vantadb 0.1.4

name: VantaDB CI

on:
  push:
    branches: [ "main" ]
    paths:
      - 'src/**'
      - 'tests/**'
      - 'benches/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'build.rs'
      - '.config/nextest.toml'
      - '.github/workflows/rust_ci.yml'
      - 'deny.toml'
      - 'rust-toolchain.toml'
      - 'vantadb-server/**'
      - 'vantadb-mcp/**'
      - 'packages/**'
  pull_request:
    branches: [ "main" ]
    paths:
      - 'src/**'
      - 'tests/**'
      - 'benches/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'build.rs'
      - '.config/nextest.toml'
      - '.github/workflows/rust_ci.yml'
      - 'deny.toml'
      - 'rust-toolchain.toml'
      - 'vantadb-server/**'
      - 'vantadb-mcp/**'
      - 'packages/**'
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
    - name: Free Disk Space
      run: |
        sudo rm -rf /usr/share/dotnet
        sudo rm -rf /usr/local/lib/android
        sudo rm -rf /opt/ghc
        sudo rm -rf /opt/hostedtoolcache/CodeQL

    - uses: actions/checkout@v6

    - name: Add swap space (prevent OOM linker crash)
      run: |
        sudo swapoff /swapfile || true
        sudo rm -f /swapfile
        sudo dd if=/dev/zero of=/swapfile bs=1M count=6144
        sudo chmod 600 /swapfile
        sudo mkswap /swapfile
        sudo swapon /swapfile
        free -h

    - name: Set up Rust
      uses: dtolnay/rust-toolchain@stable
      with:
        components: rustfmt, clippy

    - name: Rust Cache
      uses: Swatinem/rust-cache@v2
      with:
        cache-bin: "false"

    - name: Install system dependencies (RocksDB + Clang)
      run: |
        sudo apt-get update
        sudo apt-get install -y libclang-dev clang librocksdb-dev

    - name: Install cargo-nextest
      uses: taiki-e/install-action@v2
      with:
        tool: nextest

    - name: Install cargo-audit and cargo-deny
      uses: taiki-e/install-action@v2
      with:
        tool: cargo-audit,cargo-deny

    - name: Format Check
      run: cargo fmt --check

    - name: Clippy Lints
      run: cargo clippy --workspace --all-targets -- -D warnings

    # ── Fast Gate: Unified execution via nextest ─────────────────────
    # Benchmarks no se ejecutan aquí; clippy --all-targets ya los verifica sintácticamente.
    # Las pruebas de certificación pesada (stress, hnsw_validation, etc.) se ejecutan
    # exclusivamente en heavy_certification.yml (semanal / manual).
    - name: Cache benchmark dataset (GloVe 100d)
      uses: actions/cache@v4
      with:
        path: data/benchmark/glove.6B.100d.txt
        key: glove-100d-v1

    - name: Download benchmark datasets
      run: bash scripts/download_benchmark_datasets.sh
      shell: bash

    - name: Run fast gate tests (Audit profile)
      timeout-minutes: 30
      run: cargo nextest run --profile audit --workspace --features cli,arrow

    - name: Security Audit
      # DEBT NOTE: Ignoring pyo3 advisories RUSTSEC-2026-0176 and RUSTSEC-2026-0177
      # Code audit confirmed vantadb-python does NOT use affected APIs:
      # - PyList::nth() / PyTuple::nth_back() (out-of-bounds read)
      # - PyCFunction::new_closure (missing Sync bound)
      # Only safe PyList methods used: is_empty(), get_item(), iter(), len(), new(), empty(), append()
      # Pyo3 upgrade to >=0.29.0 planned in future roadmap (major version requiring extensive testing)
      run: cargo audit --ignore RUSTSEC-2026-0176 --ignore RUSTSEC-2026-0177

    - name: Dependency Policy Check
      run: cargo deny check

  windows-check:
    runs-on: windows-latest
    timeout-minutes: 45
    steps:
    - uses: actions/checkout@v6
    - name: Set up Rust (Windows)
      uses: dtolnay/rust-toolchain@stable
      with:
        components: clippy
    - name: Rust Cache
      uses: Swatinem/rust-cache@v2
      with:
        cache-bin: "false"
    - name: Install cargo-nextest
      uses: taiki-e/install-action@v2
      with:
        tool: nextest
    - name: Cargo check (Windows smoke test)
      run: cargo check --workspace
    - name: Clippy (Windows)
      run: cargo clippy --workspace -- -D warnings
    - name: Run quick integrity tests (Windows)
      shell: pwsh
      timeout-minutes: 30
      run: cargo nextest run --profile audit --workspace --features cli,arrow

  coverage:
    name: Code Coverage (cargo-llvm-cov)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
    - name: Free Disk Space
      run: |
        sudo rm -rf /usr/share/dotnet
        sudo rm -rf /usr/local/lib/android
        sudo rm -rf /opt/ghc
        sudo rm -rf /opt/hostedtoolcache/CodeQL

    - uses: actions/checkout@v6

    - name: Add swap space (prevent OOM linker crash)
      run: |
        sudo swapoff /swapfile || true
        sudo rm -f /swapfile
        sudo dd if=/dev/zero of=/swapfile bs=1M count=6144
        sudo chmod 600 /swapfile
        sudo mkswap /swapfile
        sudo swapon /swapfile

    - name: Set up Rust
      uses: dtolnay/rust-toolchain@stable
      with:
        components: llvm-tools-preview

    - name: Rust Cache
      uses: Swatinem/rust-cache@v2
      with:
        cache-bin: "false"

    - name: Install system dependencies (RocksDB + Clang)
      run: |
        sudo apt-get update
        sudo apt-get install -y libclang-dev clang librocksdb-dev

    - name: Install cargo-llvm-cov
      uses: taiki-e/install-action@v2
      with:
        tool: cargo-llvm-cov

    - name: Install cargo-nextest
      uses: taiki-e/install-action@v2
      with:
        tool: nextest

    - name: Cache benchmark dataset (GloVe 100d)
      uses: actions/cache@v4
      with:
        path: data/benchmark/glove.6B.100d.txt
        key: glove-100d-v1

    - name: Download benchmark datasets
      run: bash scripts/download_benchmark_datasets.sh
      shell: bash

    # Run workspace tests with coverage instrumentation.
    # Uses the audit nextest profile to skip heavy certification tests.
    # Generates both an LCOV report (for tooling) and a text summary (for logs).
    - name: Run tests with coverage
      timeout-minutes: 60
      run: |
        cargo llvm-cov nextest \
          --profile audit \
          --workspace \
          --features cli,arrow \
          --lcov --output-path lcov.info \
          --ignore-filename-regex '(tests/|benches/|packages/experimental|crash_injection)' \
          2>&1
        echo "--- Coverage Summary ---"
        cargo llvm-cov report \
          --ignore-filename-regex '(tests/|benches/|packages/experimental)'

    - name: Upload coverage report
      uses: actions/upload-artifact@v4
      with:
        name: coverage-lcov
        path: lcov.info
        if-no-files-found: warn