ci.yml

name: ci
permissions:
  contents: read
on:
  pull_request:
  push:
jobs:
  rustfmt:
    # Don't run duplicate `push` jobs for the repo owner's PRs.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

    runs-on: ubuntu-22.04

    steps:
      - uses: briansmith/actions-rs-toolchain@v1
        with:
          toolchain: stable
          profile: minimal
          components: rustfmt
      - uses: briansmith/actions-checkout@v2
        with:
          persist-credentials: false
      - run: cargo fmt --all -- --check

  clippy:
    # Don't run duplicate `push` jobs for the repo owner's PRs.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

    runs-on: ubuntu-22.04

    steps:
      - uses: briansmith/actions-rs-toolchain@v1
        with:
          toolchain: stable
          profile: minimal
          components: clippy

      - uses: briansmith/actions-checkout@v2
        with:
          persist-credentials: false

      - run: mk/clippy.sh

  audit:
    # Don't run duplicate `push` jobs for the repo owner's PRs.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

    runs-on: ubuntu-22.04

    steps:
      - uses: briansmith/actions-rs-toolchain@v1
        with:
          toolchain: stable
          profile: minimal

      - uses: briansmith/actions-cache@v2
        with:
          path: |
            ~/.cargo/bin/cargo-audit
            ~/.cargo/.crates.toml
            ~/.cargo/.crates2.json
          key: ${{ runner.os }}-v2-cargo-audit-0.17.4

      # With `--locked` `cargo install` complains about using yanked crates.
      - run: cargo install cargo-audit --vers "0.17.4"

      - uses: briansmith/actions-checkout@v2
        with:
          persist-credentials: false

      - run: cargo generate-lockfile

      - run: cargo audit --deny warnings

  deny:
    # Don't run duplicate `push` jobs for the repo owner's PRs.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

    runs-on: ubuntu-22.04

    steps:
      - uses: briansmith/actions-rs-toolchain@v1
        with:
          toolchain: stable
          profile: minimal

      - uses: briansmith/actions-cache@v2
        with:
          path: |
            ~/.cargo/bin/cargo-deny
            ~/.cargo/.crates.toml
            ~/.cargo/.crates2.json
          key: ${{ runner.os }}-v2-cargo-deny-locked-0.9.1

      - run: cargo install cargo-deny --locked --vers "0.9.1"

      - uses: briansmith/actions-checkout@v2
        with:
          persist-credentials: false

      - run: cargo deny check

  # Verify that documentation builds.
  rustdoc:
    # Don't run duplicate `push` jobs for the repo owner's PRs.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

    runs-on: ubuntu-22.04

    strategy:
      matrix:
        rust_channel:
          - stable
          - beta
          - nightly

        include:
          - target: x86_64-unknown-linux-gnu

    steps:
      - uses: briansmith/actions-rs-toolchain@v1
        with:
          override: true
          target: ${{ matrix.target }}
          toolchain: ${{ matrix.rust_channel }}

      - uses: briansmith/actions-checkout@v2
        with:
          persist-credentials: false

      - run: |
          cargo doc --all-features

  package:
    # Don't run duplicate `push` jobs for the repo owner's PRs.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

    runs-on: windows-latest

    steps:
      - uses: briansmith/actions-checkout@v2
        with:
          persist-credentials: false

      - run: ./mk/install-build-tools.ps1

      - uses: briansmith/actions-rs-toolchain@v1
        with:
          toolchain: stable
          profile: minimal

      - run: echo "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\Llvm\x64\bin" >> $GITHUB_PATH
        shell: bash

      - run: sh mk/package.sh
        shell: bash

  test:
    # Don't run duplicate `push` jobs for the repo owner's PRs.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

    runs-on: ${{ matrix.host_os }}

    strategy:
      matrix:
        # XXX: See `test-features` below.
        features:
          - # Default

        target:
          - aarch64-apple-ios
          - aarch64-apple-darwin
          - aarch64-linux-android
          - aarch64-pc-windows-msvc
          - aarch64-unknown-linux-gnu
          - aarch64-unknown-linux-musl
          - arm-unknown-linux-gnueabihf
          - armv7-linux-androideabi
          - armv7-unknown-linux-musleabihf
          - i686-pc-windows-msvc
          - i686-unknown-linux-gnu
          - i686-unknown-linux-musl
          - x86_64-pc-windows-gnu
          - x86_64-pc-windows-msvc
          - x86_64-apple-darwin
          - x86_64-unknown-linux-musl
          - x86_64-unknown-linux-gnu
          - s390x-unknown-linux-gnu

        mode:
          - # debug
          - --release

        rust_channel:
          - stable
          - nightly
          # Some benchmarking dependencies require 1.60.
          - 1.60.0 # MSRV
          - beta

        include:
          - target: aarch64-apple-darwin
            host_os: macos-12
            # GitHub Actions doesn't have a way to run this target yet.
            cargo_options: --no-run

          - target: aarch64-apple-ios
            host_os: macos-12
            # GitHub Actions doesn't have a way to run this target yet.
            cargo_options: --no-run

          - target: aarch64-linux-android
            host_os: ubuntu-22.04
            # TODO: https://github.com/briansmith/ring/issues/486
            cargo_options: --no-run

          - target: aarch64-pc-windows-msvc
            host_os: windows-latest
            # GitHub Actions doesn't have a way to run this target yet.
            cargo_options: --no-run

          - target: aarch64-unknown-linux-gnu
            host_os: ubuntu-22.04

          - target: aarch64-unknown-linux-musl
            host_os: ubuntu-22.04

          - target: arm-unknown-linux-gnueabihf
            host_os: ubuntu-22.04

          - target: armv7-linux-androideabi
            host_os: ubuntu-22.04
            # TODO: https://github.com/briansmith/ring/issues/838
            cargo_options: --no-run

          - target: armv7-unknown-linux-musleabihf
            host_os: ubuntu-22.04
            # TODO: https://github.com/briansmith/ring/issues/1115
            cargo_options: --no-run

          - target: i686-pc-windows-msvc
            host_os: windows-latest

          - target: i686-unknown-linux-gnu
            host_os: ubuntu-22.04

          - target: i686-unknown-linux-musl
            host_os: ubuntu-22.04

          - target: x86_64-pc-windows-gnu
            host_os: windows-latest

          - target: x86_64-pc-windows-msvc
            host_os: windows-latest

          - target: x86_64-apple-darwin
            host_os: macos-12

          - target: x86_64-unknown-linux-musl
            host_os: ubuntu-22.04

          - target: x86_64-unknown-linux-gnu
            host_os: ubuntu-22.04

          - target: s390x-unknown-linux-gnu
            host_os: ubuntu-22.04

    steps:
      - if: ${{ contains(matrix.host_os, 'ubuntu') }}
        run: sudo apt-get update -y

      - uses: briansmith/actions-checkout@v2
        with:
          persist-credentials: false

      - if: ${{ !contains(matrix.host_os, 'windows') }}
        run: mk/install-build-tools.sh --target=${{ matrix.target }} ${{ matrix.features }}

      - if: ${{ contains(matrix.host_os, 'windows') }}
        run: ./mk/install-build-tools.ps1

      - uses: briansmith/actions-rs-toolchain@v1
        with:
          override: true
          target: ${{ matrix.target }}
          toolchain: ${{ matrix.rust_channel }}

      - if: ${{ matrix.target == 'aarch64-pc-windows-msvc' }}
        run: |
          echo "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\Llvm\x64\bin" >> $GITHUB_PATH
          echo "RUSTFLAGS=-C target-feature=+crt-static" >> $GITHUB_ENV
        shell: bash

      - if: ${{ !contains(matrix.host_os, 'windows') }}
        run: |
          mk/cargo.sh test -vv --all-targets --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}

      - if: ${{ contains(matrix.host_os, 'windows') }}
        run: |
          cargo test -vv --all-targets --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}

      # --all-targets doesn't run doctests: https://github.com/rust-lang/cargo/issues/6669
      # Run doctests only on x86_64 to avoid cross-compilation hassles with `--no-run`.
      - if: ${{ !contains(matrix.host_os, 'windows') && contains(matrix.target, 'x86_64') }}
        run: |
          mk/cargo.sh test -vv --doc --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}

      # Check that all the needed symbol renaming was done.
      # TODO: Do this check on Windows too.
      # TODO: Check iOS too.
      # TODO: Do this on Apple-hosted release builds too; currently these fail with:
      #       Unknown attribute kind (528)
      #       (Producer: 'LLVM12.0.0-rust-1.54.0-nightly'
      #       Reader: 'LLVM APPLE_1_1200.0.32.29_0')
      - if: ${{ matrix.target != 'aarch64-apple-ios' &&
                !contains(matrix.host_os, 'windows') &&
                (!contains(matrix.host_os, 'macos') || matrix.mode != '--release') }}
        run: mk/check-symbol-prefixes.sh --target=${{ matrix.target }}

  # XXX: GitHub Actions won't let us test all the combinations of features in
  # the "test" matrix because the resultant matrix would be larger than the
  # maximum they allow.
  test-features:
    # Don't run duplicate `push` jobs for the repo owner's PRs.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

    runs-on: ${{ matrix.host_os }}
    strategy:
      matrix:
        features:
          - --no-default-features
          - --no-default-features --features=alloc
          - --no-default-features --features=dev_urandom_fallback
          - --all-features

        target:
          - aarch64-unknown-linux-musl
          - i686-pc-windows-msvc
          - x86_64-unknown-linux-gnu
          - s390x-unknown-linux-gnu

        mode:
          - # debug
          - --release

        rust_channel:
          - stable
          - nightly
          - 1.60.0 # MSRV
          - beta

        include:
          - target: aarch64-unknown-linux-musl
            host_os: ubuntu-22.04

          - target: i686-pc-windows-msvc
            host_os: windows-latest

          - target: x86_64-unknown-linux-gnu
            host_os: ubuntu-22.04

          - target: s390x-unknown-linux-gnu
            host_os: ubuntu-22.04

    steps:
      - if: ${{ contains(matrix.host_os, 'ubuntu') }}
        run: sudo apt-get update -y

      - uses: briansmith/actions-checkout@v2
        with:
          persist-credentials: false

      - if: ${{ !contains(matrix.host_os, 'windows') }}
        run: mk/install-build-tools.sh --target=${{ matrix.target }} ${{ matrix.features }}

      - if: ${{ contains(matrix.host_os, 'windows') }}
        run: ./mk/install-build-tools.ps1

      - uses: briansmith/actions-rs-toolchain@v1
        with:
          override: true
          target: ${{ matrix.target }}
          toolchain: ${{ matrix.rust_channel }}

      - if: ${{ matrix.target == 'aarch64-pc-windows-msvc' }}
        run: |
          echo "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\Llvm\x64\bin" >> $GITHUB_PATH
          echo "RUSTFLAGS=-C target-feature=+crt-static" >> $GITHUB_ENV
        shell: bash

      - if: ${{ !contains(matrix.host_os, 'windows') }}
        run: |
          mk/cargo.sh test -vv --all-targets --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}

      - if: ${{ contains(matrix.host_os, 'windows') }}
        run: |
          cargo test -vv --all-targets --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}

      # --all-targets doesn't run doctests: https://github.com/rust-lang/cargo/issues/6669
      # Run doctests only on x86_64 to avoid cross-compilation hassles with `--no-run`.
      - if: ${{ !contains(matrix.host_os, 'windows') && contains(matrix.target, 'x86_64') }}
        run: |
          mk/cargo.sh test -vv --doc --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}

      # Check that all the needed symbol renaming was done.
      # TODO: Do this check on Windows too.
      # TODO: Check iOS too.
      # TODO: Do this on Apple-hosted release builds too; currently these fail with:
      #       Unknown attribute kind (528)
      #       (Producer: 'LLVM12.0.0-rust-1.54.0-nightly'
      #       Reader: 'LLVM APPLE_1_1200.0.32.29_0')
      - if: ${{ matrix.target != 'aarch64-apple-ios' &&
          !contains(matrix.host_os, 'windows') &&
          (!contains(matrix.host_os, 'macos') || matrix.mode != '--release') }}
        run: mk/check-symbol-prefixes.sh --target=${{ matrix.target }}


  # The wasm32-unknown-unknown targets have a different set of feature sets and
  # an additional `webdriver` dimension.
  test-wasm32:
    # Don't run duplicate `push` jobs for the repo owner's PRs.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

    runs-on: ${{ matrix.host_os }}

    strategy:
      matrix:
        features:
          - --features=wasm32_unknown_unknown_js
          - --no-default-features --features=wasm32_unknown_unknown_js

        host_os:
          - ubuntu-22.04
        mode:
          - # debug
          - --release
        rust_channel:
          - stable
          - beta
          - nightly
        target:
          - wasm32-unknown-unknown
        webdriver:
          # TODO: Firefox is not in Ubuntu 22.04 images according to
          # https://github.com/actions/runner-images/issues/5490 and our
          # testing.
          # - GECKODRIVER=$GECKOWEBDRIVER/geckodriver
          - CHROMEDRIVER=$CHROMEWEBDRIVER/chromedriver

    steps:
      - if: ${{ contains(matrix.host_os, 'ubuntu') }}
        run: sudo apt-get update -y

      - uses: briansmith/actions-checkout@v2
        with:
          persist-credentials: false

      - run: cargo generate-lockfile

      - run: mk/install-build-tools.sh --target=${{ matrix.target }} ${{ matrix.features }}

      - uses: briansmith/actions-rs-toolchain@v1
        with:
          override: true
          target: ${{ matrix.target }}
          toolchain: ${{ matrix.rust_channel }}

      - run: |
          ${{ matrix.webdriver }} mk/cargo.sh test -vv --target=${{ matrix.target }} ${{ matrix.features }} ${{ matrix.mode }}

      # Check that all the needed symbol renaming was done.
      # TODO: Do this check on Windows too.
      - run: mk/check-symbol-prefixes.sh --target=${{ matrix.target }}

  coverage:
    # Don't run duplicate `push` jobs for the repo owner's PRs.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

    runs-on: ${{ matrix.host_os }}

    strategy:
      matrix:
        features:
          # Enable all the library features so we can measure all the coverage.
          # Don't enable `slow_tests` and other (test suite) features that are
          # unuseful, or even counterproductive, for coverage testing.
          # `slow_tests` is slow and it is running code that is already intended
          # to be covered without it being enabled.
          - --features=alloc,dev_urandom_fallback,std

        # TODO: targets
        target:
          - aarch64-unknown-linux-gnu
          - i686-unknown-linux-gnu
          - x86_64-unknown-linux-musl
          - s390x-unknown-linux-gnu

        mode:
          - # debug

        # Coverage collection is Nightly-only
        rust_channel:
          - nightly

        # TODO: targets
        include:
          # TODO: Use the -musl target after
          # https://github.com/rust-lang/rust/issues/79556 and
          # https://github.com/rust-lang/rust/issues/79555 are fixed.
          - target: aarch64-unknown-linux-gnu
            host_os: ubuntu-22.04

          # TODO: Use the -musl target after
          # https://github.com/rust-lang/rust/issues/79556 and
          # https://github.com/rust-lang/rust/issues/79555 are fixed.
          - target: i686-unknown-linux-gnu
            host_os: ubuntu-22.04

          - target: x86_64-unknown-linux-musl
            host_os: ubuntu-22.04

          - target: s390x-unknown-linux-gnu
            host_os: ubuntu-22.04

          # TODO: Add an ARM target after
          # https://github.com/rust-lang/rust/issues/79555 is fixed. This may
          # require https://github.com/rust-lang/rust/issues/79555 to be fixed
          # too.

    steps:
      - if: ${{ contains(matrix.host_os, 'ubuntu') }}
        run: sudo apt-get update -y

      - uses: briansmith/actions-checkout@v2
        with:
          persist-credentials: false

      - if: ${{ !contains(matrix.host_os, 'windows') }}
        run: RING_COVERAGE=1 mk/install-build-tools.sh --target=${{ matrix.target }} ${{ matrix.features }}

      - uses: briansmith/actions-rs-toolchain@v1
        with:
          override: true
          target: ${{ matrix.target }}
          toolchain: ${{ matrix.rust_channel }}

      - if: ${{ !contains(matrix.host_os, 'windows') }}
        run: |
          RING_COVERAGE=1 mk/cargo.sh +${{ matrix.rust_channel }} test -vv --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}

      - uses: briansmith/codecov-codecov-action@v3
        with:
          directory: ./target/${{ matrix.target }}/debug/coverage/reports
          fail_ci_if_error: true
          verbose: true