check.yml

name: Check
on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  merge_group:
  schedule:
    - cron: "26 3 * * *" # 03:26 UTC
env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}
  cancel-in-progress: true

permissions:
  contents: read

defaults:
  run:
    shell: bash

jobs:
  toolchains:
    runs-on: ubuntu-latest
    outputs:
      toolchains: ${{ steps.toolchains.outputs.toolchains }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          sparse-checkout: Cargo.toml
      - id: toolchains
        run: |
          msrv="$(grep rust-version Cargo.toml | tr -d '"' | cut -f3 -d\ )"
          echo "toolchains=[\"$msrv\", \"stable\", \"nightly\"]" >> "$GITHUB_OUTPUT"

  check:
    needs: toolchains
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        rust-toolchain: ${{ fromJSON(needs.toolchains.outputs.toolchains) }}
        type: [debug]
        include:
          # Also do some release builds on the latest OS versions.
          - os: ubuntu-latest
            rust-toolchain: stable
            type: release
          - os: macos-latest
            rust-toolchain: stable
            type: release
          - os: windows-latest
            rust-toolchain: stable
            type: release
          # Also do some debug builds on the oldest OS versions.
          - os: ubuntu-20.04
            rust-toolchain: stable
            type: debug
          - os: macos-13
            rust-toolchain: stable
            type: debug
          - os: windows-2019
            rust-toolchain: stable
            type: debug
    env:
      BUILD_TYPE: ${{ matrix.type == 'release' && '--release' || '' }}
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: mozilla/neqo
          sparse-checkout: |
            .github/actions/rust
          path: neqo
      - uses: ./neqo/.github/actions/rust
        with:
          version: ${{ matrix.rust-toolchain }}
          components: ${{ matrix.rust-toolchain == 'nightly' && 'llvm-tools' || '' }} ${{ matrix.rust-toolchain == 'nightly' && 'rust-src' || '' }}
          tools: ${{ matrix.rust-toolchain == 'nightly' && 'cargo-llvm-cov, ' || '' }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Check
        run: |
          OPTIONS=(--all-targets)
          if [ "$BUILD_TYPE" ]; then
            OPTIONS+=("$BUILD_TYPE")
          fi
          cargo +${{ matrix.rust-toolchain }} check "${OPTIONS[@]}"

      - name: Run tests and determine coverage
        env:
          RUST_LOG: trace
        run: |
          OPTIONS=(--no-fail-fast)
          if [ "$BUILD_TYPE" ]; then
            OPTIONS+=("$BUILD_TYPE")
          fi
          if [ "${{ matrix.rust-toolchain }}" == "nightly" ] && [ "${{ matrix.type }}" == "debug" ] && [ "${{endsWith(matrix.os, '-latest') && 'latest' || '' }}" == "latest" ]; then
            cargo +${{ matrix.rust-toolchain }} llvm-cov test --mcdc --include-ffi "${OPTIONS[@]}" --codecov --output-path codecov.json
          else
            if [ "${{ startsWith(matrix.os, 'windows') && 'windows' || '' }}" == "windows" ]; then
              # The codegen_windows_bindings test only succeeds when run via llvm-cov?!
              OPTIONS+=(-- --skip codegen_windows_bindings)
            fi
            cargo +${{ matrix.rust-toolchain }} test "${OPTIONS[@]}"
          fi
          cargo +${{ matrix.rust-toolchain }} bench --no-run

      - uses: codecov/codecov-action@7f8b4b4bde536c465e797be725718b88c5d95e0e # v5.1.1
        with:
          files: lcov.info
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}
          verbose: true
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        if: matrix.type == 'debug' && matrix.rust-toolchain == 'nightly' && endsWith(matrix.os, '-latest')

      - name: Run tests with sanitizers
        if: (matrix.os == 'ubuntu-latest' || matrix.os == 'macos-latest') && matrix.rust-toolchain == 'nightly'
        env:
          RUST_LOG: trace
          ASAN_OPTIONS: detect_leaks=1:detect_stack_use_after_return=1
        run: |
          if [ "${{ matrix.os }}" = "ubuntu-latest" ]; then
            sudo apt-get install -y --no-install-recommends llvm
            TARGET="x86_64-unknown-linux-gnu"
            SANITIZERS="address thread leak memory"
          elif [ "${{ matrix.os }}" = "macos-latest" ]; then
            # llvm-symbolizer (as part of llvm) is installed by default on macOS runners
            TARGET="aarch64-apple-darwin"
            # no memory and leak sanitizer support yet
            SANITIZERS="address thread"
            # Suppress non-mtu leaks on macOS. TODO: Check occasionally if these are still needed.
            {
              echo "leak:dyld4::RuntimeState"
              echo "leak:fetchInitializingClassList"
              echo "leak:std::rt::lang_start_internal"
            } > suppressions.txt
            # shellcheck disable=SC2155
            export LSAN_OPTIONS="suppressions=$(pwd)/suppressions.txt"
          fi
          for sanitizer in $SANITIZERS; do
            echo "Running tests with $sanitizer sanitizer..."
            export RUSTFLAGS="-Z sanitizer=$sanitizer"
            export RUSTDOCFLAGS="$RUSTFLAGS"
            cargo +nightly test -Z build-std --target "$TARGET"
          done

  clippy:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: mozilla/neqo
          sparse-checkout: |
            .github/actions/rust
          path: neqo
      - uses: ./neqo/.github/actions/rust
        with:
          components: clippy
          tools: cargo-hack
          token: ${{ secrets.GITHUB_TOKEN }}

      - run: cargo hack clippy --all-targets --feature-powerset --exclude-features gecko -- -D warnings
      - run: cargo doc --workspace --no-deps --document-private-items
        env:
          RUSTDOCFLAGS: "--deny rustdoc::broken_intra_doc_links --deny warnings"

  machete:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: mozilla/neqo
          sparse-checkout: |
            .github/actions/rust
          path: neqo
      - uses: ./neqo/.github/actions/rust
        with:
          tools: cargo-machete
          token: ${{ secrets.GITHUB_TOKEN }}

        #  --with-metadata has false positives, see https://github.com/bnjbvr/cargo-machete/issues/127
      - run: cargo machete

  format:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: mozilla/neqo
          sparse-checkout: |
            .github/actions/rust
          path: neqo
      - uses: ./neqo/.github/actions/rust
        with:
          version: nightly
          components: rustfmt
          token: ${{ secrets.GITHUB_TOKEN }}

      - run: cargo fmt --all -- --check

  semver:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: mozilla/neqo
          sparse-checkout: |
            .github/actions/rust
          path: neqo
      - uses: ./neqo/.github/actions/rust
        with:
          tools: cargo-semver-checks
          token: ${{ secrets.GITHUB_TOKEN }}

      - run: cargo semver-checks --default-features

  readme:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: mozilla/neqo
          sparse-checkout: |
            .github/actions/rust
          path: neqo
      - uses: ./neqo/.github/actions/rust
        with:
          tools: cargo-readme
          token: ${{ secrets.GITHUB_TOKEN }}

      - run: |
          cargo readme -o /tmp/README.md
          diff -u README.md /tmp/README.md

  check-vm:
    strategy:
      fail-fast: false
      matrix:
        os: [freebsd, openbsd, netbsd, solaris]
    runs-on: ubuntu-latest
    env:
      RUST_LOG: trace

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: curl -o rustup.sh --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs

      - if: matrix.os == 'freebsd'
        uses: vmactions/freebsd-vm@debf37ca7b7fa40e19c542ef7ba30d6054a706a4
        with:
          usesh: true
          envs: "CARGO_TERM_COLOR RUST_BACKTRACE RUST_LOG GITHUB_ACTIONS"
          prepare: | # This executes as root
            set -e
            pkg install -y curl llvm
          run: | # This executes as user
            set -e
            sh rustup.sh --default-toolchain nightly --profile minimal --component clippy llvm-tools -y
            . "$HOME/.cargo/env"
            cargo check --all-targets
            cargo clippy -- -D warnings
            cargo install cargo-llvm-cov --locked
            cargo llvm-cov test --mcdc --include-ffi --no-fail-fast --codecov --output-path codecov.json
            cargo test --no-fail-fast --release
            rm -rf target # Don't sync this back to host

      - if: matrix.os == 'openbsd'
        uses: vmactions/openbsd-vm@0cfe06e734a0ea3a546fca7ebf200b984b94d58a
        with:
          usesh: true
          envs: "CARGO_TERM_COLOR RUST_BACKTRACE RUST_LOG GITHUB_ACTIONS"
          prepare: | # This executes as root
            set -e
            pkg_add rust rust-clippy llvm-16.0.6p30 # rustup doesn't support OpenBSD at all
          run: | # This executes as user
            set -e
            export LIBCLANG_PATH=/usr/local/llvm16/lib
            cargo check --all-targets
            cargo clippy -- -D warnings
            # FIXME: No profiler support in openbsd currently, error is:
            # > error[E0463]: can't find crate for `profiler_builtins`
            # > = note: the compiler may have been built without the profiler runtime
            # export LLVM_COV=/usr/local/llvm16/bin/llvm-cov
            # export LLVM_PROFDATA=/usr/local/llvm16/bin/llvm-profdata
            # cargo install cargo-llvm-cov --locked
            # cargo llvm-cov test --mcdc --include-ffi --no-fail-fast --codecov --output-path codecov.json
            cargo test --no-fail-fast # Remove this once profiler is supported
            cargo test --no-fail-fast --release
            rm -rf target # Don't sync this back to host

      - if: matrix.os == 'netbsd'
        uses: vmactions/netbsd-vm@7c9086fdb4cc1aa814cda6e305390c2b966551a9
        with:
          usesh: true
          envs: "CARGO_TERM_COLOR RUST_BACKTRACE RUST_LOG GITHUB_ACTIONS"
          prepare: | # This executes as root
            set -e
            /usr/sbin/pkg_add pkgin
            pkgin -y install curl clang
          run: | # This executes as user
            set -e
            sh rustup.sh --default-toolchain nightly --profile minimal --component clippy llvm-tools -y
            . "$HOME/.cargo/env"
            cargo check --all-targets
            cargo clippy -- -D warnings
            # FIXME: No profiler support in netbsd currently, error is:
            # > error[E0463]: can't find crate for `profiler_builtins`
            # > = note: the compiler may have been built without the profiler runtime
            # cargo install cargo-llvm-cov --locked
            # cargo llvm-cov test --mcdc --include-ffi --no-fail-fast --codecov --output-path codecov.json
            cargo test --no-fail-fast # Remove this once profiler is supported
            cargo test --no-fail-fast --release
            rm -rf target # Don't sync this back to host

      - if: matrix.os == 'solaris'
        uses: vmactions/solaris-vm@a89b9438868c70db27e41625f0a5de6ff5e90809
        with:
          release: "11.4-gcc"
          usesh: true
          envs: "CARGO_TERM_COLOR RUST_BACKTRACE RUST_LOG GITHUB_ACTIONS"
          prepare: | # This executes as root
            set -e
            pkg install clang-libs
          run: | # This executes as also as root on Solaris
            set -e
            source <(curl -s https://raw.githubusercontent.com/psumbera/solaris-rust/refs/heads/main/sh.rust-web-install) || true # This doesn't exit with zero on success
            export LIBCLANG_PATH="/usr/lib/amd64"
            cargo check --all-targets
            cargo clippy -- -D warnings
            # FIXME: No profiler support in openbsd currently, error is:
            # > error[E0463]: can't find crate for `profiler_builtins`
            # > = note: the compiler may have been built without the profiler runtime
            # cargo install cargo-llvm-cov --locked
            # cargo llvm-cov test --mcdc --include-ffi --no-fail-fast --codecov --output-path codecov.json
            cargo test --no-fail-fast # Remove this once profiler is supported
            cargo test --no-fail-fast --release
            rm -rf target # Don't sync this back to host

      - uses: codecov/codecov-action@7f8b4b4bde536c465e797be725718b88c5d95e0e # v5.1.1
        with:
          files: codecov.json
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}
          verbose: true
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  check-cargo-lock:
    name: Ensure `Cargo.lock` contains all required dependencies
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: mozilla/neqo
          sparse-checkout: |
            .github/actions/rust
          path: neqo
      - uses: ./neqo/.github/actions/rust
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
      - run: cargo update -w --locked