ci.yml

on:
  push:
    branches:
      - main
  pull_request:

name: CI

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    strategy:
      matrix:
        partition: ["1", "2", "3", "4", "5", "6", "7", "8", "9", "10"]
    env:
      RUSTFLAGS: -D warnings
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          key: partition-${{ matrix.partition }}
      - name: Install just, cargo-hack, and cargo-sync-rdme
        uses: taiki-e/install-action@v2
        with:
          tool: just,cargo-hack,cargo-sync-rdme
      - name: Lint (clippy)
        run: just powerset --partition ${{ matrix.partition }}/10 clippy --all-targets
      - name: Lint (rustfmt)
        run: cargo xfmt --check
      - name: Run rustdoc
        run: just rustdoc
      # Pin to a specific nightly for compatibility with cargo-sync-rdme.
      - name: Install nightly toolchain for cargo-sync-rdme
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly-2026-04-30
      - name: Regenerate readmes
        run: just generate-readmes
      - name: Check for differences
        run: git diff --exit-code
    
  build-and-test:
    name: Build and test
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest]
        rust-version: ["stable"]
        partition: ["1", "2", "3", "4", "5", "6", "7", "8", "9", "10"]
      fail-fast: false
    env:
      RUSTFLAGS: -D warnings
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust-version }}
      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          key: partition-${{ matrix.partition }}
      - uses: taiki-e/install-action@cargo-hack
      - uses: taiki-e/install-action@just
      - uses: taiki-e/install-action@nextest
      - name: Build
        run: just powerset --partition ${{ matrix.partition }}/10 build
      - name: Run tests
        run: just powerset --partition ${{ matrix.partition }}/10 nextest run
      - name: Doctests
        run: just powerset --partition ${{ matrix.partition }}/10 test --doc

  build-and-test-msrv:
    name: Build and test (MSRV)
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest]
        # 1.86 is the MSRV
        rust-version: ["1.86"]
        partition: ["1", "2", "3", "4", "5", "6", "7", "8", "9", "10"]
      fail-fast: false
    env:
      RUSTFLAGS: -D warnings
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust-version }}
      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          key: partition-${{ matrix.partition }}-msrv
      - uses: taiki-e/install-action@cargo-hack
      - uses: taiki-e/install-action@just
      - uses: taiki-e/install-action@nextest
      - name: Build
        run: just powerset --partition ${{ matrix.partition }}/10 build
      # We don't run UI tests on the MSRV since compiler output varies by
      # version.
      - name: Run tests (excluding UI tests)
        run: just powerset --partition ${{ matrix.partition }}/10 nextest run -E 'not binary_id(iddqd::ui)'
      - name: Doctests
        run: just powerset --partition ${{ matrix.partition }}/10 test --doc


  build-no-std:
    name: Build on no-std
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest]
        # 1.86 is the MSRV
        rust-version: ["1.86", "stable"]
      fail-fast: false
    env:
      RUSTFLAGS: -D warnings
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust-version }}
      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
      - uses: taiki-e/install-action@cross
      - name: Check
        run: cross check --target thumbv7em-none-eabi --no-default-features -p iddqd

  miri:
    name: Run tests with miri (${{ matrix.aliasing-model }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        # Run miri under both Stacked and Tree Borrows.
        # 
        # * Stacked Borrows is the default and catches most issues,
        #   but is known to have false positives under the eventual
        #   Rust aliasing model.
        # * Tree Borrows is generally more permissive than Stacked
        #   Borrows, but is stricter for some things as well. In any
        #   case, it is likely closer to the formal model Rust is moving
        #   towards.
        # 
        # We ensure in CI that iddqd satisfies both models.
        include:
          - aliasing-model: stacked-borrows
            miri-flags: ""
          - aliasing-model: tree-borrows
            miri-flags: "-Zmiri-tree-borrows"
    env:
      RUSTFLAGS: -D warnings
      MIRIFLAGS: ${{ matrix.miri-flags }}
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly
          components: miri
      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          key: miri-${{ matrix.aliasing-model }}
      - uses: taiki-e/install-action@cargo-hack
      - uses: taiki-e/install-action@nextest
      # Run tests for all crates containing unsafe code. Currently, that's just
      # iddqd.
      - name: Run tests
        run: cargo +nightly miri nextest run -p iddqd
      - name: Doctests
        run: cargo +nightly miri test --doc -p iddqd

  soteria:
    name: Soteria proofs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          key: soteria
      - uses: taiki-e/install-action@just
      - uses: taiki-e/install-action@nextest
      # Soteria publishes only a single rolling `nightly` bundle, and `cargo
      # soteria setup` always installs whatever the tag points to. The cache
      # below is mainly for speed -- it (unfortunately) doesn't provide any
      # determinism.
      - name: Cache Soteria toolchain
        id: soteria-cache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.soteria
          key: soteria-bundle-v1
      - name: Install Soteria
        if: steps.soteria-cache.outputs.cache-hit != 'true'
        run: |
          cargo install soteria --git https://github.com/soteria-tools/cargo-soteria.git
          cargo soteria setup
      # The cache covers ~/.soteria but not the rustc toolchain Charon pins (a
      # specific nightly under ~/.rustup), which `cargo soteria setup` installs
      # via `obol toolchain-path`. On a cache hit that step is skipped, so
      # provision it directly from the cached bundle's obol -- this picks up
      # whatever nightly the bundle needs and no-ops if it's already installed.
      - name: Provision Charon toolchain
        run: |
          obol="$(find ~/.soteria -mindepth 2 -maxdepth 2 -type d -name bin | sort -V | tail -1)/obol"
          "$obol" toolchain-path
      - name: Run proofs
        run: just soteria