ci.yaml

# Generated by simit. Manual edits will be reported as ci=drift.
name: CI

on:
  push:
    branches:
      - "trunk"
    tags-ignore: ["**"]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow_ref }}-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.ref_type == 'tag' && github.ref || format('refs/heads/{0}', github.event.pull_request.head.ref || github.ref_name) }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-24.04
    env:
      NIX_CONFIG: "experimental-features = nix-command flakes"
      XDG_CACHE_HOME: "/tmp/.cache"
      CARGO_HOME: "/tmp/.cargo"
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Nix
        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes
            substituters = https://attic.candee.baby/canix https://cache.nixos.org
            trusted-public-keys = canix:lPzPzKrmYqW5Rxa5r0uQWvCqD3S5nx0h2eCy7XD5JM8= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=

      - name: Configure GitHub input transport
        run: |
          git config --global --add url.https://github.com/.insteadOf ssh://git@github.com/
          git config --global --add url.https://github.com/.insteadOf git@github.com:

      - name: Add cargo bin to PATH
        run: echo "$CARGO_HOME/bin" >> "$GITHUB_PATH"

      - name: Format check
        run: |
          # Expand formatter variables inside the Nix shell.
          # shellcheck disable=SC2016
          nix develop -c sh -c 'formatter_expr="let root = toString ./.; flake = builtins.getFlake (if builtins.pathExists ./.git then \"git+file://\" + root else root); in if flake ? formatter.\${builtins.currentSystem} then flake.formatter.\${builtins.currentSystem} else null"; formatter=$(nix eval --impure --raw --expr "let f = ($formatter_expr); in if f == null then \"\" else f.drvPath") || exit; if [ -n "$formatter" ]; then formatter_program=$(nix eval --impure --raw --expr "let f = ($formatter_expr); in f.meta.mainProgram or (f.pname or (builtins.parseDrvName f.name).name)") || exit; formatter_path=$(nix build --no-link --print-out-paths "$formatter^out") || exit; formatter_exe="$formatter_path/bin/$formatter_program"; if [ ! -x "$formatter_exe" ]; then echo "Declared flake formatter executable is missing: $formatter_exe" >&2; exit 1; fi; if [ "$formatter_program" = treefmt ]; then exec "$formatter_exe" --ci; fi; repository_root=$(git rev-parse --show-toplevel) || exit; index_tree=$(git -C "$repository_root" write-tree) || exit; snapshot_dir=$(mktemp -d "${TMPDIR:-/tmp}/simit-format.XXXXXXXX") || exit; trap "rm -rf -- \"\$snapshot_dir\"" 0; trap "exit 129" HUP; trap "exit 130" INT; trap "exit 143" TERM; snapshot_dir=$(cd "$snapshot_dir" && pwd -P) || exit; case "$snapshot_dir/" in "$repository_root/"*) echo "Formatter snapshot directory must be outside the repository" >&2; exit 1;; esac; snapshot_worktree() { GIT_INDEX_FILE="$snapshot_dir/index" git -C "$repository_root" read-tree "$index_tree" && GIT_INDEX_FILE="$snapshot_dir/index" git -C "$repository_root" add --all -- . && GIT_INDEX_FILE="$snapshot_dir/index" git -C "$repository_root" write-tree; }; before_tree=$(snapshot_worktree) || exit; "$formatter_exe" || exit; after_tree=$(snapshot_worktree) || exit; current_index=$(git -C "$repository_root" write-tree) || exit; if [ "$before_tree" != "$after_tree" ] || [ "$index_tree" != "$current_index" ]; then echo "Formatter modified repository content or staging" >&2; exit 1; fi; exit 0; fi; if command -v treefmt >/dev/null 2>&1; then exec treefmt --ci; else exec cargo fmt --all -- --check; fi'

      - name: Check flake
        run: nix flake check

      - name: Test
        run: nix develop -c cargo test --workspace

      - name: Test no default features
        run: nix develop -c cargo test --workspace --no-default-features

      - name: Check cargo-audit tool
        run: nix develop -c cargo-audit --version

      - name: Check cargo-deny tool
        run: nix develop -c cargo-deny --version

      - name: Fetch RustSec advisory database
        run: |
          db="${CARGO_HOME:-$HOME/.cargo}/advisory-db"
          rm -rf "$db"
          mkdir -p "$(dirname "$db")"
          git -c http.lowSpeedLimit=1024 -c http.lowSpeedTime=30 clone --depth 1 https://github.com/RustSec/advisory-db.git "$db"

      - name: Audit dependencies
        run: |
          db="${CARGO_HOME:-$HOME/.cargo}/advisory-db"
          nix develop -c cargo audit --db "$db" --no-fetch --stale

      - name: Deny dependency policy
        run: nix develop -c cargo deny check bans licenses sources

      - name: Clippy
        run: nix develop -c cargo clippy --workspace --all-targets -- --deny warnings

      - name: Clippy no default features
        run: nix develop -c cargo clippy --workspace --all-targets --no-default-features -- --deny warnings