rust.yml

# SPDX-FileCopyrightText: © 2026 hashcatHitman
#
# SPDX-License-Identifier: Apache-2.0 OR MIT

name: Rust Quality Control

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["**"]
  workflow_dispatch: {}

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_VET_VERSION: 0.10.2
  CARGO_AUDIT_VERSION: 0.22.2
  EXTRA_NIGHTLY_FLAGS: "-Zcrate-attr=feature(strict_provenance_lints,unqualified_local_imports,must_not_suspend,multiple_supertrait_upcastable,non_exhaustive_omitted_patterns_lint,supertrait_item_shadowing)"
  MSRV: 1.97.1

defaults:
  run:
    shell: bash

jobs:
  cargo-audit:
    name: Audit Dependencies
    runs-on: ubuntu-latest
    permissions:
      security-events: write # Required for upload-sarif to upload SARIF files.
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Rust
        run: rustup update stable && rustup default stable
      - name: Check cache for cargo-audit
        id: cache-cargo-audit
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cargo/bin/cargo-audit
          key: cargo-audit-bin-${{ env.CARGO_AUDIT_VERSION }}
      - if: ${{ steps.cache-cargo-audit.outputs.cache-hit != 'true' }}
        name: Install cargo-audit
        run: cargo install --locked --version ${CARGO_AUDIT_VERSION} cargo-audit
      - name: Invoke cargo-audit
        run: cargo audit --deny warnings --format=sarif > cargo_audit_results.sarif
      - if: success() || failure()
        name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
        with:
          sarif_file: cargo_audit_results.sarif
          category: cargo-audit

  cargo-vet:
    name: Vet Dependencies
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Rust
        run: rustup update stable && rustup default stable
      - name: Check cache for cargo-vet
        id: cache-cargo-vet
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cargo/bin/cargo-vet
          key: cargo-vet-bin-${{ env.CARGO_VET_VERSION }}
      - if: ${{ steps.cache-cargo-vet.outputs.cache-hit != 'true' }}
        name: Install cargo-vet
        run: cargo install --locked --version ${CARGO_VET_VERSION} cargo-vet
      - name: Invoke cargo-vet
        run: cargo vet --locked

  rustfmt:
    name: Format Check (Nightly)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Nightly Install
        run: rustup toolchain add nightly && rustup component add --toolchain nightly rustfmt
      - name: Format Check (Nightly)
        run: cargo +nightly fmt --verbose --all --check

  clippy:
    name: Clippy (Nightly)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Nightly Install
        run: rustup toolchain add nightly && rustup component add --toolchain nightly clippy
      - name: Clippy (Nightly)
        run: cargo +nightly clippy --locked --workspace --all-targets --all-features -- -D warnings ${EXTRA_NIGHTLY_FLAGS}

  miri:
    name: Miri
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Nightly Install
        run: rustup toolchain add nightly && rustup component add --toolchain nightly miri
      - name: Setup Miri
        run: cargo +nightly miri setup --locked # Does --locked even do anything here?
      - name: Tests with Miri
        run: RUSTFLAGS=${EXTRA_NIGHTLY_FLAGS} cargo +nightly miri test --workspace --all-targets --all-features --locked
      - name: Doctests with Miri
        run: RUSTFLAGS=${EXTRA_NIGHTLY_FLAGS} RUSTDOCFLAGS=${EXTRA_NIGHTLY_FLAGS} cargo +nightly miri test --workspace --doc --all-features --locked

  build-test-msrv:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]

    name: Build & Test (${{ matrix.os }}) (MSRV)
    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: MSRV Install
        run: rustup toolchain add ${MSRV}
      - name: Build
        run: cargo +${MSRV} build --verbose --workspace --all-targets --all-features --locked
      - name: Tests
        run: cargo +${MSRV} test --verbose --workspace --all-targets --all-features --locked
      - name: Doctests
        run: cargo +${MSRV} test --verbose --workspace --doc --all-features --locked

  build-test-nightly:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]

    name: Build & Test (${{ matrix.os }}) (Nightly)
    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Nightly Install
        run: rustup toolchain add nightly
      - name: Build
        run: cargo +nightly build --verbose --workspace --all-targets --all-features --locked
      - name: Tests
        run: cargo +nightly test --verbose --workspace --all-targets --all-features --locked
      - name: Doctests
        run: cargo +nightly test --verbose --workspace --doc --all-features --locked