name: Rust

on:
  pull_request:
    paths:
      - .github/workflows/rust.yml
      - Cargo.lock
      - "**/Cargo.toml"
      - justfile
      - deny.toml
      - "**/*.rs"
      - policy-*/Dockerfile
      - rust-toolchain.toml
      - bin/rust-toolchain-version

permissions:
  contents: read

env:
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  PROTOC_NO_VENDOR: 1
  RUST_BACKTRACE: short
  RUSTUP_MAX_RETRIES: 10

jobs:
  audit:
    timeout-minutes: 10
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        checks:
          - advisories
          - bans licenses sources
    # Prevent sudden announcement of a new advisory from failing Ci.
    continue-on-error: ${{ matrix.checks == 'advisories' }}
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
      - uses: EmbarkStudios/cargo-deny-action@3f4a782664881cf5725d0ffd23969fcce89fd868
        with:
          command: check ${{ matrix.checks }}

  fmt:
    timeout-minutes: 5
    runs-on: ubuntu-22.04
    container: ghcr.io/linkerd/dev:v43-rust
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
      - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
      - run: just rs-check-fmt

  clippy:
    timeout-minutes: 20
    runs-on: ubuntu-22.04
    container: ghcr.io/linkerd/dev:v43-rust
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
      - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
      - run: just rs-fetch
      - run: just rs-clippy
      - run: just rs-doc --no-deps

  check:
    timeout-minutes: 20
    runs-on: ubuntu-22.04
    container: ghcr.io/linkerd/dev:v43-rust
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
      - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
      - run: just rs-fetch
      - run: just rs-check-dirs

  test:
    name: test
    runs-on: ubuntu-22.04
    timeout-minutes: 15
    container: ghcr.io/linkerd/dev:v43-rust
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
      - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
      - run: just rs-fetch
      - run: just rs-test-build
      - run: just rs-test

  rust-toolchain:
    name: rust toolchain
    runs-on: ubuntu-22.04
    timeout-minutes: 2
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
      - shell: bash
        run: |
          toolchain_version="$(./bin/rust-toolchain-version)"

          ex=0
          # Check this workflow against the version in rust-toolchain.
          versions=$(sed -nE 's|.*docker://(.*/)?rust:([^ #]+).*|\2|p' .github/workflows/*)
          for mismatch in $(echo "$versions" | grep -vF "$toolchain_version" || true) ; do
            echo "::error file=.github/workflows/rust.yml::Workflow uses incorrect rust version(s): $mismatch (expected '$toolchain_version)')"
            ex=$((ex + 1))
          done

          exit $ex