ci.yml

# .github/workflows/ci.yml
# Continuous Integration: lint, test, audit, and build verification
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  RUST_LOG: debug

jobs:
  # Rust linting and formatting
  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly
        with:
          components: rustfmt, clippy

      - name: Cache cargo
        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Run clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

  # Rust unit tests
  test-rust:
    name: Rust Tests (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly

      - name: Cache cargo
        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2

      - name: Run tests
        run: cargo test --all-features --verbose -- --nocapture
        env:
          RUST_LOG: debug

      - name: Run doc tests
        run: cargo test --doc

      - name: Run Rust E2E tests with JSONL logging
        shell: bash
        run: |
          set -euo pipefail
          mapfile -t tests < <(git ls-files 'tests/e2e_*.rs' | sed 's#^tests/##; s#\\.rs$##')
          if [[ "${#tests[@]}" -eq 0 ]]; then
            echo "No e2e_* tests found; skipping."
            exit 0
          fi
          args=()
          for t in "${tests[@]}"; do
            args+=(--test "$t")
          done
          E2E_LOG=1 cargo test --all-features --verbose "${args[@]}" -- --nocapture

      - name: Validate E2E JSONL logs
        if: always()
        shell: bash
        run: |
          if [[ -d "test-results/e2e" ]] && ls test-results/e2e/*.jsonl 1>/dev/null 2>&1; then
            ./scripts/validate-e2e-jsonl.sh test-results/e2e/*.jsonl
          else
            echo "No E2E JSONL logs found to validate"
          fi

      - name: Upload E2E JSONL logs
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: e2e-jsonl-${{ matrix.os }}
          path: test-results/e2e/*.jsonl
          if-no-files-found: ignore
          retention-days: 14

  e2e-orchestrated:
    name: E2E Orchestrator (Rust + Shell)
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly

      - name: Cache cargo
        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2

      - name: Run orchestrated E2E runner (Rust + Shell)
        shell: bash
        run: |
          set -euo pipefail
          RUN_PLAYWRIGHT=0 E2E_LOG=1 ./scripts/tests/run_all.sh

      - name: Validate E2E JSONL logs
        if: always()
        shell: bash
        run: |
          if [[ -d "test-results/e2e" ]] && ls test-results/e2e/*.jsonl 1>/dev/null 2>&1; then
            ./scripts/validate-e2e-jsonl.sh test-results/e2e/*.jsonl
          else
            echo "No E2E JSONL logs found to validate"
          fi

      - name: Show E2E summary
        if: always()
        shell: bash
        run: |
          if [[ -f "test-results/e2e/summary.md" ]]; then
            cat test-results/e2e/summary.md
          else
            echo "No summary.md found"
          fi

      - name: Upload orchestrated E2E logs
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: e2e-orchestrated-logs
          path: |
            test-results/e2e/combined.jsonl
            test-results/e2e/summary.md
            test-results/e2e/*.jsonl
          if-no-files-found: ignore
          retention-days: 14

  # Crypto test vectors
  crypto-vectors:
    name: Crypto Test Vectors
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly

      - name: Cache cargo
        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2

      - name: Run crypto vector tests
        run: cargo test --test crypto_vectors -- --nocapture
        env:
          RUST_LOG: debug

  # Security audit
  security:
    name: Security Audit
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly

      - name: Cache cargo
        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2

      - name: Install cargo-audit
        uses: taiki-e/install-action@878643b9fbcb563eeb35c8d9abe2ea9c84cb55bb # cargo-audit

      - name: Run cargo audit
        run: cargo audit

  # Build artifacts (verification only, not for release)
  build:
    name: Build (${{ matrix.target }})
    needs: [lint, test-rust, crypto-vectors, security]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: macos-15-intel
            target: x86_64-apple-darwin
          - os: macos-14
            target: aarch64-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-msvc
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly
        with:
          targets: ${{ matrix.target }}

      - name: Cache cargo
        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2

      - name: Build release
        run: cargo build --release --target ${{ matrix.target }}

      - name: Upload artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: cass-${{ matrix.target }}
          path: target/${{ matrix.target }}/release/cass*

  e2e-log-summary:
    name: E2E Log Summary
    needs: [test-rust]
    runs-on: ubuntu-latest
    if: always()
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Download E2E log artifacts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
        continue-on-error: true
        with:
          pattern: 'e2e-jsonl-*'
          path: artifacts
          merge-multiple: true

      - name: Aggregate E2E JSONL logs
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p artifacts test-results/e2e
          find artifacts -type f -name "*.jsonl" -print0 | sort -z | xargs -0 cat > test-results/e2e/combined.jsonl || true

      - name: Generate E2E summary report
        shell: bash
        run: |
          set -euo pipefail
          python3 - <<'PY'
          import json
          from datetime import datetime, timezone
          from pathlib import Path

          combined_path = Path("test-results/e2e/combined.jsonl")
          summary_path = Path("test-results/e2e/summary.md")
          summary_path.parent.mkdir(parents=True, exist_ok=True)

          total = passed = failed = skipped = flaky = 0
          durations = {}
          failures = []

          if combined_path.exists():
            for line in combined_path.read_text(encoding="utf-8").splitlines():
              line = line.strip()
              if not line:
                continue
              try:
                event = json.loads(line)
              except json.JSONDecodeError:
                continue

              if event.get("event") != "test_end":
                continue

              runner = event.get("runner", "unknown")
              result = event.get("result", {})
              status = result.get("status", "unknown")
              duration_ms = result.get("duration_ms", 0)
              durations[runner] = durations.get(runner, 0) + int(duration_ms or 0)
              total += 1

              if status == "pass":
                passed += 1
              elif status == "skip":
                skipped += 1
              else:
                failed += 1

              retries = result.get("retries")
              if status == "pass" and retries and int(retries) > 0:
                flaky += 1

              if status == "fail":
                test = event.get("test", {})
                error = event.get("error", {})
                failures.append({
                  "runner": runner,
                  "suite": test.get("suite", "unknown"),
                  "name": test.get("name", "unknown"),
                  "file": test.get("file"),
                  "line": test.get("line"),
                  "message": error.get("message", "unknown error"),
                })

          now = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S UTC")
          lines = [
            "# E2E Log Summary (CI)",
            "",
            f"**Generated:** {now}",
            f"**Combined Log:** {combined_path.as_posix()}",
            "",
            "## Totals",
            "",
            f"- **Total Tests:** {total}",
            f"- **Passed:** {passed}",
            f"- **Failed:** {failed}",
            f"- **Skipped:** {skipped}",
            f"- **Flaky (passed on retry):** {flaky}",
            "",
            "## Duration by Runner",
            "",
            "| Runner | Duration (ms) |",
            "|--------|---------------|",
          ]

          if durations:
            for runner, duration in sorted(durations.items()):
              lines.append(f"| {runner} | {duration} |")
          else:
            lines.append("| (none) | 0 |")

          lines.append("")
          lines.append("## Failed Tests")
          lines.append("")

          if failures:
            for f in failures:
              location = ""
              if f.get("file"):
                if f.get("line"):
                  location = f"{f['file']}:{f['line']}"
                else:
                  location = f"{f['file']}"
              detail = f"{f['runner']} :: {f['suite']} :: {f['name']}"
              if location:
                detail += f" ({location})"
              detail += f" — {f['message']}"
              lines.append(f"- {detail}")
          else:
            lines.append("- None")

          summary_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
          print(f"Wrote {summary_path}")
          PY

      - name: Upload aggregated E2E logs
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: e2e-log-summary
          path: |
            test-results/e2e/combined.jsonl
            test-results/e2e/summary.md
          retention-days: 14
          if-no-files-found: ignore

      - name: Comment summary on PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
        with:
          script: |
            const fs = require('fs');
            const marker = '<!-- cass-e2e-summary -->';
            const rustStart = '<!-- cass-e2e-rust:start -->';
            const rustEnd = '<!-- cass-e2e-rust:end -->';
            let summary = fs.readFileSync('test-results/e2e/summary.md', 'utf8');

            if (summary.startsWith('# ')) {
              summary = summary.replace(/^#\s+.*$/m, '## Rust E2E Summary');
            } else if (!summary.startsWith('## ')) {
              summary = `## Rust E2E Summary\n\n${summary}`;
            }

            const rustSection = `${rustStart}\n${summary.trim()}\n${rustEnd}`;
            const { owner, repo } = context.repo;
            const issue_number = context.issue.number;

            const { data: comments } = await github.rest.issues.listComments({
              owner,
              repo,
              issue_number,
              per_page: 100,
            });

            const existing = comments.find(comment => comment.body.includes(marker));

            const upsertSection = (body, section) => {
              if (body.includes(rustStart) && body.includes(rustEnd)) {
                const regex = new RegExp(`${rustStart}[\\s\\S]*?${rustEnd}`, 'm');
                return body.replace(regex, section);
              }
              return `${body.trim()}\n\n${section}`;
            };

            let body = existing ? existing.body : marker;
            if (!body.includes(marker)) {
              body = `${marker}\n${body}`;
            }
            body = upsertSection(body, rustSection);

            if (existing) {
              await github.rest.issues.updateComment({
                owner,
                repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner,
                repo,
                issue_number,
                body,
              });
            }