quality.yml

name: Quality

# Reusable fmt/clippy/test/audit checks, called by ci.yml so every push and PR is
# gated on the exact toolchain the release build uses.
#
# All checks use build.sh's pinned enc-build devcontainer image, with rustc,
# clippy, rustfmt and cargo-audit pinned by the Nix flake lock, not the runner.
#
# One matrix entry per check runs them in parallel; add an entry for a new check.
# Each entry builds the image: a cold build realizes the whole Nix closure;
# a warm build restores it from the layer cache.

on:
  workflow_call:

permissions:
  contents: read

jobs:
  check:
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: fmt
            cmd: cargo fmt --all -- --check
            timeout: 20
          - name: clippy
            cmd: cargo clippy --workspace --all-targets --locked -- -D warnings
            timeout: 45
          - name: test
            cmd: cargo test --workspace --locked
            timeout: 45
          # cargo-audit comes from the image's closure, so its version moves with the
          # flake lock. --deny warnings fails the job on any advisory. It picks up
          # .cargo/audit.toml (the RUSTSEC ignore list) from the working directory,
          # the same file a local ./audit.sh run would read.
          - name: audit
            cmd: cargo audit --deny warnings
            timeout: 20
          # deny.toml: permissive licences only, crates.io only, no wildcard versions.
          # Advisories stay with cargo-audit above.
          - name: deny
            cmd: cargo deny --locked check licenses bans sources
            timeout: 20
    name: ${{ matrix.name }}
    runs-on: ubuntu-24.04
    timeout-minutes: ${{ matrix.timeout }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # Image layers are keyed on the whole devcontainer directory, so any change to the
      # Dockerfile or the flake lock builds fresh; restore-keys let a PR start from
      # main's cache. Replacing the cache keeps its size bounded: buildx writes a new
      # export rather than updating in place.
      - name: Cache toolchain image layers
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: /tmp/buildx-cache
          key: buildx-${{ hashFiles('.devcontainer/**') }}
          restore-keys: buildx-

      - name: Build toolchain image
        run: |
          set -euo pipefail
          # The default builder cannot export a cache; docker-container can.
          docker buildx create --name enc-ci --driver docker-container --use >/dev/null
          docker buildx build --load \
            --target enc-build -t enc-build \
            --cache-from type=local,src=/tmp/buildx-cache \
            --cache-to type=local,dest=/tmp/buildx-cache-new,mode=max \
            -f .devcontainer/Dockerfile .devcontainer
          rm -rf /tmp/buildx-cache
          mv /tmp/buildx-cache-new /tmp/buildx-cache

      # Cache registry downloads and build artifacts in the cargo home and target
      # directory used below. Per-check keys keep fast checks from overwriting
      # compilation caches with an empty target/.
      - name: Cache cargo home and target
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            target/.cargo-home/registry
            target/.cargo-home/git
            target/debug
          key: cargo-${{ matrix.name }}-${{ hashFiles('Cargo.lock', '.devcontainer/nix/flake.lock') }}
          restore-keys: cargo-${{ matrix.name }}-

      # --user is the runner's uid, overriding the image's unprivileged default, so the
      # checkout and everything written under target/ stays readable by later steps and by
      # the cache action. --init gives the container a PID 1 that reaps the git processes
      # the black-box tests spawn.
      - name: ${{ matrix.name }}
        run: |
          set -euo pipefail
          docker run --rm --init \
            --user "$(id -u):$(id -g)" \
            -e HOME=/tmp \
            -e CARGO_HOME=/work/target/.cargo-home \
            -v "$PWD":/work -w /work \
            enc-build \
            ${{ matrix.cmd }}