ci.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -Dwarnings

jobs:
  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # Must match rust-toolchain.toml exactly ("1.92.0" not "1.92"): rustup
      # treats the two as different toolchain entries, so components installed
      # under "1.92" are invisible when cargo activates "1.92.0" from the file.
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.92.0"
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # Must match rust-toolchain.toml exactly — see the fmt job comment above.
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.92.0"
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --workspace --all-targets -- -D warnings

  test:
    name: Test
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.92.0"
      - uses: Swatinem/rust-cache@v2
      - name: Fetch test fixtures
        run: bash scripts/fetch_test_fixtures.sh
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Generate standard format fixtures
        run: cargo run -p rawshift-image --example generate_test_fixtures
      - run: cargo test --workspace

  test-all-features:
    name: Test (all features)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.92.0"
      - uses: Swatinem/rust-cache@v2
      # `rawshift-image/full` enables `avif` and `heic` (pure-Rust gamut-avif /
      # gamut-heic container/pipeline — no system library; pixel decode goes
      # through rawshift-hwdec via `full`'s `hw` flag, and the AVIF/HEIC
      # hardware tests skip gracefully on GPU-less runners) and `jxl-encode`
      # (builds libjxl hermetically through gamut-jxl-sys — cmake + clang for
      # its bindings). libdav1d-dev is no longer needed: the `image` crate's
      # avif-native decoder (its consumer) left with #33.
      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends cmake clang libclang-dev
      - name: Fetch test fixtures
        run: bash scripts/fetch_test_fixtures.sh
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Generate standard format fixtures
        run: cargo run -p rawshift-image --example generate_test_fixtures
      - run: cargo test --workspace --features rawshift-image/full

  image-only:
    name: Build (image only)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.92.0"
      - uses: Swatinem/rust-cache@v2
      # The facade with only the `image` feature, and the image crate standalone.
      - run: cargo build -p rawshift --no-default-features --features image
      - run: cargo build -p rawshift-image

  video-only:
    name: Build (video only)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.92.0"
      - uses: Swatinem/rust-cache@v2
      # `rawshift-video` is parked and unpublished for v1, and the facade no
      # longer has a `video` feature, so this builds the crate directly.
      - run: cargo build -p rawshift-video --all-features
      # Assert the video build pulls in zero image crates — this is the contract
      # the image/video workspace split exists to guarantee, and it must keep
      # holding while the crate is parked.
      - name: Assert no image crates in the video dependency tree
        run: |
          tree=$(cargo tree -p rawshift-video --all-features --prefix none --no-dedupe)
          echo "$tree"
          if echo "$tree" | grep -qiE 'rawshift-image|zune-|libheif|libwebp|img-parts|little_exif|resvg|ravif|jxl-oxide|^image '; then
            echo "::error::video build pulled in image crates"
            exit 1
          fi
          echo "OK: video build is free of image crates"
      # Assert the parked crate stays out of the facade entirely.
      - name: Assert the facade does not depend on rawshift-video
        run: |
          tree=$(cargo tree -p rawshift --all-features --prefix none --no-dedupe)
          if echo "$tree" | grep -q 'rawshift-video'; then
            echo "::error::rawshift facade depends on the parked rawshift-video crate"
            exit 1
          fi
          echo "OK: facade is free of rawshift-video"

  # ── Compile boundaries (issue #34) ──────────────────────────────────────────
  # The `hw-*` backend pins are *verified* feature flags: rawshift-hwdec holds
  # a `compile_error!` for each explicit backend on any target its platform
  # API does not exist on (docs/SUPPORT.md is the permanent matrix). This job
  # proves the boundary in both directions: every invalid feature x target
  # combination MUST fail to compile with that backend's `compile_error!`
  # text, and the valid combinations (an explicit pin on its native target;
  # the portable `hw` anywhere — including no-API targets, where it compiles
  # the no-backend stub) MUST succeed. `cargo check --target` only needs the
  # target's std, which `rustup target add` ships, and the `compile_error!`
  # fires long before linking — so Apple and musl targets check fine from a
  # Linux host.
  compile-boundaries:
    name: Compile boundaries (feature x target)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.92.0"
          targets: aarch64-apple-darwin,x86_64-unknown-linux-musl
      - uses: Swatinem/rust-cache@v2
      - name: Invalid combos must fail with the compile_error text
        run: |
          check_fails() {
            local features="$1" target="$2" expect="$3"
            echo "::group::EXPECT FAIL: --features ${features} --target ${target}"
            if out=$(cargo check -p rawshift-image --no-default-features \
                       --features "${features}" --target "${target}" 2>&1); then
              echo "${out}"
              echo "::error::--features ${features} --target ${target} compiled, but must fail"
              exit 1
            fi
            if ! grep -qF "${expect}" <<<"${out}"; then
              echo "${out}"
              echo "::error::--features ${features} --target ${target} failed, but not with the expected compile_error (\"${expect}\")"
              exit 1
            fi
            echo "OK: failed with the expected compile_error"
            echo "::endgroup::"
          }
          check_fails hw-vaapi        aarch64-apple-darwin      "requires a linux-gnu target"
          check_fails hw-vaapi        x86_64-unknown-linux-musl "requires a linux-gnu target"
          check_fails hw-videotoolbox x86_64-unknown-linux-gnu  "requires an Apple target"
          check_fails hw-mediacodec   x86_64-unknown-linux-gnu  "requires an Android target"
      - name: Valid combos must succeed
        run: |
          # Explicit pin on its native target.
          cargo check -p rawshift-image --no-default-features --features hw-vaapi --target x86_64-unknown-linux-gnu
          # The portable `hw` is valid everywhere: it selects the native
          # backend where one exists and compiles the no-backend stub (with a
          # build-script warning) where none does (musl).
          cargo check -p rawshift-image --no-default-features --features hw --target aarch64-apple-darwin
          cargo check -p rawshift-image --no-default-features --features hw --target x86_64-unknown-linux-musl

  # ── `full` on tier-1 targets (issue #34) ────────────────────────────────────
  # docs/SUPPORT.md tier 1: x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu,
  # aarch64-apple-darwin, aarch64-apple-ios, aarch64-linux-android, and
  # x86_64-pc-windows-msvc. The four with native GitHub runners get an
  # explicit `--features full` check here (the test matrix only exercises
  # default features at the OS level). aarch64-apple-ios and
  # aarch64-linux-android are excluded: `full` includes `jxl-encode`
  # (cmake-built libjxl via gamut-jxl-sys) and `webp` (libwebp, C), and hosted
  # runners have no cross C/C++ toolchain for those targets; their
  # boundary-relevant half (the hw pins) is covered by compile-boundaries.
  full-check:
    name: Check (full)
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
          - os: macos-latest
            target: aarch64-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-msvc
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.92.0"
      - uses: Swatinem/rust-cache@v2
      # `full` pulls `jxl-encode` (gamut-jxl-sys cmake-builds libjxl; clang for
      # its bindings). The macOS and Windows runners ship cmake + LLVM already.
      - name: Install system libraries (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends cmake clang libclang-dev
      - run: cargo check -p rawshift-image --features full
      - run: cargo check -p rawshift --features full

  coverage-report:
    name: Coverage Report
    runs-on: ubuntu-latest
    needs: [test-all-features]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.92.0"
      - uses: Swatinem/rust-cache@v2
      - name: Fetch test fixtures
        run: bash scripts/fetch_test_fixtures.sh
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Generate standard format fixtures
        run: cargo run -p rawshift-image --example generate_test_fixtures
      - name: Print coverage report
        run: python3 scripts/test_coverage_report.py
      - name: Export coverage JSON
        run: python3 scripts/test_coverage_report.py --json > coverage.json
      - uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage.json

  msrv:
    name: MSRV (1.92)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.92.0"
      - uses: Swatinem/rust-cache@v2
      - run: cargo check --workspace

  # Optional nightly job for extra checks
  nightly:
    name: Nightly checks
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: miri
      - uses: Swatinem/rust-cache@v2
      - name: Run Miri on unit tests
        run: cargo +nightly miri test -p rawshift-core -p rawshift-image --lib -- --skip tiff --skip dng --skip arw --skip export
        env:
          # Tree Borrows, not the default Stacked Borrows: rayon's crossbeam-epoch
          # reclamation list retags a `*const Entry` into a `*const Local`
          # (crossbeam-epoch internal.rs `element_of`) in a way Stacked Borrows
          # rejects outright, so *every* rayon-parallel test — the demosaic and
          # transform hot paths this job exists to check — aborted before Miri
          # reached any rawshift code. Tree Borrows accepts it, restoring cover.
          # `ignore-leaks`: rayon's global pool is never joined, so its workers
          # outlive main and Miri's exit-time leak check fires on that alone.
          MIRIFLAGS: -Zmiri-disable-isolation -Zmiri-tree-borrows -Zmiri-ignore-leaks