node/.github/workflows/pr-checks.yml

name: PR Checks

on:
  pull_request:
  # Run in the merge queue so a PR is re-validated against the true merged
  # result before it lands. Guards against semantic merge races where two
  # individually-green PRs break main in combination (#113 + #145 → #229).
  merge_group:
  # Release-branch heads are created and pushed by GITHUB_TOKEN (release-please
  # and the lock-sync job), and GitHub's recursion guard means those pushes
  # trigger no workflow runs. workflow_dispatch is the documented carve-out that
  # GITHUB_TOKEN CAN trigger, so the release flow dispatches this workflow at
  # the release branch to attach check runs to its head. Read-only workflow
  # (contents: read), so the dispatch surface adds no privilege.
  workflow_dispatch:
  push:
    branches:
      - main

permissions:
  contents: read

# Cancel superseded runs on the same PR/branch; never cancel runs on main.
concurrency:
  group: pr-checks-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  fmt-clippy:
    name: fmt + clippy
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Check out repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
        with:
          toolchain: stable
          components: rustfmt, clippy

      - name: Cache cargo
        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0

      - name: cargo fmt --check
        run: cargo fmt --all -- --check

      - name: cargo clippy
        run: cargo clippy --locked --workspace --all-targets -- -D warnings

  test:
    name: test (${{ matrix.toolchain }})
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        toolchain: [stable, beta]
    # Beta is informational: an upstream beta regression should warn, not block merges.
    continue-on-error: ${{ matrix.toolchain == 'beta' }}
    # Postgres for the DB-backed integration tests (#[sqlx::test] provisions an
    # isolated database per test off this connection). The health-check gate keeps
    # `cargo test` from racing a not-yet-ready server.
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: gitlawb_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - name: Check out repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
        with:
          toolchain: ${{ matrix.toolchain }}

      - name: Cache cargo
        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          key: ${{ matrix.toolchain }}

      - name: cargo test
        env:
          DATABASE_URL: postgres://postgres:postgres@localhost:5432/gitlawb_test
        run: cargo test --locked --workspace

  build-release:
    name: build --release
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Check out repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
        with:
          toolchain: stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          key: release

      - name: cargo build --release
        run: cargo build --locked --release --workspace

  audit:
    name: cargo audit
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Check out repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
        with:
          toolchain: stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          key: audit-0.22.2

      - name: Install cargo-audit (pinned)
        # Pin the scanner on this BLOCKING gate: an unpinned `cargo install`
        # floats to the latest release, so a regressed cargo-audit could red CI
        # repo-wide with no code change. Advisory-DB freshness is fetched at scan
        # time, independent of the binary, so this does not weaken what the gate
        # catches. The weekly Scheduled Audit (audit-schedule.yml) deliberately
        # floats to latest as the drift canary; when it shows a newer cargo-audit
        # behaving differently, bump this version (and the cache key above) as a
        # deliberate maintainer action. If 0.22.2 is ever yanked from crates.io
        # this step fails loud until the pin is bumped.
        run: |
          set -euo pipefail
          cargo install --locked --version 0.22.2 cargo-audit
          # Assert the pin took effect so an accidental future unpin (or a drift
          # off 0.22.2) fails loudly here instead of silently running a different
          # scanner. `cargo audit --version` prints "cargo-audit-audit 0.22.2".
          installed="$(cargo audit --version)"
          echo "cargo-audit installed: $installed"
          echo "$installed" | grep -qE '(^| )0\.22\.2($| )' || {
            echo "::error::cargo-audit is not the pinned 0.22.2 (got: $installed)"
            exit 1
          }

      # Hard-fail gate. Suppressions live in .cargo/audit.toml (read automatically
      # from the repo root), each with no available upstream fix. A green check
      # here means "no NEW advisories", not "advisory-clean": surface the active
      # ignore list so a reviewer sees exactly what is being accepted.
      - name: Show active audit ignores
        run: |
          {
            echo '### cargo audit: accepted advisories (.cargo/audit.toml)'
            echo '```toml'
            sed -n '/^\[advisories\]/,$p' .cargo/audit.toml
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: cargo audit
        run: cargo audit

  msrv:
    name: MSRV (Rust 1.91)
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Check out repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Set up Rust 1.91
        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # 1.91
        with:
          toolchain: "1.91"

      - name: Cache cargo
        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          key: msrv

      - name: cargo check on MSRV
        run: cargo check --locked --workspace --all-targets

  docker-build:
    name: Docker build smoke test
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Check out repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Build image
        run: docker build -t gitlawb-node:ci-test .

      - name: Smoke test --version
        run: docker run --rm gitlawb-node:ci-test --version

  test-windows:
    name: test (windows, non-blocking)
    runs-on: windows-latest
    timeout-minutes: 45
    # Non-blocking, mirroring the informational `beta` lane above. We ship `gl`
    # and `git-remote-gitlawb` to Windows users (release.yml) with zero Windows
    # test coverage, so run their suites here to make Windows-only regressions
    # VISIBLE on the PR without gating merge (#228). These two are the client
    # CLIs and depend on no database, so no Postgres service is needed (service
    # containers do not run on windows-latest regardless). `git` is preinstalled
    # on windows-latest, which the real_git_fetch harness relies on.
    continue-on-error: true
    steps:
      - name: Check out repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
        with:
          toolchain: stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          key: windows

      - name: cargo test (shipped Windows crates)
        run: cargo test --locked -p gl -p git-remote-gitlawb

  # gitlawb-core is embedded by every consumer (gl, git-remote-gitlawb, the node
  # daemon), so it must stay lean. This gate fails if gitlawb-core's normal
  # (non-dev, non-build) dependency tree gains any crate not on the allowlist in
  # ci/gitlawb-core-allowed-deps.txt. Exhaustive-by-construction: a new heavy
  # dependency reds CI whether or not anyone thought to ban it, which a denylist
  # cannot do. Regen instructions live in the allowlist header.
  core-deps-purity:
    name: gitlawb-core dependency purity
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Check out repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
        with:
          toolchain: stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          key: core-deps-purity

      - name: Check gitlawb-core dependency allowlist
        run: bash scripts/check-gitlawb-core-deps.sh