ci.yml

name: CI

on:
  push:
    branches: ["*"]
  pull_request:
  workflow_dispatch:

# Cancel in-progress runs when a new commit is pushed
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  # Minimum supported Rust version
  MSRV: "1.82"

jobs:
  # ==========================================================================
  # Format check
  # ==========================================================================
  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: Check formatting
        run: cargo fmt --all -- --check

  # ==========================================================================
  # Clippy lints
  # ==========================================================================
  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Run Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

  # ==========================================================================
  # Tests
  # ==========================================================================
  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Run tests
        run: cargo test --all-features

      - name: Run doc tests
        run: cargo test --doc

  # ==========================================================================
  # MSRV check
  # ==========================================================================
  msrv:
    name: MSRV (1.82)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust ${{ env.MSRV }}
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.MSRV }}

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Check MSRV
        run: cargo check --all-features

  # ==========================================================================
  # Documentation
  # ==========================================================================
  docs:
    name: Documentation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Build docs
        run: cargo doc --no-deps --all-features
        env:
          RUSTDOCFLAGS: -D warnings

  # ==========================================================================
  # Build
  # ==========================================================================
  build:
    name: Build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
          - target: x86_64-apple-darwin
            os: macos-latest
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-pc-windows-msvc
            os: windows-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install cross-compilation tools
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu

      - name: Install musl tools
        if: matrix.target == 'x86_64-unknown-linux-musl'
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      - name: Build
        run: cargo build --release --target ${{ matrix.target }}
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: apc-${{ matrix.target }}
          path: |
            target/${{ matrix.target }}/release/apc
            target/${{ matrix.target }}/release/apc.exe
          if-no-files-found: ignore

  # ==========================================================================
  # Benchmarks
  # ==========================================================================
  benchmark:
    name: Benchmark
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Run benchmarks
        run: cargo bench --bench benchmarks -- --noplot --save-baseline ci

      - name: Check benchmark results
        run: |
          echo "Benchmark completed successfully!"
          echo "Key benchmark results:"
          echo "======================"
          # Parse and display key metrics from Criterion output
          for dir in target/criterion/*/new; do
            if [ -d "$dir" ]; then
              bench_name=$(basename $(dirname "$dir"))
              if [ -f "$dir/estimates.json" ]; then
                mean=$(grep -o '"point_estimate":[0-9.]*' "$dir/estimates.json" | head -1 | cut -d: -f2)
                if [ -n "$mean" ]; then
                  # Convert to human-readable format
                  if (( $(echo "$mean < 1000" | bc -l) )); then
                    echo "$bench_name: ${mean}ns"
                  elif (( $(echo "$mean < 1000000" | bc -l) )); then
                    echo "$bench_name: $(echo "scale=2; $mean/1000" | bc)µs"
                  else
                    echo "$bench_name: $(echo "scale=2; $mean/1000000" | bc)ms"
                  fi
                fi
              fi
            fi
          done

      - name: Verify performance thresholds
        run: |
          # Define performance thresholds (in nanoseconds)
          # These are based on current benchmark results with 50% margin
          declare -A THRESHOLDS=(
            ["detector_detect"]=25000000        # 25ms max (current ~14µs)
            ["detector_detect_with_custom_vars"]=25000000  # 25ms max
            ["config_parsing_full"]=20000000    # 20ms max (current ~9µs)
            ["config_parsing_minimal"]=10000000 # 10ms max (current ~4µs)
            ["config_default"]=2000000          # 2ms max (current ~550ns)
            ["config_validation"]=1000000       # 1ms max (current ~33ns)
          )

          FAILED=0
          for bench_name in "${!THRESHOLDS[@]}"; do
            threshold=${THRESHOLDS[$bench_name]}
            estimates_file="target/criterion/$bench_name/new/estimates.json"

            if [ -f "$estimates_file" ]; then
              mean=$(grep -o '"point_estimate":[0-9.]*' "$estimates_file" | head -1 | cut -d: -f2)
              if [ -n "$mean" ]; then
                # Compare using bc for floating point
                if (( $(echo "$mean > $threshold" | bc -l) )); then
                  echo "❌ REGRESSION: $bench_name exceeded threshold!"
                  echo "   Current: ${mean}ns, Threshold: ${threshold}ns"
                  FAILED=1
                else
                  echo "✓ $bench_name: ${mean}ns (threshold: ${threshold}ns)"
                fi
              fi
            fi
          done

          if [ $FAILED -eq 1 ]; then
            echo ""
            echo "Performance regression detected! Please investigate."
            exit 1
          fi

          echo ""
          echo "All benchmarks within acceptable thresholds."

  # ==========================================================================
  # Security audit
  # ==========================================================================
  security:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install cargo-audit
        run: cargo install cargo-audit

      - name: Run audit
        run: cargo audit

  # ==========================================================================
  # Coverage
  # ==========================================================================
  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Generate coverage
        run: cargo llvm-cov --all-features --lcov --output-path lcov.info

      - name: Upload to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: lcov.info
          fail_ci_if_error: false

  # ==========================================================================
  # All checks passed - THIS IS THE REQUIRED CHECK FOR BRANCH PROTECTION
  # Set "CI Success" as a required status check in GitHub branch protection
  # ==========================================================================
  ci-success:
    name: CI Success
    needs: [fmt, clippy, test, msrv, docs, build, benchmark, security, coverage]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Check all jobs passed
        run: |
          if [[ "${{ needs.fmt.result }}" != "success" ]] || \
             [[ "${{ needs.clippy.result }}" != "success" ]] || \
             [[ "${{ needs.test.result }}" != "success" ]] || \
             [[ "${{ needs.msrv.result }}" != "success" ]] || \
             [[ "${{ needs.docs.result }}" != "success" ]] || \
             [[ "${{ needs.build.result }}" != "success" ]] || \
             [[ "${{ needs.benchmark.result }}" != "success" ]] || \
             [[ "${{ needs.security.result }}" != "success" ]] || \
             [[ "${{ needs.coverage.result }}" != "success" ]]; then
            echo "One or more jobs failed"
            exit 1
          fi
          echo "All CI checks passed!"