vx 0.4.1

name: CI

# Continuous Integration for PR validation and main branch verification
# - Code quality checks (formatting, clippy, documentation)
# - Comprehensive testing across platforms and Rust versions
# - Security auditing and MSRV verification
# - Build verification for key platforms
# - Release-plz configuration validation (PR only)

on:
  pull_request:
    branches: [main]
  push:
    branches: [main, develop]

permissions:
  contents: read
  actions: read
  security-events: write

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  # Code quality checks - formatting, clippy, and documentation
  code_quality:
    name: Code Quality
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache Rust dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-quality-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-quality-
            ${{ runner.os }}-cargo-

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Run clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Check documentation
        run: cargo doc --all-features --no-deps --document-private-items
        env:
          RUSTDOCFLAGS: "-D warnings"

  # Comprehensive testing across platforms
  test:
    name: Test - ${{ matrix.platform.name }}
    runs-on: ${{ matrix.platform.os }}
    strategy:
      matrix:
        platform:
          # Native compilation platforms - full build and test
          - name: Linux-x86_64
            os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            rust: stable
            cross_compile: false
          - name: Linux-x86_64-beta
            os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            rust: beta
            cross_compile: false
          - name: Windows-x86_64
            os: windows-latest
            target: x86_64-pc-windows-msvc
            rust: stable
            cross_compile: false
          - name: macOS-x86_64
            os: macos-latest
            target: x86_64-apple-darwin
            rust: stable
            cross_compile: false
          # Cross-compilation targets - build verification only
          - name: Linux-ARM64
            os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            rust: stable
            cross_compile: true
          - name: Linux-musl
            os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            rust: stable
            cross_compile: false
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # Install system dependencies for cross-compilation
      - name: Install cross-compilation dependencies
        if: matrix.platform.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu

      # Install musl tools for musl target
      - name: Install musl tools
        if: matrix.platform.target == 'x86_64-unknown-linux-musl'
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

      # For native compilation: run both build and test
      # For cross-compilation: only build (can't run tests on different architecture)
      - name: Run tests and build (native)
        if: matrix.platform.cross_compile == false
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: both
          target: ${{ matrix.platform.target }}
          toolchain: ${{ matrix.platform.rust }}
          args: "--locked --all-features"
          use-rust-cache: true

      - name: Build only (cross-compilation)
        if: matrix.platform.cross_compile == true
        uses: houseabsolute/actions-rust-cross@v1
        with:
          command: build
          target: ${{ matrix.platform.target }}
          toolchain: ${{ matrix.platform.rust }}
          args: "--locked --all-features"
          use-rust-cache: true

  # Build verification for key platforms only (not all targets)
  # This ensures the code compiles but doesn't upload artifacts
  # Each platform builds its native target to avoid cross-compilation issues
  build-check:
    name: Build Check
    strategy:
      matrix:
        include:
          # Native builds only - no cross-compilation
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: macos-latest
            target: x86_64-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-msvc
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-build-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-build-
            ${{ runner.os }}-cargo-

      - name: Build verification (native target)
        run: cargo build --release

      # No artifact upload - this is just verification

  # Security audit using rustsec database
  security_audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run security audit
        uses: rustsec/audit-check@v2.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  # Check minimum supported Rust version
  msrv:
    name: MSRV
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-msrv-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-msrv-
            ${{ runner.os }}-cargo-

      - name: Check MSRV
        run: cargo check --all-features

  # Validate release-plz configuration (PR only)
  release_plz_config_check:
    name: Release-plz Config Validation
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          # For PR events, checkout the PR head commit (supports fork PRs)
          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}

      - name: Debug PR information
        run: |
          echo "🔍 Debugging PR and checkout information..."
          echo "Event name: ${{ github.event_name }}"
          echo "Repository: ${{ github.repository }}"
          echo "Head ref: ${{ github.head_ref }}"
          echo "Base ref: ${{ github.base_ref }}"
          echo "PR number: ${{ github.event.number }}"
          echo "PR head SHA: ${{ github.event.pull_request.head.sha }}"
          echo "PR head ref: ${{ github.event.pull_request.head.ref }}"
          echo "PR head repo: ${{ github.event.pull_request.head.repo.full_name }}"
          echo "PR base repo: ${{ github.event.pull_request.base.repo.full_name }}"
          echo "Current SHA: ${{ github.sha }}"
          echo ""
          echo "📁 Current working directory contents:"
          ls -la
          echo ""
          echo "🌿 Git branch information:"
          git branch -a || echo "Git branch command failed"
          echo ""
          echo "📝 Git log (last 3 commits):"
          git log --oneline -3 || echo "Git log command failed"

      - name: Validate GitHub Token
        run: |
          echo "🔐 Validating GitHub Token configuration..."
          echo ""
          # Check if RELEASE_PLZ_TOKEN is available (we can't access the actual value for security)
          if [ -n "${{ secrets.RELEASE_PLZ_TOKEN }}" ]; then
            echo "✅ RELEASE_PLZ_TOKEN is configured"
            TOKEN_SOURCE="RELEASE_PLZ_TOKEN"
          else
            echo "⚠️ RELEASE_PLZ_TOKEN not found, will use GITHUB_TOKEN"
            TOKEN_SOURCE="GITHUB_TOKEN"
          fi

          # Test token format validation logic (using GITHUB_TOKEN as it's always available)
          TEST_TOKEN="${{ secrets.GITHUB_TOKEN }}"
          # Basic token format validation
          if [[ "$TEST_TOKEN" =~ ^(ghp_|gho_|ghu_|ghs_|ghr_|github_pat_) ]]; then
            echo "✅ Token format validation logic works correctly"
          else
            echo "❌ Token format validation failed - this may indicate an issue"
            exit 1
          fi

          # Test API connectivity with GITHUB_TOKEN
          echo "🌐 Testing GitHub API connectivity..."
          curl -s -H "Authorization: Bearer $TEST_TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            https://api.github.com/user > /dev/null || {
            echo "❌ GitHub API connectivity test failed"
            exit 1
          }
          echo "✅ GitHub API connectivity test passed"
          echo "🎯 Token validation will use: $TOKEN_SOURCE"

      - name: Validate release-plz configuration file
        run: |
          echo "🔧 Validating release-plz configuration..."
          echo ""
          # Check if config file exists
          if [ -f "release-plz.toml" ]; then
            echo "✅ release-plz.toml found"
          else
            echo "❌ release-plz.toml not found"
            exit 1
          fi

          # Validate TOML syntax
          echo "🧪 Checking TOML syntax..."
          if command -v toml-cli &> /dev/null; then
            toml-cli get release-plz.toml . > /dev/null || {
              echo "❌ Invalid TOML syntax in release-plz.toml"
              exit 1
            }
          else
            # Basic syntax check using Python (available in GitHub runners)
            python3 -c "
          import tomllib
          try:
              with open('release-plz.toml', 'rb') as f:
                  tomllib.load(f)
              print('✅ TOML syntax is valid')
          except Exception as e:
              print(f'❌ TOML syntax error: {e}')
              exit(1)
          " || exit 1
          fi

          echo ""
          echo "✅ Release-plz configuration validation completed!"
          echo "📝 Configuration file exists and has valid TOML syntax."
          echo "🎯 The workflow should work correctly when merged to main."

  # Simulate publishing to catch dependency issues early
  publish_simulation:
    name: Publish Simulation
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-publish-sim-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-publish-sim-
            ${{ runner.os }}-cargo-

      - name: Simulate package publishing
        run: |
          echo "🚀 Simulating package publishing to detect dependency issues..."
          echo ""

          # Test packaging for key crates that have external dependencies
          # Note: vx-cli temporarily excluded due to vx-paths dependency (new crate not yet published)
          CRATES_TO_TEST=(
            "vx-tool-standard"
            "vx-tool-node"
            "vx-tool-go"
            "vx-tool-rust"
            "vx-tool-uv"
            "vx"
          )

          for crate in "${CRATES_TO_TEST[@]}"; do
            echo "📦 Testing package: $crate"
            if cargo package -p "$crate" --allow-dirty --no-verify; then
              echo "✅ $crate packages successfully"
            else
              echo "❌ $crate packaging failed"
              exit 1
            fi
            echo ""
          done

          echo "🎉 All packages can be built for publishing!"
          echo "💡 This ensures dependencies are correctly specified for crates.io"

  # Code coverage reporting (only on PR)
  coverage:
    name: Code Coverage
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov

      - name: Cache Rust dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-coverage-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-coverage-
            ${{ runner.os }}-cargo-

      - name: Generate code coverage
        run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          fail_ci_if_error: false  # 只显示不失败
          verbose: true
          flags: unittests
          name: codecov-umbrella