rust.yml

name: Rust CI

# Path scoping lives in the `changes` job below, NOT in `on:`. A workflow that
# never starts because of a path filter never creates its check runs, and a
# required check that is never created sits "Expected — Waiting for status" on
# the PR forever: `mergeStateStatus` stays BLOCKED with nothing to click. That
# is exactly what happened to every cloud-only PR while these fourteen contexts
# were required and `paths-ignore: cloud/**` kept them from ever reporting.
#
# A job skipped by an `if:` condition is different: it *does* create a check
# run, concludes "skipped", and branch protection counts that as satisfied. So
# the workflow now always starts, decides once whether the Rust tree was
# touched, and lets every job skip itself when it wasn't.
on:
  push:
    branches: [main, master, develop]
  pull_request:
    branches: [main, master, develop]

# Cancel superseded runs on the same ref so hung/queued Windows jobs from
# already-pushed SHAs cannot starve the tip (observed 60+ min hangs with no
# job timeout during the macOS PR merge burst).
concurrency:
  group: rust-ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  # The `changes` job reads the PR's file list through the API rather than
  # cloning full history to diff it.
  pull-requests: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  # Decides once whether this change touches the Rust tree. Every job below
  # gates on it, so the fourteen required contexts always report — as real
  # results on a Rust change, as "skipped" (which branch protection accepts)
  # on a cloud-only or docs-only one.
  changes:
    name: Detect changed paths
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      rust: ${{ steps.filter.outputs.rust }}
    steps:
      - id: filter
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          # On push (post-merge) we do not try to be clever: run everything.
          # Only pull requests need accurate skipping, and only they are gated
          # by branch protection.
          if [ "${{ github.event_name }}" != "pull_request" ]; then
            echo "rust=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          files=$(gh api \
            "repos/${{ github.repository }}/pulls/${{ github.event.number }}/files" \
            --paginate --jq '.[].filename')

          # These are the paths Rust CI has no stake in — the same list that
          # used to live in `paths-ignore`. If every changed file matches one
          # of them, the Rust jobs skip. An empty or unreadable file list
          # falls through to "true", so the failure mode is running CI we did
          # not need rather than merging without it.
          IGNORED='^(cloud/|docs/|public/)|^\.github/workflows/cloud\.yml$|\.md$'

          if printf '%s\n' "$files" | grep -qvE "$IGNORED"; then
            echo "rust=true" >> "$GITHUB_OUTPUT"
          else
            echo "rust=false" >> "$GITHUB_OUTPUT"
          fi

  check:
    name: Check (${{ matrix.os }})
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result == 'failure' || needs.changes.outputs.rust == 'true') }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      # ubuntu compiles via the headless backend (the fastest signal and the
      # only job that exercises platform/headless.rs); it needs the GTK/webkit
      # system libraries before cargo runs.
      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libxdo-dev

      - name: Check Rust crate
        run: cargo check --manifest-path src-tauri/Cargo.toml --all-targets

  test:
    name: Test (${{ matrix.os }})
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result == 'failure' || needs.changes.outputs.rust == 'true') }}
    runs-on: ${{ matrix.os }}
    # Windows cold `cargo test` normally finishes well under this; without a
    # cap, a stuck runner holds the queue indefinitely.
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libxdo-dev

      - name: Run unit tests
        run: cargo test --manifest-path src-tauri/Cargo.toml

  clippy:
    name: Clippy (${{ matrix.os }})
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result == 'failure' || needs.changes.outputs.rust == 'true') }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libxdo-dev

      - name: Run clippy
        run: cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings

  fmt:
    name: Rustfmt
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result == 'failure' || needs.changes.outputs.rust == 'true') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: Check formatting
        run: cargo fmt --manifest-path src-tauri/Cargo.toml -- --check

  tauri-compile:
    name: Tauri compile smoke test (${{ matrix.os }})
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result == 'failure' || needs.changes.outputs.rust == 'true') }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      # cargo tauri build runs beforeBuildCommand (npm run build -> Vite),
      # so the frontend toolchain must be installed first.
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: npm

      - name: Install frontend dependencies
        run: npm ci

      - name: Install Tauri CLI
        run: cargo install tauri-cli --version "^2.0" --locked

      - name: Compile desktop app without packaging installers
        run: cargo tauri build --no-bundle

  experimental:
    name: Experimental (${{ matrix.job }})
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result == 'failure' || needs.changes.outputs.rust == 'true') }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        job: [check, test, clippy]
    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libxdo-dev g++ libstdc++-13-dev

      - name: Check (experimental)
        if: matrix.job == 'check'
        run: cargo check --manifest-path src-tauri/Cargo.toml --all-targets --features experimental

      - name: Run unit tests (experimental)
        if: matrix.job == 'test'
        env:
          CXX: g++
          CC: gcc
        run: cargo test --manifest-path src-tauri/Cargo.toml --features experimental

      - name: Run clippy (experimental)
        if: matrix.job == 'clippy'
        run: cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets --features experimental -- -D warnings

  version-consistency:
    name: Version consistency
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result == 'failure' || needs.changes.outputs.rust == 'true') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      # Source manifests must agree with each other; marketing files must agree
      # with each other on the *published* release, which may trail source.
      # Forcing README/site to carry the source version made CI demand we
      # advertise unreleased builds (the false claim #281 removed).
      - name: Check version alignment
        run: |
          SRC=$(grep '^version' src-tauri/Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          echo "Source version: $SRC"
          for f in src-tauri/Cargo.toml src-tauri/tauri.conf.json; do
            grep -q "$SRC" "$f" || { echo "Source version $SRC missing from $f"; exit 1; }
          done
          # public/index.html is the cloud-pivoted marketing site; it no longer
          # advertises a specific desktop release (the legacy download CTA was
          # deliberately dropped, see #396 and the site copy rewrite that
          # followed). README.md still names the published desktop tag as
          # historical reference. Only cross-check the two when the site
          # actually mentions a version — its absence is not drift to catch,
          # it's the current, intended state of a page that stopped talking
          # about desktop releases at all.
          REL=$(grep -oE 'v2\.[0-9]+\.[0-9]+' public/index.html | head -1)
          echo "Advertised release: ${REL:-<none>}"
          if [ -n "$REL" ]; then
            grep -q "$REL" README.md || { echo "Advertised release $REL missing from README.md"; exit 1; }
          fi

  frontend-contract:
    name: Frontend contract tests
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result == 'failure' || needs.changes.outputs.rust == 'true') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: '20'

      - name: Run compression-review contract tests
        run: node --test src/compression-review.test.mjs

  # The single required context for this workflow.
  #
  # Branch protection cannot depend on the matrix jobs directly. A matrix job
  # skipped by an `if:` condition reports its check run under the *unexpanded*
  # name — literally "Check (${{ matrix.os }})" — because the matrix never
  # expands for a job that does not run. So requiring "Check (ubuntu-latest)"
  # leaves it waiting forever on a cloud-only PR, which is the same deadlock
  # this workflow's `changes` job was introduced to fix, one level down.
  #
  # A non-matrix aggregator has a static name in every case. It reports failure
  # if any gated job failed, and success when they all skipped.
  rust-ci:
    name: Rust CI
    needs:
      - check
      - test
      - clippy
      - fmt
      - tauri-compile
      - version-consistency
      - frontend-contract
    # `always()` so this still reports when its dependencies skipped — the
    # entire point. Without it, a skipped dependency skips the aggregator too
    # and the required context never appears.
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      # GitHub expressions take single-quoted string literals only. An earlier
      # revision used join(needs.*.result, ",") with double quotes, which is a
      # workflow-file syntax error — the whole run fails to start, no jobs are
      # created, and the PR shows no Rust checks at all rather than a failure
      # pointing at this line.
      - name: Fail if any gated Rust job failed
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "::error::a gated Rust CI job failed or was cancelled"
          exit 1

      - name: Report
        run: echo "all gated Rust jobs passed or skipped"