name: ci
on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with: { persist-credentials: false }
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10
        with: { toolchain: stable, components: "clippy, rustfmt" }
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - run: cargo fmt --all --check
      - run: cargo clippy --workspace --all-targets -- -D warnings
      - run: cargo test --workspace

  # The web vault's core (crates/kv-wasm/README.md): wasm32 lints, in-browser tests (IndexedDB,
  # WebCrypto), the package build and a Node smoke test of the built package.
  wasm:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with: { persist-credentials: false }
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10
        with: { toolchain: stable, components: clippy, targets: wasm32-unknown-unknown }
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - run: cargo install wasm-pack --locked
      - run: cargo clippy -p kv-wasm --target wasm32-unknown-unknown --all-targets -- -D warnings
      - run: wasm-pack test --headless --chrome crates/kv-wasm
      - run: crates/kv-wasm/build.sh
      - run: node crates/kv-wasm/js/smoke.mjs

  deny:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with: { persist-credentials: false }
      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
        with: { command: check, arguments: --all-features }

  # Builds every fuzz target and runs each for a minute from the checked-in seeds (fuzz/README.md).
  fuzz:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with: { persist-credentials: false }
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10
        with: { toolchain: nightly }
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with: { workspaces: fuzz }
      - run: cargo install cargo-fuzz --locked
      - name: Fuzz smoke run
        working-directory: fuzz
        run: |
          for t in $(cargo +nightly fuzz list); do
            mkdir -p "$RUNNER_TEMP/corpus/$t"
            cargo +nightly fuzz run "$t" "$RUNNER_TEMP/corpus/$t" "seeds/$t" -- -max_total_time=60 -max_len=4096
          done
      - if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with: { name: fuzz-artifacts, path: fuzz/artifacts }