ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - master

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  rust:
    name: Rust (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30

    env:
      RUST_BACKTRACE: 1

    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            full_deps: true
            run_lints: true
          # Future expansion:
          # - os: windows-latest
          #   full_deps: false
          #   run_lints: false
          # - os: macos-latest
          #   full_deps: false
          #   run_lints: false

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Linux system dependencies
        if: matrix.full_deps
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            pkg-config \
            libegl1-mesa-dev \
            libgl1-mesa-dev \
            libssl-dev \
            libx11-dev \
            libxrandr-dev \
            libxi-dev \
            libxcursor-dev \
            libwayland-dev \
            libxkbcommon-dev

      # Uses rust-toolchain.toml automatically
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Rustfmt (check)
        if: matrix.run_lints
        run: cargo fmt --all -- --check

      - name: Clippy (deny warnings)
        if: matrix.run_lints
        run: cargo clippy --workspace --all-targets --locked -- -D warnings

      - name: Clippy (deny warnings, html5)
        if: matrix.run_lints
        run: cargo clippy --workspace --all-targets --features html5 --locked -- -D warnings

      - name: Clippy (deny warnings, html5 hardening/fuzz)
        if: matrix.run_lints
        run: cargo clippy --workspace --all-targets --features "html5 html5-fuzzing parser-conformance parser_invariants parser-failure-injection" --locked -- -D warnings

      - name: Build (debug, all targets)
        run: cargo build --workspace --all-targets --locked

      - name: Run tests (default HTML5 build)
        run: cargo test --workspace --lib --bins --tests --examples --locked

      - name: Run tests (explicit html5 feature lane)
        run: cargo test --workspace --lib --bins --tests --examples --features html5 --locked

      - name: Run canonical HTML parser conformance observations
        run: cargo test -p html --test html5_parser_conformance --features parser-conformance --locked

      - name: Run pinned external HTML parser subset
        run: make test-html5-external-fixtures

      - name: Run typed HTML parser fatal-failure lane
        run: make test-html5-parser-fatal-failures

      - name: Run HTML5 semantic DOM golden fixtures
        run: cargo test -p html --test html5_golden_tree_builder --features "html5 dom-snapshot parser-conformance" --locked

      - name: Run HTML5 patch-log golden fixtures
        run: cargo test -p html --test html5_golden_tree_builder_patches --features html5 --locked

      - name: Run HTML5 smoke corpus
        run: cargo test -p html --test html5_smoke_real_pages --features "html5 dom-snapshot" --locked

      - name: Run promoted rawtext/script regressions
        run: cargo test -p html --test html5_rawtext_script_regressions --features "html5 dom-snapshot parser_invariants" --locked

      - name: Run HTML5 pipeline regression snapshots
        run: cargo test -p html --test html5_pipeline_regressions --features "html5 html5-fuzzing dom-snapshot parser_invariants" --locked

      - name: Run WPT tree-builder slice
        run: cargo test -p html --test wpt_html5_tree_builder --features "html5 dom-snapshot" --locked

      - name: Build (debug, all targets, html5)
        run: cargo build --workspace --all-targets --features html5 --locked

      - name: Build (release)
        run: cargo build --workspace --release --locked

      - name: Build (release, html5)
        run: cargo build --workspace --release --features html5 --locked

      - name: Compile HTML5 Criterion benches
        run: cargo bench -p html --bench html_bench --features html5 --no-run --locked

      - name: Check generated HTML entities
        run: make html-entities-check

  html5_tokenizer_fuzz_smoke:
    name: HTML5 tokenizer fuzz smoke
    runs-on: ubuntu-latest
    timeout-minutes: 10

    env:
      RUST_BACKTRACE: 1
      HTML5_TOKENIZER_FUZZ_SMOKE_SEED: "1592653589"
      HTML5_TOKENIZER_FUZZ_SMOKE_RUNS: "128"
      HTML5_TOKENIZER_FUZZ_SMOKE_INPUT_TIMEOUT_SEC: "5"
      HTML5_TOKENIZER_FUZZ_SMOKE_WALL_TIMEOUT_SEC: "90"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Run deterministic tokenizer fuzz smoke
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          bash ./tools/ci/html5_tokenizer_fuzz_smoke.sh 2>&1 | tee ci_artifacts/html5_tokenizer_fuzz_smoke.log

      - name: Upload tokenizer fuzz smoke artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: html5-tokenizer-fuzz-smoke-${{ github.sha }}
          path: |
            ci_artifacts/html5_tokenizer_fuzz_smoke.log
            ci_artifacts/html5_tokenizer_fuzz_failure

  html5_tokenizer_script_data_fuzz_smoke:
    name: HTML5 tokenizer script-data fuzz smoke
    runs-on: ubuntu-latest
    timeout-minutes: 10

    env:
      RUST_BACKTRACE: 1
      HTML5_TOKENIZER_SCRIPT_DATA_FUZZ_SMOKE_SEED: "1123581321"
      HTML5_TOKENIZER_SCRIPT_DATA_FUZZ_SMOKE_RUNS: "128"
      HTML5_TOKENIZER_SCRIPT_DATA_FUZZ_SMOKE_INPUT_TIMEOUT_SEC: "5"
      HTML5_TOKENIZER_SCRIPT_DATA_FUZZ_SMOKE_WALL_TIMEOUT_SEC: "90"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Run deterministic script-data fuzz smoke
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          bash ./tools/ci/html5_tokenizer_script_data_fuzz_smoke.sh 2>&1 | tee ci_artifacts/html5_tokenizer_script_data_fuzz_smoke.log

      - name: Upload script-data fuzz smoke artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: html5-tokenizer-script-data-fuzz-smoke-${{ github.sha }}
          path: |
            ci_artifacts/html5_tokenizer_script_data_fuzz_smoke.log
            ci_artifacts/html5_tokenizer_script_data_fuzz_failure

  html5_tokenizer_rawtext_fuzz_smoke:
    name: HTML5 tokenizer rawtext fuzz smoke
    runs-on: ubuntu-latest
    timeout-minutes: 10

    env:
      RUST_BACKTRACE: 1
      HTML5_TOKENIZER_RAWTEXT_FUZZ_SMOKE_SEED: "2654435761"
      HTML5_TOKENIZER_RAWTEXT_FUZZ_SMOKE_RUNS: "128"
      HTML5_TOKENIZER_RAWTEXT_FUZZ_SMOKE_INPUT_TIMEOUT_SEC: "5"
      HTML5_TOKENIZER_RAWTEXT_FUZZ_SMOKE_WALL_TIMEOUT_SEC: "90"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Run deterministic rawtext fuzz smoke
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          bash ./tools/ci/html5_tokenizer_rawtext_fuzz_smoke.sh 2>&1 | tee ci_artifacts/html5_tokenizer_rawtext_fuzz_smoke.log

      - name: Upload rawtext fuzz smoke artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: html5-tokenizer-rawtext-fuzz-smoke-${{ github.sha }}
          path: |
            ci_artifacts/html5_tokenizer_rawtext_fuzz_smoke.log
            ci_artifacts/html5_tokenizer_rawtext_fuzz_failure

  html5_tokenizer_rcdata_fuzz_smoke:
    name: HTML5 tokenizer rcdata fuzz smoke
    runs-on: ubuntu-latest
    timeout-minutes: 10

    env:
      RUST_BACKTRACE: 1
      HTML5_TOKENIZER_RCDATA_FUZZ_SMOKE_SEED: "2246822519"
      HTML5_TOKENIZER_RCDATA_FUZZ_SMOKE_RUNS: "128"
      HTML5_TOKENIZER_RCDATA_FUZZ_SMOKE_INPUT_TIMEOUT_SEC: "5"
      HTML5_TOKENIZER_RCDATA_FUZZ_SMOKE_WALL_TIMEOUT_SEC: "90"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Run deterministic rcdata fuzz smoke
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          bash ./tools/ci/html5_tokenizer_rcdata_fuzz_smoke.sh 2>&1 | tee ci_artifacts/html5_tokenizer_rcdata_fuzz_smoke.log

      - name: Upload rcdata fuzz smoke artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: html5-tokenizer-rcdata-fuzz-smoke-${{ github.sha }}
          path: |
            ci_artifacts/html5_tokenizer_rcdata_fuzz_smoke.log
            ci_artifacts/html5_tokenizer_rcdata_fuzz_failure

  html5_tree_builder_token_fuzz_smoke:
    name: HTML5 tree-builder token fuzz smoke
    runs-on: ubuntu-latest
    timeout-minutes: 10

    env:
      RUST_BACKTRACE: 1
      HTML5_TREE_BUILDER_TOKEN_FUZZ_SMOKE_SEED: "3141592653"
      HTML5_TREE_BUILDER_TOKEN_FUZZ_SMOKE_RUNS: "128"
      HTML5_TREE_BUILDER_TOKEN_FUZZ_SMOKE_INPUT_TIMEOUT_SEC: "5"
      HTML5_TREE_BUILDER_TOKEN_FUZZ_SMOKE_WALL_TIMEOUT_SEC: "90"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Run deterministic tree-builder fuzz smoke
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          bash ./tools/ci/html5_tree_builder_tokens_fuzz_smoke.sh 2>&1 | tee ci_artifacts/html5_tree_builder_tokens_fuzz_smoke.log

      - name: Upload tree-builder fuzz smoke artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: html5-tree-builder-token-fuzz-smoke-${{ github.sha }}
          path: |
            ci_artifacts/html5_tree_builder_tokens_fuzz_smoke.log
            ci_artifacts/html5_tree_builder_token_fuzz_failure

  html5_pipeline_fuzz_smoke:
    name: HTML5 pipeline fuzz smoke
    runs-on: ubuntu-latest
    timeout-minutes: 10

    env:
      RUST_BACKTRACE: 1
      HTML5_PIPELINE_FUZZ_SMOKE_SEED: "1414213562"
      HTML5_PIPELINE_FUZZ_SMOKE_RUNS: "128"
      HTML5_PIPELINE_FUZZ_SMOKE_INPUT_TIMEOUT_SEC: "5"
      HTML5_PIPELINE_FUZZ_SMOKE_WALL_TIMEOUT_SEC: "90"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Run deterministic pipeline fuzz smoke
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          bash ./tools/ci/html5_pipeline_fuzz_smoke.sh 2>&1 | tee ci_artifacts/html5_pipeline_fuzz_smoke.log

      - name: Upload pipeline fuzz smoke artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: html5-pipeline-fuzz-smoke-${{ github.sha }}
          path: |
            ci_artifacts/html5_pipeline_fuzz_smoke.log
            ci_artifacts/html5_pipeline_fuzz_failure

  css_fuzz_regressions:
    name: CSS fuzz regressions
    runs-on: ubuntu-latest
    timeout-minutes: 10

    env:
      RUST_BACKTRACE: 1

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Replay promoted CSS fuzz regressions
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          cargo test -p css --features css-fuzzing --test css_fuzz_regressions --locked \
            2>&1 | tee ci_artifacts/css_fuzz_regressions.log

      - name: Upload CSS fuzz regression log on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: css-fuzz-regressions-${{ github.sha }}
          path: ci_artifacts/css_fuzz_regressions.log

  css_syntax_fuzz_smoke:
    name: CSS syntax fuzz smoke
    runs-on: ubuntu-latest
    timeout-minutes: 15

    env:
      RUST_BACKTRACE: 1
      CSS_TOKENIZER_FUZZ_SMOKE_SEED: "1873819023"
      CSS_TOKENIZER_FUZZ_SMOKE_RUNS: "128"
      CSS_TOKENIZER_FUZZ_SMOKE_INPUT_TIMEOUT_SEC: "5"
      CSS_TOKENIZER_FUZZ_SMOKE_WALL_TIMEOUT_SEC: "90"
      CSS_PARSER_FUZZ_SMOKE_SEED: "2718281828"
      CSS_PARSER_FUZZ_SMOKE_RUNS: "128"
      CSS_PARSER_FUZZ_SMOKE_INPUT_TIMEOUT_SEC: "5"
      CSS_PARSER_FUZZ_SMOKE_WALL_TIMEOUT_SEC: "90"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Run deterministic CSS tokenizer fuzz smoke
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          bash ./tools/ci/css_tokenizer_fuzz_smoke.sh 2>&1 | tee ci_artifacts/css_tokenizer_fuzz_smoke.log

      - name: Run deterministic CSS parser fuzz smoke
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          bash ./tools/ci/css_parser_fuzz_smoke.sh 2>&1 | tee ci_artifacts/css_parser_fuzz_smoke.log

      - name: Upload CSS syntax fuzz artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: css-syntax-fuzz-smoke-${{ github.sha }}
          path: |
            ci_artifacts/css_tokenizer_fuzz_smoke.log
            ci_artifacts/css_parser_fuzz_smoke.log
            ci_artifacts/css_tokenizer_fuzz_failure
            ci_artifacts/css_parser_fuzz_failure

  css_pipeline_fuzz_smoke:
    name: CSS pipeline fuzz smoke
    runs-on: ubuntu-latest
    timeout-minutes: 20

    env:
      RUST_BACKTRACE: 1
      CSS_SELECTOR_PARSER_FUZZ_SMOKE_SEED: "3141592653"
      CSS_SELECTOR_PARSER_FUZZ_SMOKE_RUNS: "128"
      CSS_SELECTOR_PARSER_FUZZ_SMOKE_INPUT_TIMEOUT_SEC: "5"
      CSS_SELECTOR_PARSER_FUZZ_SMOKE_WALL_TIMEOUT_SEC: "90"
      CSS_SELECTOR_MATCHING_FUZZ_SMOKE_SEED: "1618033988"
      CSS_SELECTOR_MATCHING_FUZZ_SMOKE_RUNS: "128"
      CSS_SELECTOR_MATCHING_FUZZ_SMOKE_INPUT_TIMEOUT_SEC: "5"
      CSS_SELECTOR_MATCHING_FUZZ_SMOKE_WALL_TIMEOUT_SEC: "90"
      CSS_CASCADE_FUZZ_SMOKE_SEED: "1414213562"
      CSS_CASCADE_FUZZ_SMOKE_RUNS: "128"
      CSS_CASCADE_FUZZ_SMOKE_INPUT_TIMEOUT_SEC: "5"
      CSS_CASCADE_FUZZ_SMOKE_WALL_TIMEOUT_SEC: "90"
      CSS_VALUES_FUZZ_SMOKE_SEED: "2449489742"
      CSS_VALUES_FUZZ_SMOKE_RUNS: "128"
      CSS_VALUES_FUZZ_SMOKE_INPUT_TIMEOUT_SEC: "5"
      CSS_VALUES_FUZZ_SMOKE_WALL_TIMEOUT_SEC: "90"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Run deterministic CSS selector parser fuzz smoke
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          bash ./tools/ci/css_selector_parser_fuzz_smoke.sh 2>&1 | tee ci_artifacts/css_selector_parser_fuzz_smoke.log

      - name: Run deterministic CSS selector matching fuzz smoke
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          bash ./tools/ci/css_selector_matching_fuzz_smoke.sh 2>&1 | tee ci_artifacts/css_selector_matching_fuzz_smoke.log

      - name: Run deterministic CSS cascade fuzz smoke
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          bash ./tools/ci/css_cascade_fuzz_smoke.sh 2>&1 | tee ci_artifacts/css_cascade_fuzz_smoke.log

      - name: Run deterministic CSS values fuzz smoke
        shell: bash
        run: |
          set -o pipefail
          mkdir -p ci_artifacts
          bash ./tools/ci/css_values_fuzz_smoke.sh 2>&1 | tee ci_artifacts/css_values_fuzz_smoke.log

      - name: Upload CSS pipeline fuzz artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: css-pipeline-fuzz-smoke-${{ github.sha }}
          path: |
            ci_artifacts/css_selector_parser_fuzz_smoke.log
            ci_artifacts/css_selector_matching_fuzz_smoke.log
            ci_artifacts/css_cascade_fuzz_smoke.log
            ci_artifacts/css_values_fuzz_smoke.log
            ci_artifacts/css_selector_parser_fuzz_failure
            ci_artifacts/css_selector_matching_fuzz_failure
            ci_artifacts/css_cascade_fuzz_failure
            ci_artifacts/css_values_fuzz_failure