rust.yml

name: Rust

on:
  pull_request:
    paths:
      - .github/workflows/rust.yml
      - Cargo.lock
      - '**/Cargo.toml'
      - justfile
      - deny.toml
      - '**/*.rs'
      - policy-*/Dockerfile
      - rust-toolchain

permissions:
  contents: read

env:
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  PROTOC_NO_VENDOR: 1
  RUST_BACKTRACE: short
  RUSTUP_MAX_RETRIES: 10

jobs:
  audit:
    timeout-minutes: 10
    runs-on: ubuntu-latest
    strategy:
      matrix:
        checks:
          - advisories
          - bans licenses sources
    # Prevent sudden announcement of a new advisory from failing Ci.
    continue-on-error: ${{ matrix.checks == 'advisories' }}
    steps:
    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
    - uses: EmbarkStudios/cargo-deny-action@e0a440755b184aa50374330fa75cca0f84fcb59a
      with:
        command: check ${{ matrix.checks }}

  fmt:
    timeout-minutes: 5
    runs-on: ubuntu-latest
    container: ghcr.io/linkerd/dev:v40-rust
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
      - run: just rs-check-fmt

  clippy:
    timeout-minutes: 10
    runs-on: ubuntu-latest
    container: ghcr.io/linkerd/dev:v40-rust
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
      - run: just rs-fetch
      - run: just rs-clippy
      - run: just rs-doc --no-deps

  check:
    timeout-minutes: 20
    runs-on: ubuntu-latest
    container: ghcr.io/linkerd/dev:v40-rust
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - run: just rs-fetch
      - run: just rs-check-dirs

  test:
    name: test
    runs-on: ubuntu-latest
    timeout-minutes: 15
    container: ghcr.io/linkerd/dev:v40-rust
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - run: just rs-fetch
      - run: just rs-test-build
      - run: just rs-test

  rust-toolchain:
    name: rust toolchain
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - run: |
          ex=0

          # Check this workflow against the version in rust-toolchain.
          versions=$(sed -nE 's|.*docker://(.*/)?rust:([^ #]+).*|\2|p' .github/workflows/*)
          for mismatch in $(echo "$versions" | grep -vF "$(cat rust-toolchain)" || true) ; do
            echo "::error file=.github/workflows/rust.yml::Workflow uses incorrect rust version(s): $mismatch"
            ex=$((ex + 1))
          done

          exit $ex