yt-dlp 2.8.3

name: "🔌 Github CI - Development"

on:
  push:
    branches: [ develop, master ]
  pull_request:
    branches: [ develop, master ]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  scorecard-analysis:
    name: 🔍 Scorecard analysis
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      id-token: write
      pull-requests: read
      contents: read
      actions: read
      issues: read

    steps:
      - name: 🛡️ Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
          disable-telemetry: true

      - name: 📁 Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: 🔍 Scan with Scorecard
        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: true
          repo_token: ${{ secrets.GITHUB_TOKEN }}

      - name: 📦 Upload Scorecard scan results artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sarif-results
          path: results.sarif
          retention-days: 5

      - name: 📦 Upload Scorecard scan results to GitHub dashboard
        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          sarif_file: results.sarif

  fossa:
    name: 📜 FOSSA license scan
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: 🛡️ Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
          disable-telemetry: true

      - name: 📁 Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 📜 Run FOSSA scan
        uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0
        with:
          api-key: ${{ secrets.FOSSA_API_KEY }}

  sonarcloud-analysis:
    name: 🔍 SonarCloud analysis
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read

    steps:
      - name: 🛡️ Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
          disable-telemetry: true

      - name: 📁 Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: 🔍 Scan with SonarCloud
        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  dependency-review:
    name: 📦 Dependency review
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: 🛡️ Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
          disable-telemetry: true

      - name: 📁 Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 📦 Review dependencies
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

  check-spell:
    name: 📝 Check spelling
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: 🛡️ Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
          disable-telemetry: true

      - name: 📁 Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 📝 Check spelling
        uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0

  check-format:
    name: 💄 Check formatting
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: 🛡️ Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
          disable-telemetry: true

      - name: 📁 Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 🛠️ Set up nightly Rust (for rustfmt)
        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # nightly
        with:
          toolchain: nightly
          components: rustfmt

      - name: 💄 Check formatting
        run: cargo +nightly fmt --all -- --check

  build-and-test:
    name: 🦀 Build & Test
    runs-on: ubuntu-latest
    needs: [check-spell]
    env:
      CLICOLOR: 1
      SCCACHE_GHA_ENABLED: "true"
      RUSTC_WRAPPER: "sccache"
      REDIS_URL: redis://localhost:6379
    permissions:
      contents: read
    services:
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: 🛡️ Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
          disable-telemetry: true

      - name: 📁 Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 📦 Set up sccache
        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
        with:
          disable_annotations: true

      - name: 📦 Cache Rust registry
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          shared-key: "full"
          cache-targets: false

      - name: 📦 Restore compiled dependencies
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: target/
          key: target-full-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: target-full-${{ runner.os }}-

      - name: 🛠️ Set up Rust toolchain
        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
        with:
          components: clippy

      - name: 🦀 Check with Clippy
        run: cargo clippy --workspace --all-features -- -D warnings

      - name: 🧪 Run unit tests
        run: cargo test --test unit --all-features

      - name: 🔗 Run integration tests
        run: cargo test --test integration --all-features

  doc-tests:
    name: 📚 Test docs
    needs: [check-spell]
    runs-on: ubuntu-latest
    env:
      CLICOLOR: 1
      SCCACHE_GHA_ENABLED: "true"
      RUSTC_WRAPPER: "sccache"
    permissions:
      contents: read

    steps:
      - name: 🛡️ Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
          disable-telemetry: true

      - name: 📁 Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 📦 Set up sccache
        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
        with:
          disable_annotations: true

      - name: 📦 Cache Rust registry
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          shared-key: "full"
          cache-targets: false

      - name: 📦 Restore compiled dependencies
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: target/
          key: target-full-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: target-full-${{ runner.os }}-

      - name: 🛠️ Set up Rust toolchain
        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable

      - name: 📚 Run doc tests
        run: cargo test --doc --workspace --all-features

  e2e-tests:
    name: 🚀 E2E tests
    needs: [build-and-test, doc-tests]
    runs-on: ubuntu-latest
    env:
      CLICOLOR: 1
      SCCACHE_GHA_ENABLED: "true"
      RUSTC_WRAPPER: "sccache"
    permissions:
      contents: read

    steps:
      - name: 🛡️ Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
          disable-telemetry: true

      - name: 📁 Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 📦 Set up sccache
        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
        with:
          disable_annotations: true

      - name: 📦 Cache Rust registry
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          shared-key: "full"
          cache-targets: false

      - name: 📦 Restore compiled dependencies
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: target/
          key: target-full-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: target-full-${{ runner.os }}-

      - name: 🛠️ Set up Rust toolchain
        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable

      - name: 🛠️ Install ffmpeg from boul2gom/ffmpeg-builds
        run: |
          curl -fsSL "https://github.com/boul2gom/ffmpeg-builds/releases/latest/download/ffmpeg-linux-x64.zip" -o /tmp/ffmpeg.zip
          mkdir -p /opt/ffmpeg
          unzip -j /tmp/ffmpeg.zip ffmpeg -d /opt/ffmpeg
          chmod +x /opt/ffmpeg/ffmpeg
          rm /tmp/ffmpeg.zip
          echo "/opt/ffmpeg" >> $GITHUB_PATH

      - name: 🚀 Run E2E tests
        run: cargo test --test e2e --all-features -- --test-threads=1

  analysis:
    name: 🔍 Static analysis
    needs: [build-and-test]
    runs-on: ubuntu-latest
    env:
      CLICOLOR: 1
    permissions:
      contents: read

    steps:
      - name: 🛡️ Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
          disable-telemetry: true

      - name: 📁 Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 🛠️ Install cargo-deny
        uses: taiki-e/install-action@7fa572463ed6f88f64fd37a4f8ca146df751432d # cargo-deny

      - name: 🔐 Security, License and Dependency Audit
        run: cargo deny check

      - name: 🛠️ Install cargo-machete
        uses: taiki-e/install-action@6929d36b9cc9bd3c8a031f179ec7f72cffbfc6fa # cargo-machete

      - name: 🧹 Unused dependencies
        run: cargo machete

  coverage:
    name: 📊 Code coverage
    needs: [e2e-tests]
    runs-on: ubuntu-latest
    env:
      CLICOLOR: 1
      SCCACHE_GHA_ENABLED: "true"
      RUSTC_WRAPPER: "sccache"
    permissions:
      contents: read

    steps:
      - name: 🛡️ Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
          disable-telemetry: true

      - name: 📁 Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 📦 Set up sccache
        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
        with:
          disable_annotations: true

      - name: 📦 Cache Rust artifacts
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          shared-key: "coverage"
          cache-targets: false

      - name: 🛠️ Set up Rust toolchain
        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
        with:
          components: llvm-tools-preview

      - name: 📦 Install cargo-llvm-cov
        uses: taiki-e/install-action@c1305996457413b456b636a549d9f98354fd89cf # cargo-llvm-cov

      - name: 🛠️ Install ffmpeg from boul2gom/ffmpeg-builds
        run: |
          curl -fsSL "https://github.com/boul2gom/ffmpeg-builds/releases/latest/download/ffmpeg-linux-x64.zip" -o /tmp/ffmpeg.zip
          mkdir -p /opt/ffmpeg
          unzip -j /tmp/ffmpeg.zip ffmpeg -d /opt/ffmpeg
          chmod +x /opt/ffmpeg/ffmpeg
          rm /tmp/ffmpeg.zip
          echo "/opt/ffmpeg" >> $GITHUB_PATH

      - name: 📊 Generate coverage (unit + integration + e2e)
        run: |
          cargo llvm-cov clean --workspace
          cargo llvm-cov --no-report --test unit --all-features
          cargo llvm-cov --no-report --test integration --all-features
          cargo llvm-cov --no-report --test e2e --all-features -- --test-threads=1
          cargo llvm-cov report --lcov --output-path lcov.info

      - name: 📦 Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          fail_ci_if_error: false