ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - master
  merge_group:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"
  CARGO_PROFILE_TEST_DEBUG: "0"

jobs:
  rust-format:
    name: Rust format
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        run: |
          set -euo pipefail
          toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
          rustup toolchain install "$toolchain" --profile minimal --component rustfmt
          rustup default "$toolchain"
          rustc --version
          cargo --version

      - name: Check formatting
        run: cargo fmt --all --check

      - name: Naming gate (retired legacy tokens)
        run: ./scripts/check_legacy_naming.sh

  rust-check:
    name: Rust check
    runs-on: ubuntu-latest
    timeout-minutes: 45

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        run: |
          set -euo pipefail
          toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
          rustup toolchain install "$toolchain" --profile minimal
          rustup default "$toolchain"
          rustc --version
          cargo --version

      - name: Cache Cargo artifacts
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Check workspace
        run: RUSTFLAGS='-D warnings' cargo check --workspace --all-targets --locked

      - name: Check all features
        run: RUSTFLAGS='-D warnings' cargo check --workspace --all-targets --all-features --locked

  rust-clippy:
    name: Rust clippy
    runs-on: ubuntu-latest
    timeout-minutes: 45

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        run: |
          set -euo pipefail
          toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
          rustup toolchain install "$toolchain" --profile minimal --component clippy
          rustup default "$toolchain"
          rustc --version
          cargo --version

      - name: Cache Cargo artifacts
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Run clippy
        run: cargo clippy --workspace --all-targets --locked -- -D warnings

      - name: Run clippy with all features
        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings

  rust-test:
    name: Rust tests (${{ matrix.partition }}/4)
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        partition: [1, 2, 3, 4]

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        run: |
          set -euo pipefail
          toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
          rustup toolchain install "$toolchain" --profile minimal
          rustup default "$toolchain"
          rustc --version
          cargo --version

      - name: Install cargo-nextest
        uses: taiki-e/install-action@b18fb392e1a1b90971f7c7572c92790fa54f23d5 # nextest

      - name: Cache Cargo artifacts
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Run workspace tests
        # The subprocess-heavy `wn-cli::cli` suite runs in its own
        # `cli-e2e` job so its fan-out never starves these fast unit tests
        # (issue #103). `relay_runtime` keeps its own serial job.
        run: cargo nextest run --workspace --exclude cgka-conformance-simulator --locked --profile ci --partition count:${{ matrix.partition }}/4 -E 'not (package(marmot-app) & binary(relay_runtime)) and not (package(wn-cli) & binary(cli))'

      - name: Run doctests
        if: matrix.partition == 1
        run: cargo test --workspace --exclude cgka-conformance-simulator --doc --locked

  cli-e2e:
    name: CLI e2e (mock relay)
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        run: |
          set -euo pipefail
          toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
          rustup toolchain install "$toolchain" --profile minimal
          rustup default "$toolchain"
          rustc --version
          cargo --version

      - name: Install cargo-nextest
        uses: taiki-e/install-action@b18fb392e1a1b90971f7c7572c92790fa54f23d5 # nextest

      - name: Cache Cargo artifacts
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Run CLI end-to-end tests
        # Dedicated job: this subprocess-heavy suite is capped by the `cli-e2e`
        # test-group and the `ci` profile adds retries + a hung-test backstop.
        # The real-relay test self-skips here; it has its own `Relay CLI E2E`
        # job with a docker relay stack.
        run: cargo nextest run -p wn-cli --test cli --locked --profile ci

  relay-runtime:
    name: Relay runtime tests
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        run: |
          set -euo pipefail
          toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
          rustup toolchain install "$toolchain" --profile minimal
          rustup default "$toolchain"
          rustc --version
          cargo --version

      - name: Cache Cargo artifacts
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Run relay runtime tests serially
        run: cargo test -p marmot-app --test relay_runtime --locked -- --test-threads=1

  relay-e2e:
    name: Relay CLI E2E
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        run: |
          set -euo pipefail
          toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
          rustup toolchain install "$toolchain" --profile minimal
          rustup default "$toolchain"
          rustc --version
          cargo --version

      - name: Install cargo-nextest
        uses: taiki-e/install-action@b18fb392e1a1b90971f7c7572c92790fa54f23d5 # nextest

      - name: Cache Cargo artifacts
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Start local relay stack
        run: docker compose up -d setup nostr-rs-relay strfry-nostr-relay

      - name: Wait for local relays
        run: |
          docker compose ps
          ./scripts/wait_for_relays.sh

      - name: Run real relay CLI E2E
        env:
          MDK_E2E_REQUIRE_RELAYS: "1"
        run: cargo nextest run -p wn-cli --test cli --locked --profile ci -E 'test(=real_local_relays_deliver_cli_messages_over_sdk_path)'

      - name: Dump local relay logs
        if: failure()
        run: docker compose logs nostr-rs-relay strfry-nostr-relay || true

      - name: Stop local relay stack
        if: always()
        run: docker compose down -v

  conformance:
    name: Simulator and vectors
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        run: |
          set -euo pipefail
          toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
          rustup toolchain install "$toolchain" --profile minimal
          rustup default "$toolchain"
          rustc --version
          cargo --version

      - name: Install cargo-nextest
        uses: taiki-e/install-action@b18fb392e1a1b90971f7c7572c92790fa54f23d5 # nextest

      - name: Cache Cargo artifacts
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Run simulator tests
        run: cargo nextest run -p cgka-conformance-simulator --locked --profile ci

      - name: Run simulator doctests
        run: cargo test -p cgka-conformance-simulator --doc --locked

      - name: Run vector report
        run: |
          cargo run -p cgka-conformance-simulator --bin cgka-conformance-simulator-report --locked -- \
            --vectors crates/cgka-conformance-simulator/vectors \
            --out target/cgka-conformance-simulator-reports \
            --strict-oracle

      - name: Upload vector report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: cgka-conformance-simulator-reports
          path: target/cgka-conformance-simulator-reports
          if-no-files-found: error

  formal:
    name: Tamarin proofs
    runs-on: ubuntu-latest
    timeout-minutes: 45

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install Tamarin dependencies
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends graphviz maude

      - name: Install Tamarin
        env:
          TAMARIN_VERSION: 1.12.0
        run: |
          set -euo pipefail
          curl -L --fail --show-error --silent \
            "https://github.com/tamarin-prover/tamarin-prover/releases/download/${TAMARIN_VERSION}/tamarin-prover-${TAMARIN_VERSION}-linux64-ubuntu.tar.gz" \
            -o /tmp/tamarin-prover.tar.gz
          tar -xzf /tmp/tamarin-prover.tar.gz -C /tmp
          sudo install -m 0755 /tmp/tamarin-prover /usr/local/bin/tamarin-prover
          tamarin-prover --version

      - name: Run Tamarin proofs
        run: make -C formal/tamarin prove