name: Rust CI

on:
  workflow_call:
  push:
    branches:
      - master
      - main
    paths:
      - "Cargo.toml"
      - "Cargo.lock"
      - "crates/**"
      - "apps/**"
      - "install.sh"
      - "deploy.sh"
      - "update.sh"
      - "generate_keys.sh"
      - ".env.example"
      - "README.md"
      - "Dockerfile.app"
      - "docker-compose.yml"
      - "docker-compose.single-node.yml"
      - "docker-compose.local.yml"
      - "docker-compose.release-local.yml"
      - "tests/compose_database_config_test.py"
      - "tests/install_*_test.sh"
      - "tests/deploy_*_test.sh"
      - "tests/update_*_test.sh"
      - "tests/release_supply_chain_test.sh"
      - "tests/tunnel_installer_config_security_test.sh"
      - ".github/workflows/build-tunnel.yml"
      - ".github/workflows/deploy-pages.yml"
      - ".github/workflows/release.yml"
      - ".github/workflows/rust-ci.yml"
      - ".github/workflows/nightly.yml"
  pull_request:
    paths:
      - "Cargo.toml"
      - "Cargo.lock"
      - "crates/**"
      - "apps/**"
      - "install.sh"
      - "deploy.sh"
      - "update.sh"
      - "generate_keys.sh"
      - ".env.example"
      - "README.md"
      - "Dockerfile.app"
      - "docker-compose.yml"
      - "docker-compose.single-node.yml"
      - "docker-compose.local.yml"
      - "docker-compose.release-local.yml"
      - "tests/compose_database_config_test.py"
      - "tests/install_*_test.sh"
      - "tests/deploy_*_test.sh"
      - "tests/update_*_test.sh"
      - "tests/release_supply_chain_test.sh"
      - "tests/tunnel_installer_config_security_test.sh"
      - ".github/workflows/build-tunnel.yml"
      - ".github/workflows/deploy-pages.yml"
      - ".github/workflows/release.yml"
      - ".github/workflows/rust-ci.yml"
      - ".github/workflows/nightly.yml"

concurrency:
  group: rust-ci-${{ github.event_name }}-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_INCREMENTAL: 0
  CARGO_PROFILE_DEV_DEBUG: 0
  CARGO_PROFILE_TEST_DEBUG: 0
  CARGO_TERM_COLOR: always

jobs:
  shell_security:
    name: Shell security fixtures
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Run installer and supply-chain fixtures
        shell: bash
        run: |
          python3 tests/compose_database_config_test.py
          bash tests/deploy_state_safety_test.sh
          bash tests/install_archive_safety_test.sh
          bash tests/install_container_runtime_security_test.sh
          bash tests/install_current_release_link_test.sh
          bash tests/install_local_bundle_safety_test.sh
          bash tests/install_privileged_write_safety_test.sh
          bash tests/install_source_trust_test.sh
          bash tests/release_supply_chain_test.sh
          bash tests/update_compose_safety_test.sh
          bash tests/tunnel_installer_config_security_test.sh

  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.95.0
          components: rustfmt

      - name: Format
        run: cargo fmt --all --check

  clippy_gateway:
    name: Clippy (Gateway)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.95.0
          components: clippy

      - name: Rust cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          shared-key: rust-ci-${{ runner.os }}
          workspaces: . -> target

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Clippy
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: cargo clippy -p aether-gateway --lib --bins --examples -- -D warnings

      - name: Show sccache stats
        if: always()
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: sccache --show-stats

  clippy_data:
    name: Clippy (Data)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.95.0
          components: clippy

      - name: Rust cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          shared-key: rust-ci-${{ runner.os }}
          workspaces: . -> target

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Clippy
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: cargo clippy -p aether-data --all-targets -- -D warnings

      - name: Show sccache stats
        if: always()
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: sccache --show-stats

  clippy_rest:
    name: Clippy (Workspace Rest)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.95.0
          components: clippy

      - name: Rust cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          shared-key: rust-ci-${{ runner.os }}
          workspaces: . -> target

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Clippy
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: cargo clippy --workspace --exclude aether-gateway --exclude aether-data --exclude aether-integration-tests --all-targets -- -D warnings

      - name: Show sccache stats
        if: always()
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: sccache --show-stats

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    needs:
      - clippy_gateway
      - clippy_data
      - clippy_rest
    if: ${{ always() }}
    steps:
      - name: Verify clippy jobs
        run: |
          if [ "${{ needs.clippy_gateway.result }}" != "success" ] || \
             [ "${{ needs.clippy_data.result }}" != "success" ] || \
             [ "${{ needs.clippy_rest.result }}" != "success" ]; then
            echo "Clippy failed"
            exit 1
          fi

  test_gateway:
    name: Test (Gateway)
    runs-on: ubuntu-latest
    # 构建指纹提到 job 级：mold RUSTFLAGS / 栈 / sccache 对 lib、bins、integration 三步保持一致，
    # 避免 step 级 env 漂移导致同 job 内 rustc 指纹不一致。
    env:
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
      RUST_MIN_STACK: "16777216"
      RUSTFLAGS: "-C link-arg=-fuse-ld=mold"
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          # 与 rust-toolchain.toml、fmt/clippy 钉在同一版本，避免浮动 stable 换指纹导致全量重编
          toolchain: 1.95.0

      - name: Show Rust toolchain
        run: rustup show active-toolchain

      - name: Rust cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          # mold RUSTFLAGS 只在本 job 生效：独立 cache key，避免与无 mold 的 job 互相污染指纹
          shared-key: rust-ci-gateway-test-${{ runner.os }}
          workspaces: . -> target

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Setup mold
        uses: rui314/setup-mold@7e4f20ad28a2e8ca6fd0892ccf72e2abb706b9c3 # v1

      - name: Install nextest
        uses: taiki-e/install-action@d5f9268ff7620505a81ada10ddf18cdd72240185 # nextest

      - name: Expose PostgreSQL test binaries
        run: pg_config --bindir >> "$GITHUB_PATH"

      - name: Test lib
        run: cargo nextest run -p aether-gateway --lib

      - name: Test bins
        run: cargo nextest run -p aether-gateway --bins

      # 架构守卫（独立轻量 target）+ 此前未执行的未签名身份头安全用例
      - name: Test integration targets
        run: cargo nextest run -p aether-gateway --tests

      - name: Show sccache stats
        if: always()
        run: sccache --show-stats

  test_data:
    name: Test (Data)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.95.0

      - name: Show Rust toolchain
        run: rustup show active-toolchain

      - name: Rust cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          shared-key: rust-ci-${{ runner.os }}
          workspaces: . -> target

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Install nextest
        uses: taiki-e/install-action@d5f9268ff7620505a81ada10ddf18cdd72240185 # nextest

      - name: Expose PostgreSQL test binaries
        run: pg_config --bindir >> "$GITHUB_PATH"

      - name: Test
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
          AETHER_REQUIRE_LOCAL_POSTGRES_TESTS: "true"
        run: cargo nextest run -p aether-data

      - name: Show sccache stats
        if: always()
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: sccache --show-stats

  check_data_features:
    name: Check (Data Feature - ${{ matrix.feature }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        feature:
          - postgres
          - all-drivers
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.95.0

      - name: Rust cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          shared-key: rust-ci-${{ runner.os }}
          workspaces: . -> target

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Check selected data driver
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: cargo check -p aether-data --no-default-features --features ${{ matrix.feature }}

      - name: Show sccache stats
        if: always()
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: sccache --show-stats

  test_rest:
    name: Test (Workspace Rest)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.95.0

      - name: Show Rust toolchain
        run: rustup show active-toolchain

      - name: Rust cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          shared-key: rust-ci-${{ runner.os }}
          workspaces: . -> target

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Install nextest
        uses: taiki-e/install-action@d5f9268ff7620505a81ada10ddf18cdd72240185 # nextest

      - name: Test
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: cargo nextest run --workspace --exclude aether-gateway --exclude aether-data --exclude aether-integration-tests

      - name: Show sccache stats
        if: always()
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: sccache --show-stats

  test_data_adapters:
    name: Test (Data Adapter - ${{ matrix.package }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        package:
          - aether-data-postgres
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.95.0

      - name: Rust cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          shared-key: rust-ci-${{ runner.os }}
          workspaces: . -> target

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Install nextest
        uses: taiki-e/install-action@d5f9268ff7620505a81ada10ddf18cdd72240185 # nextest

      - name: Test adapter
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: cargo nextest run -p ${{ matrix.package }}

      - name: Show sccache stats
        if: always()
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: sccache --show-stats

  check_integration_scenarios:
    name: Test (Integration Scenarios)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.95.0

      - name: Rust cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          shared-key: rust-ci-${{ runner.os }}
          workspaces: . -> target

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Expose PostgreSQL test binaries
        run: pg_config --bindir >> "$GITHUB_PATH"

      - name: Test scenario binaries and end-to-end suites
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: cargo test -p aether-integration-tests --bins --tests

      - name: Show sccache stats
        if: always()
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: sccache --show-stats

  test:
    name: Test
    runs-on: ubuntu-latest
    needs:
      - test_gateway
      - test_data
      - check_data_features
      - test_rest
      - test_data_adapters
      - check_integration_scenarios
    if: ${{ always() }}
    steps:
      - name: Verify test jobs
        run: |
          if [ "${{ needs.test_gateway.result }}" != "success" ] || \
             [ "${{ needs.test_data.result }}" != "success" ] || \
             [ "${{ needs.check_data_features.result }}" != "success" ] || \
             [ "${{ needs.test_rest.result }}" != "success" ] || \
             [ "${{ needs.test_data_adapters.result }}" != "success" ] || \
             [ "${{ needs.check_integration_scenarios.result }}" != "success" ]; then
            echo "Tests failed"
            exit 1
          fi

  data_db_smoke_postgres:
    name: Data DB Smoke (Postgres)
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: aether_test
          POSTGRES_USER: aether
          POSTGRES_PASSWORD: aether
        ports:
          - 5432:5432
        options: >-
          --health-cmd="pg_isready -h 127.0.0.1 -U aether -d aether_test"
          --health-interval=5s
          --health-timeout=5s
          --health-retries=20
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.95.0

      - name: Show Rust toolchain
        run: rustup show active-toolchain

      - name: Rust cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          shared-key: rust-ci-${{ runner.os }}
          workspaces: . -> target

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Add PostgreSQL server binaries to PATH
        run: echo "$(pg_config --bindir)" >> "$GITHUB_PATH"

      - name: Run Postgres migration smoke test
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
          AETHER_TEST_POSTGRES_URL: postgres://aether:aether@127.0.0.1:5432/aether_test
        run: cargo test -p aether-data --all-features postgres_migrations_create_core_config_tables_when_url_is_set --lib -- --nocapture

      - name: Run Postgres provider metadata migration smoke test
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
          AETHER_TEST_POSTGRES_URL: postgres://aether:aether@127.0.0.1:5432/aether_test
        run: cargo test -p aether-data --all-features postgres_provider_upstream_metadata_migration_preserves_json_when_url_is_set --lib -- --nocapture

      - name: Run Postgres payment callback regression tests
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
          AETHER_TEST_DATABASE_URL: postgres://aether:aether@127.0.0.1:5432/aether_test
        run: cargo test -p aether-data-postgres live_payment_callback --lib -- --ignored --nocapture

      - name: Run Postgres API key lifecycle tests
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
          AETHER_REQUIRE_LOCAL_POSTGRES_TESTS: "true"
        run: |
          cargo test -p aether-data --all-features lifecycle::migrate::tests::postgres_request_candidates_preserve_deleted_api_key_identity --lib -- --exact --nocapture
          cargo test -p aether-data --all-features lifecycle::migrate::tests::postgres_request_candidate_migration_decouples_legacy_api_key_foreign_key --lib -- --exact --nocapture
          cargo test -p aether-data --all-features lifecycle::migrate::tests::postgres_stats_daily_api_key_migration_decouples_legacy_foreign_key --lib -- --exact --nocapture
          cargo test -p aether-data --all-features lifecycle::migrate::tests::postgres_expired_api_key_cleanup_preserves_historical_identity --lib -- --exact --nocapture
          cargo test -p aether-data --all-features lifecycle::migrate::tests::postgres_api_key_leaderboard_user_filter_preserves_aggregate_history --lib -- --exact --nocapture

      - name: Run Postgres core export smoke test
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
          AETHER_TEST_POSTGRES_URL: postgres://aether:aether@127.0.0.1:5432/aether_test
        run: cargo test -p aether-data --all-features postgres_core_export_reads_migrated_database_rows_when_url_is_set --lib -- --nocapture

      - name: Show sccache stats
        if: always()
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
        run: sccache --show-stats

  data_db_smoke:
    name: Data DB Smoke
    runs-on: ubuntu-latest
    needs:
      - data_db_smoke_postgres
    if: ${{ always() }}
    steps:
      - name: Verify database smoke jobs
        run: |
          if [ "${{ needs.data_db_smoke_postgres.result }}" != "success" ]; then
            echo "Data DB smoke failed"
            exit 1
          fi

  check:
    name: check
    runs-on: ubuntu-latest
    needs:
      - fmt
      - clippy
      - test
      - data_db_smoke
      - shell_security
    if: ${{ always() }}
    steps:
      - name: Verify required jobs
        run: |
          if [ "${{ needs.fmt.result }}" != "success" ] || \
             [ "${{ needs.clippy.result }}" != "success" ] || \
             [ "${{ needs.test.result }}" != "success" ] || \
             [ "${{ needs.data_db_smoke.result }}" != "success" ] || \
             [ "${{ needs.shell_security.result }}" != "success" ]; then
            echo "Rust CI failed"
            exit 1
          fi