u-numflow 0.6.4

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  check:
    name: Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - run: cargo check --all-targets

  # The declared `rust-version` was measured by hand (toolchains 1.85 / 1.87
  # / 1.89 installed and run), and nothing since has checked that the crate
  # still builds there: the cross-repo guard only orders the floors. This job
  # builds on exactly the declared toolchain on every push. Dependencies are
  # resolved the way a consumer on that toolchain would resolve them -- the
  # MSRV-aware resolver takes the newest version of each dependency that
  # declares support for the floor -- so a dependency raising its own floor
  # surfaces as this job failing to resolve, not as a broken build somewhere
  # downstream.
  msrv:
    name: MSRV (declared rust-version builds)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Read the declared floor
        id: msrv
        run: |
          MSRV=$(grep -m1 '^rust-version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
          test -n "$MSRV" || { echo "no rust-version in Cargo.toml"; exit 1; }
          echo "version=$MSRV" >> "$GITHUB_OUTPUT"
          echo "Declared MSRV: $MSRV"
      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
        with:
          toolchain: ${{ steps.msrv.outputs.version }}
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - run: cargo generate-lockfile
        env:
          CARGO_RESOLVER_INCOMPATIBLE_RUST_VERSIONS: fallback
      - run: cargo check --all-features

  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
        with:
          toolchain: stable
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
        with:
          toolchain: stable
          components: clippy
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - run: cargo clippy --all-targets -- -D warnings

  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - run: cargo test --all-targets
      # `--all-targets` expands to lib/bins/tests/benches/examples and
      # deliberately excludes doc-tests, so they need their own invocation.
      # Without this step the examples in the public docs go unverified.
      - run: cargo test --doc

  docs:
    name: Documentation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - run: cargo doc --no-deps
        env:
          RUSTDOCFLAGS: -D warnings

  audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: taiki-e/install-action@84f5ac3124727fb3d284d4d22ee9ab3654fd09a6 # v2
        with:
          tool: cargo-audit
      - run: cargo audit

  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
        with:
          toolchain: stable
          components: llvm-tools-preview
      - uses: taiki-e/install-action@84f5ac3124727fb3d284d4d22ee9ab3654fd09a6 # v2
        with:
          tool: cargo-llvm-cov
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - run: cargo llvm-cov --lcov --output-path lcov.info
      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          files: lcov.info
          fail_ci_if_error: false

  semver:
    name: SemVer (cargo-semver-checks)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Check public API against the latest crates.io release
        uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2

  changelog:
    name: Changelog Entry
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Changelog has an entry for the version in Cargo.toml
        run: bash scripts/check-changelog-entry.sh

  wasm:
    name: WASM Binding
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
        with:
          toolchain: stable
          components: clippy
          targets: wasm32-unknown-unknown
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      # `src/wasm.rs` is behind the `wasm` feature, so every job above compiles
      # the crate without it -- the bindings, and any tests that pin their wire
      # contract, are invisible to all of them. This job is the only place the
      # binding is built at all outside a release.
      - name: Binding tests (host target)
        run: cargo test --features wasm --lib
      - run: cargo clippy --features wasm --all-targets -- -D warnings
      - name: Compile the binding for its real target
        run: cargo check --features wasm --target wasm32-unknown-unknown

  unused-deps:
    name: Unused Dependencies
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: taiki-e/install-action@84f5ac3124727fb3d284d4d22ee9ab3654fd09a6 # v2
        with:
          tool: cargo-machete@0.9.2
      # The pin checks say whether a declared dependency is current, not whether
      # it is needed at all. One that is declared and never named costs every
      # build, and ties this crate's releases to that crate's.
      - run: cargo machete