rust.yml

name: Rust CI

on:
  push:
    branches: ["github"]
    tags: ["v*"]
  pull_request:
    branches: ["github"]
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

permissions:
  contents: read

concurrency:
  group: rust-ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint-security-lean:
    name: Lint, Security, Lean
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Install Linux build deps
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends clang lld cmake pkg-config libseccomp-dev

      - name: Cache Rust artifacts
        uses: Swatinem/rust-cache@v2

      - name: Rustfmt
        run: cargo fmt --all --check

      - name: Clippy (default + CLI)
        run: |
          cargo clippy -p zpaq_rs --locked
          cargo clippy -p infotheory --lib --bins --features cli --locked
          cargo clippy -p infotheory --lib --bins --no-default-features --features cli --locked

      - name: Warnings gate (default + no-default CLI)
        run: |
          RUSTFLAGS="-D warnings" cargo check -p zpaq_rs --locked
          RUSTFLAGS="-D warnings" cargo check -p infotheory --features cli --locked
          RUSTFLAGS="-D warnings" cargo check -p infotheory --no-default-features --features cli --locked

      - name: Install coverage tooling
        run: cargo install cargo-llvm-cov --locked

      - name: Rust line coverage gate (CLI + library parity suite)
        run: |
          cargo llvm-cov -p infotheory --tests --features cli --locked --summary-only --fail-under-lines 50

      - name: Rustdoc coverage gate
        run: |
          cargo +nightly rustdoc -p infotheory --all-features -- -Z unstable-options --show-coverage --output-format json > /tmp/rustdoc_cov.json
          python - <<'PY'
          import json, sys
          data = json.load(open("/tmp/rustdoc_cov.json"))
          files = data.get("files", data)
          total = sum(v.get("total", 0) for v in files.values())
          with_docs = sum(v.get("with_docs", 0) for v in files.values())
          pct = 100.0 if total == 0 else (with_docs * 100.0 / total)
          print(f"Rustdoc documented items: {with_docs}/{total} ({pct:.2f}%)")
          if with_docs != total:
              print("Rustdoc coverage gate failed (<100.0%).", file=sys.stderr)
              sys.exit(1)
          PY

      - name: Security audit
        run: |
          cargo install cargo-audit --locked
          cargo audit

      - name: Dependency integrity
        run: |
          cargo update --workspace --locked --dry-run
          cargo tree --workspace --all-features --locked --duplicates

      - name: Install Lean (elan)
        run: |
          curl -sSf https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh | sh -s -- -y
          echo "$HOME/.elan/bin" >> "$GITHUB_PATH"

      - name: Build infotheory CLI for Lean validation
        run: cargo build --release --features cli --bin infotheory --locked

      - name: Run Lean validation (ite-bench)
        run: ./projman.sh lean_test

  platform-hosted:
    name: ${{ matrix.name }}
    needs: lint-security-lean
    runs-on: ${{ matrix.runs_on }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Linux GNU (x86_64)
            runs_on: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            run_vm: true
            rustdocflags: -C target-cpu=x86-64 -C link-arg=-fuse-ld=lld
            release_rustc_flags: -C target-cpu=x86-64
            artifact_ext: ""
          - name: Linux GNU (arm64)
            runs_on: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            run_vm: false
            rustdocflags: -C target-cpu=generic -C link-arg=-fuse-ld=lld
            release_rustc_flags: -C target-cpu=generic
            artifact_ext: ""
          - name: macOS (x86_64)
            runs_on: macos-15-intel
            target: x86_64-apple-darwin
            run_vm: false
            rustdocflags: -C target-cpu=x86-64
            release_rustc_flags: -C target-cpu=x86-64
            artifact_ext: ""
          - name: Windows (x86_64)
            runs_on: windows-latest
            target: x86_64-pc-windows-msvc
            run_vm: false
            rustdocflags: -C target-cpu=x86-64
            release_rustc_flags: -C target-cpu=x86-64
            artifact_ext: ".exe"
          - name: Windows (arm64)
            runs_on: windows-11-arm
            target: aarch64-pc-windows-msvc
            run_vm: false
            rustdocflags: -C target-cpu=generic
            release_rustc_flags: -C target-cpu=generic
            artifact_ext: ".exe"
          - name: macOS (arm64)
            runs_on: macos-15
            target: aarch64-apple-darwin
            run_vm: false
            rustdocflags: -C target-cpu=generic
            release_rustc_flags: -C target-cpu=generic
            artifact_ext: ""
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install Linux build deps
        if: ${{ endsWith(matrix.target, 'unknown-linux-gnu') }}
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends clang lld cmake pkg-config libseccomp-dev

      - name: Configure Linux GNU ARM linker/toolchain
        if: ${{ matrix.target == 'aarch64-unknown-linux-gnu' }}
        run: |
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=clang" >> "$GITHUB_ENV"
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS=-C link-arg=-fuse-ld=lld" >> "$GITHUB_ENV"

      - name: Cache Rust artifacts
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: platform-hosted-${{ matrix.target }}

      - name: Feature checks
        env:
          RUSTFLAGS: -D warnings
        run: |
          cargo check --locked
          cargo check --no-default-features --locked
          cargo check --no-default-features --features cli --locked
          cargo check --features cli --locked

      - name: VM feature check
        if: ${{ matrix.run_vm }}
        run: cargo check --features vm --locked

      - name: Test matrix
        env:
          RUSTDOCFLAGS: ${{ matrix.rustdocflags }}
        run: |
          cargo test --release --locked
          cargo test --release --no-default-features --locked
          cargo test --release --features cli --locked
          cargo test --release --no-default-features --features cli --locked

      - name: VM tests
        if: ${{ matrix.run_vm }}
        env:
          RUSTDOCFLAGS: ${{ matrix.rustdocflags }}
        run: cargo test --release --features vm --locked

      - name: Build release CLI binary
        run: |
          cargo rustc --release --features cli --bin infotheory --target ${{ matrix.target }} --locked -- ${{ matrix.release_rustc_flags }}

      - name: Package binary artifact
        shell: bash
        run: |
          set -euo pipefail
          out_dir="target/${{ matrix.target }}/release"
          bin_name="infotheory${{ matrix.artifact_ext }}"
          artifact_name="infotheory-cli-${{ matrix.target }}"
          mkdir -p dist
          cp "${out_dir}/${bin_name}" "dist/${bin_name}"
          tar -C dist -czf "${artifact_name}.tar.gz" "${bin_name}"

      - name: Upload workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: infotheory-cli-${{ matrix.target }}
          path: infotheory-cli-${{ matrix.target }}.tar.gz
          if-no-files-found: error

      - name: Upload binary to GitHub release (tag pushes)
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: infotheory-cli-${{ matrix.target }}.tar.gz

  platform-bsd:
    name: BSD x86_64 ${{ matrix.os }} (${{ matrix.version }})
    needs: lint-security-lean
    runs-on: ubuntu-latest
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: freebsd
            version: "15.0"
            target: x86_64-unknown-freebsd
            rustdocflags: -C target-cpu=x86-64 -C link-arg=-fuse-ld=lld
          - os: openbsd
            version: "7.8"
            target: x86_64-unknown-openbsd
            rustdocflags: -C target-cpu=x86-64 -C link-arg=-fuse-ld=lld
          - os: netbsd
            version: "10.1"
            target: x86_64-unknown-netbsd
            rustdocflags: -C target-cpu=x86-64
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Cross-platform BSD validation + build
        uses: cross-platform-actions/action@v0.32.0
        with:
          operating_system: ${{ matrix.os }}
          version: ${{ matrix.version }}
          architecture: x86_64
          memory: 6G
          environment_variables: CARGO_TERM_COLOR
          shell: sh
          run: |
            set -eu

            as_root() {
              if command -v sudo >/dev/null 2>&1; then
                sudo "$@"
              elif command -v doas >/dev/null 2>&1; then
                doas "$@"
              else
                "$@"
              fi
            }

            ensure_rust() {
              if command -v cargo >/dev/null 2>&1; then
                return 0
              fi
              if command -v pkg >/dev/null 2>&1; then
                as_root pkg update -f || true
                as_root pkg install -y rust || true
              elif command -v pkgin >/dev/null 2>&1; then
                as_root pkgin -y update || true
                as_root pkgin -y install rust || true
              elif command -v pkg_add >/dev/null 2>&1; then
                as_root pkg_add rust || true
              fi
              if ! command -v cargo >/dev/null 2>&1; then
                if command -v curl >/dev/null 2>&1; then
                  curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
                elif command -v ftp >/dev/null 2>&1; then
                  ftp -o /tmp/rustup-init.sh https://sh.rustup.rs
                  sh /tmp/rustup-init.sh -y --profile minimal
                else
                  echo "Unable to install Rust toolchain in BSD runner" >&2
                  exit 1
                fi
              fi
            }

            ensure_rust
            export PATH="/usr/local/bin:/usr/pkg/bin:$HOME/.cargo/bin:$PATH"
            cargo --version
            rustc --version

            OS="$(uname -s)"
            case "$OS" in
              NetBSD)
                export CARGO_FEATURE_NOJIT=1
                export CARGO_PROFILE_RELEASE_LTO=off
                if ! command -v clang >/dev/null 2>&1 && command -v cc >/dev/null 2>&1; then
                  export CARGO_TARGET_X86_64_UNKNOWN_NETBSD_LINKER=cc
                fi
                ;;
              OpenBSD)
                export CARGO_FEATURE_NOJIT=1
                ;;
              FreeBSD)
                :
                ;;
            esac

            export RUSTDOCFLAGS="${{ matrix.rustdocflags }}"

            RUSTFLAGS="-D warnings" cargo check --locked
            RUSTFLAGS="-D warnings" cargo check --locked --no-default-features
            RUSTFLAGS="-D warnings" cargo check --locked --features cli
            RUSTFLAGS="-D warnings" cargo check --locked --no-default-features --features cli

            cargo test --release --locked
            cargo test --release --no-default-features --locked
            cargo test --release --features cli --locked
            cargo test --release --no-default-features --features cli --locked

            cargo rustc --release --features cli --bin infotheory --locked -- -C target-cpu=x86-64

            mkdir -p dist
            cp target/release/infotheory dist/infotheory
            tar -C dist -czf "infotheory-cli-${{ matrix.target }}.tar.gz" infotheory

      - name: Upload workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: infotheory-cli-${{ matrix.target }}
          path: infotheory-cli-${{ matrix.target }}.tar.gz
          if-no-files-found: error

      - name: Upload binary to GitHub release (tag pushes)
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: infotheory-cli-${{ matrix.target }}.tar.gz

  portability-cross:
    name: Portability checks (WASM + generic x86_64)
    needs: lint-security-lean
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: |
            wasm32-unknown-unknown

      - name: Cache Rust artifacts
        uses: Swatinem/rust-cache@v2

      - name: Cross-target compile checks (RWKV-only portable profile)
        env:
          CARGO_BUILD_RUSTFLAGS: -Cdebuginfo=0
        run: |
          RUSTFLAGS="-D warnings -Cdebuginfo=0" cargo check -p infotheory --target wasm32-unknown-unknown --no-default-features --features backend-rwkv --locked
          RUSTFLAGS="-D warnings -C target-cpu=x86-64" cargo check -p infotheory --no-default-features --features backend-rwkv --locked

  platform-musl:
    name: ${{ matrix.name }}
    needs: lint-security-lean
    runs-on: ${{ matrix.runs_on }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Linux musl (x86_64)
            runs_on: ubuntu-latest
            target: x86_64-unknown-linux-musl
            cxx_triplet: x86_64-alpine-linux-musl
            release_rustc_flags: -C target-cpu=x86-64
          - name: Linux musl (arm64)
            runs_on: ubuntu-24.04-arm
            target: aarch64-unknown-linux-musl
            cxx_triplet: aarch64-alpine-linux-musl
            release_rustc_flags: -C target-cpu=generic
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Cache musl toolchain + target artifacts
        uses: actions/cache@v4
        with:
          path: |
            .ci-cache/musl/cargo
            .ci-cache/musl/rustup
            target/${{ matrix.target }}
          key: ${{ runner.os }}-${{ runner.arch }}-musl-${{ matrix.target }}-alpine-3.23.3-${{ hashFiles('Cargo.lock', '.github/workflows/rust.yml') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-musl-${{ matrix.target }}-alpine-3.23.3-

      - name: Comprehensive musl validation + build (Alpine 3.23.3)
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p .ci-cache/musl/cargo .ci-cache/musl/rustup
          target="${{ matrix.target }}"
          target_env_upper="$(echo "${target}" | tr '[:lower:]-' '[:upper:]_')"
          target_env_lower="$(echo "${target}" | tr '-' '_')"
          cxx_triplet="${{ matrix.cxx_triplet }}"
          docker run --rm \
            -v "$PWD:/work" \
            -v "$PWD/.ci-cache/musl/cargo:/root/.cargo" \
            -v "$PWD/.ci-cache/musl/rustup:/root/.rustup" \
            -w /work \
            -e CARGO_TERM_COLOR=always \
            -e TARGET="${target}" \
            -e TARGET_ENV_UPPER="${target_env_upper}" \
            -e TARGET_ENV_LOWER="${target_env_lower}" \
            -e CXX_TRIPLET="${cxx_triplet}" \
            -e RELEASE_RUSTC_FLAGS="${{ matrix.release_rustc_flags }}" \
            alpine:3.23.3 \
            sh -euxc '
              apk add --no-cache bash build-base clang lld curl ca-certificates git musl-dev pkgconf
              if ! command -v rustup >/dev/null 2>&1; then
                curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
              fi
              . /root/.cargo/env
              rustup toolchain install stable --profile minimal --no-self-update
              rustup default stable
              rustup target add "$TARGET"

              gcc_ver="$(g++ -dumpversion)"
              cxx_base="/usr/include/c++/${gcc_ver}"
              eval "export CC_${TARGET_ENV_LOWER}=clang"
              eval "export CXX_${TARGET_ENV_LOWER}=clang++"
              eval "export CFLAGS_${TARGET_ENV_LOWER}=\"--gcc-toolchain=/usr\""
              eval "export CXXFLAGS_${TARGET_ENV_LOWER}=\"--gcc-toolchain=/usr -isystem ${cxx_base} -isystem ${cxx_base}/${CXX_TRIPLET} -isystem ${cxx_base}/backward\""
              eval "export CARGO_TARGET_${TARGET_ENV_UPPER}_LINKER=clang"
              export MUSL_LD_RUSTFLAGS="-C link-arg=-fuse-ld=lld"
              export MUSL_RUSTDOCFLAGS="-C target-cpu=generic -C link-arg=-fuse-ld=lld"

              RUSTFLAGS="-D warnings ${MUSL_LD_RUSTFLAGS}" cargo check --target "$TARGET" --locked
              RUSTFLAGS="-D warnings ${MUSL_LD_RUSTFLAGS}" cargo check --target "$TARGET" --no-default-features --locked
              RUSTFLAGS="-D warnings ${MUSL_LD_RUSTFLAGS}" cargo check --target "$TARGET" --features cli --locked
              RUSTFLAGS="-D warnings ${MUSL_LD_RUSTFLAGS}" cargo check --target "$TARGET" --no-default-features --features cli --locked

              RUSTFLAGS="${MUSL_LD_RUSTFLAGS}" RUSTDOCFLAGS="${MUSL_RUSTDOCFLAGS}" cargo test --release --target "$TARGET" --locked
              RUSTFLAGS="${MUSL_LD_RUSTFLAGS}" RUSTDOCFLAGS="${MUSL_RUSTDOCFLAGS}" cargo test --release --target "$TARGET" --no-default-features --locked
              RUSTFLAGS="${MUSL_LD_RUSTFLAGS}" RUSTDOCFLAGS="${MUSL_RUSTDOCFLAGS}" cargo test --release --target "$TARGET" --features cli --locked
              RUSTFLAGS="${MUSL_LD_RUSTFLAGS}" RUSTDOCFLAGS="${MUSL_RUSTDOCFLAGS}" cargo test --release --target "$TARGET" --no-default-features --features cli --locked

              RUSTFLAGS="${MUSL_LD_RUSTFLAGS}" cargo rustc --release --features cli --bin infotheory --target "$TARGET" --locked -- ${RELEASE_RUSTC_FLAGS}
            '

      - name: Package binary artifact
        shell: bash
        run: |
          set -euo pipefail
          out_dir="target/${{ matrix.target }}/release"
          bin_name="infotheory"
          artifact_name="infotheory-cli-${{ matrix.target }}"
          mkdir -p dist
          cp "${out_dir}/${bin_name}" "dist/${bin_name}"
          tar -C dist -czf "${artifact_name}.tar.gz" "${bin_name}"

      - name: Upload workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: infotheory-cli-${{ matrix.target }}
          path: infotheory-cli-${{ matrix.target }}.tar.gz
          if-no-files-found: error

      - name: Upload binary to GitHub release (tag pushes)
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: infotheory-cli-${{ matrix.target }}.tar.gz