ci.yml

name: CI Check
on:
  merge_group:
  pull_request:
  push:
    branches:
      - main
env:
  # Use the same ssh-agent socket value across all jobs
  # Useful when a GH action is using SSH behind-the-scenes
  SSH_AUTH_SOCK: /tmp/ssh_agent.sock
  CARGO_TERM_COLOR: always
  # Disable incremental compilation.
  #
  # Incremental compilation is useful as part of an edit-build-test-edit cycle,
  # as it lets the compiler avoid recompiling code that hasn't changed. However,
  # on CI, we're not making small edits; we're almost always building the entire
  # project from scratch. Thus, incremental compilation on CI actually
  # introduces *additional* overhead to support making future builds
  # faster...but no future builds will ever occur in any given CI environment.
  #
  # See https://matklad.github.io/2021/09/04/fast-rust-builds.html#ci-workflow
  # for details.
  CARGO_INCREMENTAL: 0
  # Allow more retries for network requests in cargo (downloading crates) and
  # rustup (installing toolchains). This should help to reduce flaky CI failures
  # from transient network timeouts or other issues.
  CARGO_NET_RETRY: 10
  RUSTUP_MAX_RETRIES: 10
  # Don't emit giant backtraces in the CI logs.
  RUST_BACKTRACE: short

# Jobs launched for a PR event cancel the ongoing one for the same workflow + PR,
# Only retries (of the same run) for a Push event cancel the prior one.
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true
  

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - feature: default
    steps:
      - name: Setup SSH passphrase
        env:
          SSH_PASSPHRASE: ${{secrets.CI_SSH_PASSPHRASE}}
          SSH_PRIVATE_KEY: ${{secrets.CI_KEY}}
        run: |
          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
          echo 'echo $SSH_PASSPHRASE' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
          echo "$SSH_PRIVATE_KEY" | tr -d '\r' | DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add - >/dev/null
          eval `ssh-agent -s`
      - uses: actions/checkout@v3
      - uses: actions-rs/toolchain@v1
      # use the more efficient nextest
      - uses: taiki-e/install-action@nextest
      - uses: Swatinem/rust-cache@v2
      - name: Build
        # This build will be reused by nextest,
        # and also checks (--all-targets) that benches don't bit-rot
        run: cargo build --release --all-targets --no-default-features
      - name: Test
        run: |
          cargo nextest run --release --workspace --no-default-features
      - name: Doctests # nextest does not support doc tests
        run: |
          cargo test --doc

  fmt:
    name: Rustfmt
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions-rs/toolchain@v1
      - uses: Swatinem/rust-cache@v2
      - run: rustup component add rustfmt
      - uses: actions-rs/cargo@v1
        with:
          command: fmt
          args: --all -- --check

  clippy:
    name: Clippy lint checks
    runs-on: ubuntu-latest
    steps:
      - name: Setup SSH passphrase
        env:
          SSH_PASSPHRASE: ${{secrets.CI_SSH_PASSPHRASE}}
          SSH_PRIVATE_KEY: ${{secrets.CI_KEY}}
        run: |
          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
          echo 'echo $SSH_PASSPHRASE' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
          echo "$SSH_PRIVATE_KEY" | tr -d '\r' | DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add - >/dev/null
          eval `ssh-agent -s`
      - uses: actions/checkout@v2
      - uses: actions-rs/toolchain@v1
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - name: Run clippy
        uses: actions-rs/cargo@v1
        with:
          command: clippy
          args: --all-targets --all-features -- -D warnings

  audit:
    name: Cargo deny checks (licenses, vulnerabilities, unused dependencies)
    runs-on: ubuntu-latest
    steps:
      - name: Setup SSH passphrase
        env:
          SSH_PASSPHRASE: ${{secrets.CI_SSH_PASSPHRASE}}
          SSH_PRIVATE_KEY: ${{secrets.CI_KEY}}
        run: |
          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
          echo 'echo $SSH_PASSPHRASE' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
          echo "$SSH_PRIVATE_KEY" | tr -d '\r' | DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add - >/dev/null
          eval `ssh-agent -s`
      - uses: actions/checkout@v2
      - uses: actions-rs/toolchain@v1
      - uses: Swatinem/rust-cache@v2
      - name: Run cargo deny
        run: |
          cargo install cargo-deny
          cargo deny check

  typos:
    name: Spell Check with Typos
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Use typos with config file
      uses: crate-ci/typos@master
      with: 
        config: .github/workflows/typos.toml