ci.yml

name: CI

# What every change is checked against. Everything here runs on one runner
# family and is expected to finish quickly enough to read before moving on;
# the checks that need a second operating system, a compiler helper, or a real
# build toolchain live in the verify workflow, which runs when a change lands
# on main.
#
# Prose is exempt. A change that touches only Markdown or the documentation
# tree cannot alter what any of these checks answer, so running them there
# spends the whole workflow to re-confirm the previous result. The exemption is
# by path, not by branch: a push carrying both prose and code is a code change
# and still runs. The list is spelled out under each trigger because the
# workflow parser does not resolve YAML anchors.
on:
  push:
    branches: [main, develop]
    paths-ignore:
      - '**/*.md'
      - 'docs/**'
  pull_request:
    paths-ignore:
      - '**/*.md'
      - 'docs/**'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"

jobs:
  lint:
    name: fmt + clippy + docs + boundaries
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - name: Format
        run: cargo fmt --all --check
      - name: Clippy
        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
      - name: Verify compiler helper boundaries
        run: make verify-helper-boundaries
      - name: Verify artifact dependency boundary
        run: make verify-artifact-boundaries
      - name: Docs
        run: cargo doc --workspace --no-deps --all-features
        env:
          RUSTDOCFLAGS: "-D warnings"

  test:
    name: test
    runs-on: ubuntu-latest
    steps:
      # The whole history, not the default single commit. The seam tests count
      # co-changes and breaches over this repository's own commits, and a
      # shallow checkout would leave them measuring one commit and reporting
      # the emptiness as an answer.
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      # `rust-toolchain.toml` names the components, `rust-src` among them.
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      # The suite includes the Semantic-mode tests, which ask the C/C++ helper
      # about real translation units. It loads libclang at run time and reads a
      # control-flow graph by invoking `clang` separately, so both the library
      # and the unversioned driver have to be here. Neither is a CI-only extra:
      # they are what running this suite needs anywhere.
      - name: Install Clang and libclang
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends clang libclang-dev libc++-dev libc++abi-dev
      # The labelled precision tests refuse to pass on an empty measurement:
      # with no case materialized they report that nothing was measured rather
      # than reporting success. The suite therefore needs the same sources the
      # accuracy job fetches.
      - name: Materialize the labelled corpora
        run: corpus/scripts/materialize-labeled.sh
      # Formatting, lints and docs belong to the lint job. Running them here as
      # well only buys a second copy of the same answer.
      #
      # Every test binary runs, rather than stopping at the first one that
      # fails. A fault that only shows on one platform is rarely alone, and
      # stopping at the first means meeting the next a full round trip later.
      - name: Test
        run: cargo test --workspace --all-targets --all-features --no-fail-fast

      # `--all-targets` excludes doc examples, so a second run is what actually
      # compiles them. An example that no longer builds is documentation that is
      # wrong, and no other job here would say so.
      - name: Test doc examples
        run: cargo test --workspace --doc --all-features --no-fail-fast

  helperless-modes:
    name: Fast and Structural without compiler helpers
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      # Do not restore a target directory from another job. This package-only
      # build compiles the CLI and its library dependencies, never either
      # compiler-helper binary.
      - name: Exercise helper-free modes
        run: cargo test -p codehelion --test scan fast_and_structural_modes_run_without_compiler_helpers
        env:
          CARGO_TARGET_DIR: ${{ runner.temp }}/codehelion-helperless-target

  accuracy:
    name: detection accuracy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      # The labelled cases record a commit, not the code it names: the sources
      # belong to the projects they came from and are fetched here rather than
      # committed. Without this step the accuracy run still passes, with every
      # labelled case reported as unscored — which is the point of the step.
      - name: Materialize the labelled corpora
        run: corpus/scripts/materialize-labeled.sh
      - name: Measure
        run: make eval

  seam:
    name: seam report
    runs-on: ubuntu-latest
    steps:
      # Reading co-change needs the commits it is computed over, so this job
      # is one of the two that checks the tree out in full.
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      # Reported, not enforced. `--deny-asymmetric` is deliberately absent: a
      # change touching one member of a seam is often the right change, and a
      # check that cannot tell those apart belongs in the log where a reviewer
      # reads it rather than in a status that blocks the branch.
      # `--no-record` because the database this would write to is thrown away
      # with the runner. A generation nothing can ever be compared against is
      # not a generation, and recording one here would only teach a reader to
      # expect a trend that never survives the job.
      - name: Report seam metrics
        run: cargo run -p codehelion -- seam --no-record
      # `HEAD~1` rather than a branch name: a pull request is checked out as a
      # merge commit whose first parent is the base, so this reads the change
      # under review, and on a push it reads the commit that was pushed.
      - name: Report what this change touched
        run: cargo run -p codehelion -- guard --since HEAD~1

  packaging:
    name: publishable crates build from their own package
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      # Building a crate from its own package directory is the only thing that
      # reads it the way a dependent will, and nothing else in this workflow
      # does. Asking on every change rather than at release time keeps the
      # answer current: the alternative is finding out at the tag that a crate
      # has been unbuildable from its own tarball for weeks.
      - name: Package every publishable crate
        run: make verify-packaging

  msrv:
    name: minimum supported rust version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@1.98.0
      - uses: Swatinem/rust-cache@v2
      - name: Build
        run: cargo build --all-features

  deny:
    name: cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: EmbarkStudios/cargo-deny-action@v2