rust.yml

# Continuous integration for the Rust workspace.
#
# Runs on every push to main and every PR. Goals:
#   - catch broken builds before they land,
#   - keep formatting + lint clean across contributors,
#   - keep the unit test suite green at all times,
#   - catch regressions in the regtest end-to-end test against a
#     pinned `bitcoind` (PR-only — see the `regtest-e2e` job).

name: rust

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # Daily 04:17 UTC re-scan so a freshly-disclosed CVE in a transitive
  # dep can't sit unnoticed until the next push. The audit job is the
  # only consumer of this trigger — the build/test jobs only run on
  # actual code changes.
  schedule:
    - cron: "17 4 * * *"

permissions:
  contents: read

# Cancel older in-flight runs for the same ref so a force-push doesn't
# pile up queue depth.
concurrency:
  group: rust-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"
  RUST_BACKTRACE: short

jobs:
  fmt:
    name: cargo fmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: cargo clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - run: cargo clippy --workspace --all-targets -- -D warnings

  test:
    name: cargo test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - run: cargo test --workspace --locked

  regtest-e2e:
    name: regtest e2e
    runs-on: ubuntu-latest
    # PR-only: a merge into main has already run this on the PR check,
    # so re-running it on the merge-commit push is wasted minutes for
    # the same SHA. The schedule trigger doesn't need it either —
    # nightly is for the audit job.
    if: github.event_name == 'pull_request'
    env:
      # Pinned Bitcoin Core release. Bumping past 27.x requires
      # updating `crates/ghostkey-core/tests/regtest_e2e.rs` to use
      # descriptor wallets — Bitcoin Core 28.x removed the
      # `-deprecatedrpc=create_bdb` flag the test relies on.
      BITCOIND_VERSION: "27.2"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      # Cache the extracted bitcoind binary across runs. Download +
      # SHA256 verification + extraction is ~10 s on a cold runner; the
      # test itself is ~5 s. Caching the binary (not the data dir —
      # regtest needs a fresh chain every run) gets us closer to "this
      # job is dominated by the test, not the install."
      - name: Cache bitcoind binary
        id: bitcoind-cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ~/.local/bin/bitcoind
          key: bitcoind-${{ runner.os }}-${{ env.BITCOIND_VERSION }}

      # Trust model for the download: we trust the bitcoincore.org
      # release directory at install time. The SHA256SUMS file lives
      # in the same directory as the tarball, so a compromise of
      # bitcoincore.org compromises both. That is acceptable for CI
      # determinism. If we ever need stronger guarantees, the right
      # next step is to verify SHA256SUMS against an embedded GPG key
      # for one of the release-signing maintainers.
      - name: Download and install bitcoind
        if: steps.bitcoind-cache.outputs.cache-hit != 'true'
        run: |
          set -euo pipefail
          mkdir -p "$HOME/.local/bin"
          workdir="$(mktemp -d)"
          cd "$workdir"
          base="https://bitcoincore.org/bin/bitcoin-core-${BITCOIND_VERSION}"
          tarball="bitcoin-${BITCOIND_VERSION}-x86_64-linux-gnu.tar.gz"
          curl -fsSL --retry 3 -o "${tarball}" "${base}/${tarball}"
          curl -fsSL --retry 3 -o SHA256SUMS "${base}/SHA256SUMS"
          grep " ${tarball}\$" SHA256SUMS | sha256sum -c -
          tar -xf "${tarball}"
          install -m 0755 "bitcoin-${BITCOIND_VERSION}/bin/bitcoind" "$HOME/.local/bin/bitcoind"

      - name: Add bitcoind to PATH
        run: echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Show bitcoind version
        run: bitcoind --version | head -1

      - name: Run regtest end-to-end test
        run: cargo test -p ghostkey-core --test regtest_e2e -- --ignored --nocapture

  audit:
    name: cargo audit
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # We deliberately do NOT use dtolnay/rust-toolchain here, even
      # though the build/test/clippy/fmt jobs do. Two reasons:
      #   (a) The GitHub-hosted ubuntu-latest runner ships with a recent
      #       stable Rust + cargo pre-installed, which is plenty for
      #       running cargo-audit (audit doesn't compile our crates).
      #   (b) `dtolnay/rust-toolchain` pulls from codeload.github.com,
      #       which has had multiple outages serving its tarball during
      #       the past 48 hours. The audit job is the easiest one to
      #       harden against that infrastructure, so it stays online
      #       even when the rest of the workflow can't bootstrap.

      # taiki-e/install-action fetches a prebuilt cargo-audit binary
      # (~5 s) instead of `cargo install`-ing it from source (~90 s on
      # a cold runner). It's the standard fast path for cargo extensions
      # in CI.
      - name: Install cargo-audit
        uses: taiki-e/install-action@b6b84cf49ebfe0176417bdce007c624f0db37f20 # v2
        with:
          tool: cargo-audit

      # cargo-audit clones rustsec/advisory-db from GitHub on every run
      # (~50 MB). Cache it so the daily cron + every PR doesn't re-fetch
      # the whole repo. We bust the cache per run so each saved cache is
      # fresh; restore-keys falls back to the most recent prior cache,
      # and cargo-audit will `git pull` the DB to pick up advisories
      # disclosed since the cache was warmed.
      - name: Cache advisory database
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ~/.cargo/advisory-db
          key: cargo-advisory-db-${{ runner.os }}-${{ github.run_id }}
          restore-keys: cargo-advisory-db-${{ runner.os }}-

      # --deny warnings turns "unmaintained" and "yanked" notices into
      # hard failures, not just visual warnings. Any accepted advisory
      # belongs in `.cargo/audit.toml` with a documented justification,
      # not in a looser command flag. See "Triaging a cargo audit
      # failure" in CONTRIBUTING.md.
      - run: cargo audit --deny warnings