ── Serde tests ────────────────────────────────────────────────────────────
  # Runs the serde feature in isolation (not buried inside --all-features) to
  # catch missing cfg gates, broken impls, or feature-interaction bugs early.
  test-serde:
    name: Serde Tests and Examples
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore cargo registry cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/registry
          key: cargo-registry-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-registry-v1-
      - name: Restore debug build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/debug/deps
            target/debug/build
            target/debug/examples
          key: cargo-target-debug-stable-v1-${{ github.sha }}
      - name: Run serde tests and examples
        run: ./contrib/ci/local-ci.sh --no-deps test-serde

  # ── Benchmarks ─────────────────────────────────────────────────────────────
  bench:
    name: Simulate benchmarks
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_BENCH"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore cargo registry cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/registry
          key: cargo-registry-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-registry-v1-
      - name: Restore cargo git cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/git
          key: cargo-git-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-git-v1-
      - name: Restore debug build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/debug/deps
            target/debug/build
            target/debug/examples
          key: cargo-target-debug-stable-v1-${{ github.sha }}
      - name: Build benchmarks
        run: ./contrib/ci/local-ci.sh --no-deps bench

  # ── Test suite ─────────────────────────────────────────────────────────────
  # Stable gets a full cache hit from the build job.
  test:
    name: Test Suite on Rust ${{ matrix.rust }}
    needs: [build]
    runs-on: vdali
    container: quay.io/hummingbird/rust:latest-builder
    steps:
      - name: Install native compilation support
        run: |
          PKGS="$DNF_PACKAGES_DEV"
          if rpm -q $PKGS >/dev/null 2>&1; then
            echo "All required packages already installed"
          else
            dnf install -y $PKGS
          fi
      - uses: actions/checkout@v4
      - name: Restore cargo registry cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/registry
          key: cargo-registry-v1-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: cargo-registry-v1-
      - name: Restore build artifacts
        uses: actions/cache@v5
        with:
          path: |
            target/debug/deps
            target/debug/build
            target/debug/examples
          key: cargo-target-debug-v1-${{ github.sha }}
          restore-keys: cargo-target-debug-${{ matrix.rust }}-v1-
      - name: Run tests
        run: ./contrib/ci/local-ci.sh --no-deps test