.github/workflows/ci.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

permissions: {}

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Format
        run: cargo fmt --all -- --check

      - name: Clippy
        run: cargo clippy --workspace --all-targets --all-features -- -D warnings

  licenses:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      FORCE_COLOR: 1
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Hawkeye
        uses: taiki-e/install-action@26e9283f268b880168bdbd2c545dfcd60ec2c6ab # v2.87.13
        with:
          tool: hawkeye@7.0.0
      - name: Check license headers
        run: hawkeye check

  build:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
          - windows-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Build
        run: cargo build --workspace

  # Keep the facade wasm build focused on services with supported wasm signing paths.
  build_under_wasm:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Build
        working-directory: reqsign
        run: |
          rustup target add wasm32-unknown-unknown
          cargo build --target wasm32-unknown-unknown --no-default-features --features=aws,aws-v4a,azure,aliyun,tencent

  # Keep wasm compatibility checks focused on core traits and supported reqsign feature sets.
  wasm_compat:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Check
        run: |
          rustup target add wasm32-unknown-unknown
          cargo check -p reqsign-core --target wasm32-unknown-unknown
          cargo check -p reqsign-aws-core --target wasm32-unknown-unknown
          cargo check -p reqsign-aws-v4a --target wasm32-unknown-unknown
          cargo build --manifest-path reqsign/Cargo.toml --target wasm32-unknown-unknown --no-default-features --features=aws,aws-v4a,azure,aliyun,tencent
          cargo build --manifest-path reqsign/Cargo.toml --target wasm32-unknown-unknown --no-default-features --features=default-context,aws,aws-v4a,azure,aliyun,tencent

  unit:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Test
        run: cargo test --no-fail-fast
        env:
          RUST_LOG: DEBUG
          RUST_BACKTRACE: full
      - name: Doc Test
        run: cargo +nightly test --doc --all-features --workspace
        env:
          RUSTDOCFLAGS: --cfg docsrs
          RUST_LOG: DEBUG
          RUST_BACKTRACE: full

  wasm_tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install wasm-bindgen-cli
        run: |
          WASM_BINDGEN_VERSION=$(
            cargo metadata --format-version 1 --filter-platform wasm32-unknown-unknown \
              | jq -r '.packages[] | select(.name=="wasm-bindgen") | .version' \
              | sort -V \
              | tail -n 1
          )
          if [ -z "${WASM_BINDGEN_VERSION}" ]; then
            echo "failed to resolve wasm-bindgen version"
            exit 1
          fi
          echo "wasm-bindgen version: ${WASM_BINDGEN_VERSION}"
          cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked
      - name: Run wasm tests
        env:
          CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER: wasm-bindgen-test-runner
        run: |
          rustup target add wasm32-unknown-unknown
          cargo test --target wasm32-unknown-unknown -p reqsign-http-send-reqwest --test wasm