ci.yml

name: Tests

# Runs on every branch push (not on tag pushes: a release tag re-tests a SHA the
# branch push already covered, and the release workflows handle tags).
# Covers:
#   - All Rust workspace members (fmt, clippy, tests)
#   - smbcloud-cli + xcrs clippy on Windows and macOS (cfg-gated code)
#   - smbcloud-auth-sdk-wasm (wasm32-unknown-unknown cargo check)
#   - sdk/python  → maturin wheel build  (smbcloud-sdk-auth)
#   - sdk/npm     → wasm-pack + prepare-package.mjs  (@smbcloud/sdk-auth)
#   - sdk/gems    → smbcloud-auth, smbcloud-model and smbcloud-email, cross-built for
#                   x86_64-linux, aarch64-linux, arm64-darwin and x86_64-darwin
#                   against the workspace crates (oldest and newest shipped
#                   Ruby), then installed and required on native runners; the
#                   source gem is built, its file list checked and installed
#   - nuget       → .NET tool launcher build         (SmbCloud.Cli)

on:
  push:
    branches: ["**"] # tag pushes (v*) re-test a SHA the branch push already covers

# Superseded pushes to a feature branch are cancelled. development and main are
# never cancelled, so every commit there keeps a result.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/development' && github.ref != 'refs/heads/main' }}

env:
  CLI_CLIENT_SECRET: ${{ secrets.CLI_CLIENT_SECRET }}
  CARGO_TERM_COLOR: always

jobs:
  # ── Rust workspace ──────────────────────────────────────────────────────────
  test-rust:
    name: Rust — fmt / clippy / test (workspace)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Read Rust toolchain
        shell: bash
        run: |
          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
          if [ -z "$rust_toolchain" ]; then
            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
            exit 1
          fi
          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"

      - name: Install toolkit
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          components: rustfmt, clippy

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          key: test-rust

      - name: Check formatting
        run: cargo fmt --all -- --check

      # smbcloud-auth-sdk-wasm targets wasm32-unknown-unknown and cannot be
      # compiled or tested on the host. It is checked in its own job below.
      - name: Clippy — all workspace members (host targets)
        run: cargo clippy --workspace --exclude smbcloud-auth-sdk-wasm --tests -- -D warnings

      - name: Test — all workspace members (host targets)
        run: cargo test --workspace --exclude smbcloud-auth-sdk-wasm

  # ── Cross-platform build ────────────────────────────────────────────────────
  # A #[cfg(unix)] mismatch type-checks on Linux and only fails on Windows, so
  # compile the packages the release workflows build on those OSes.
  check-cross-platform:
    name: Rust — clippy (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, macos-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Read Rust toolchain
        shell: bash
        run: |
          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
          if [ -z "$rust_toolchain" ]; then
            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
            exit 1
          fi
          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"

      - name: Install toolkit
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          components: clippy

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          key: check-cross-platform-${{ matrix.os }}

      - name: Clippy — smbcloud-cli and xcrs
        run: cargo clippy --locked --package smbcloud-cli --package xcrs --tests -- -D warnings

  # ── WASM crate ──────────────────────────────────────────────────────────────
  check-wasm:
    name: Rust — smbcloud-auth-sdk-wasm (wasm32-unknown-unknown)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Read Rust toolchain
        shell: bash
        run: |
          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
          if [ -z "$rust_toolchain" ]; then
            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
            exit 1
          fi
          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"

      - name: Install toolkit with wasm32 target
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          targets: wasm32-unknown-unknown

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          key: check-wasm

      - name: Check — smbcloud-auth-sdk-wasm
        run: cargo check --package smbcloud-auth-sdk-wasm --target wasm32-unknown-unknown

  # ── Python SDK ──────────────────────────────────────────────────────────────
  check-python-sdk:
    name: SDK — Python wheel (smbcloud-sdk-auth)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Read Rust toolchain
        shell: bash
        run: |
          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
          if [ -z "$rust_toolchain" ]; then
            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
            exit 1
          fi
          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"

      - name: Install toolkit
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          key: check-python-sdk

      # manylinux: 'off' runs natively on the ubuntu-latest runner without
      # spinning up a manylinux container, which is sufficient for a CI check.
      # OpenSSL is vendored in the workspace (features = ["vendored"]) so no
      # system libssl-dev is required.
      - name: Build Python wheel
        uses: PyO3/maturin-action@v1
        with:
          working-directory: sdk/python
          manylinux: "off"
          args: --release --locked --out dist

  # ── npm / WASM SDK ──────────────────────────────────────────────────────────
  check-npm-sdk:
    name: SDK — npm / WASM (@smbcloud/sdk-auth)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Read Rust toolchain
        shell: bash
        run: |
          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
          if [ -z "$rust_toolchain" ]; then
            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
            exit 1
          fi
          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"

      - name: Install toolkit with wasm32 target
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          targets: wasm32-unknown-unknown

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          key: check-npm-sdk

      # wasm-pack orchestrates the wasm32 build and wasm-bindgen code generation.
      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

      - name: Install Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc

      # prepare-package.mjs runs wasm-pack internally and then assembles the
      # dist/ directory — this validates the full npm package pipeline.
      - name: Build and prepare package
        working-directory: sdk/npm/smbcloud-auth
        run: node ./prepare-package.mjs

  # ── .NET tool ───────────────────────────────────────────────────────────────
  check-nuget-tool:
    name: NuGet — .NET tool launcher (SmbCloud.Cli)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 8.0.x

      - name: Build .NET tool launcher
        run: dotnet build nuget/smbcloud-cli/SmbCloud.Cli.csproj --configuration Release

  # ── Ruby Gems ───────────────────────────────────────────────────────────────
  # Skip the gem jobs when nothing they build from changed.
  changes:
    name: Changes — detect gem inputs
    runs-on: ubuntu-latest
    outputs:
      gems: ${{ steps.filter.outputs.gems }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Filter changed paths
        id: filter
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        with:
          filters: |
            gems:
              - "sdk/gems/auth/**"
              - "sdk/gems/model/**"
              - "sdk/gems/email/**"
              - "crates/**"
              - "Cargo.toml"
              - "Cargo.lock"
              - "rust-toolchain.toml"
              - ".ruby-version"
              - ".github/workflows/ci.yml"

  # Cross-builds each gem like release-sdk-gem.yml, but against the workspace
  # crates (not the published ones) and only for the oldest and newest Ruby the
  # release ships. Those bracket the C-API differences.
  check-ruby-gems:
    name: SDK — ${{ matrix.gem }} gem (${{ matrix.platform }})
    needs: changes
    if: needs.changes.outputs.gems == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        gem: [auth, model, email]
        platform: [x86_64-linux, aarch64-linux, arm64-darwin, x86_64-darwin]
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Read Rust toolchain
        shell: bash
        run: |
          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
          if [ -z "$rust_toolchain" ]; then
            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
            exit 1
          fi
          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"

      - name: Install toolkit
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      # CI validates the unreleased workspace version. Derive the local crate
      # patches from the extension manifest; release builds deliberately
      # resolve published crates after the release workflow has run. The
      # whole checkout is mounted into the rb-sys-dock container, so the
      # relative paths resolve there too.
      - name: Use workspace Rust crates for the gem check
        shell: bash
        run: |
          mkdir -p sdk/gems/${{ matrix.gem }}/.cargo
          {
            echo "[patch.crates-io]"
            awk -F '=' '/^smbcloud-[[:alnum:]-]+[[:space:]]*=/ {
              name = $1
              gsub(/[[:space:]]/, "", name)
              print name " = { path = \"../../../crates/" name "\" }"
            }' sdk/gems/${{ matrix.gem }}/ext/${{ matrix.gem }}/Cargo.toml
          } > sdk/gems/${{ matrix.gem }}/.cargo/config.toml
          cargo generate-lockfile --manifest-path sdk/gems/${{ matrix.gem }}/Cargo.toml

      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: .ruby-version
          bundler-cache: true
          working-directory: sdk/gems/${{ matrix.gem }}

      - name: Cross-compile native gem
        id: cross-gem
        uses: oxidize-rb/actions/cross-gem@v1
        with:
          platform: ${{ matrix.platform }}
          ruby-versions: "3.1,4.0"
          working-directory: sdk/gems/${{ matrix.gem }}
          cache-version: ci-${{ matrix.gem }}

      - name: Upload gem artifact
        uses: actions/upload-artifact@v7
        with:
          name: ci-gem-${{ matrix.gem }}-${{ matrix.platform }}
          path: ${{ steps.cross-gem.outputs.gem-path }}
          retention-days: 1

  # Install each prebuilt gem on a native runner and require it, which takes
  # the real load path (the per-Ruby lib/<gem>/<x.y>/ bundle first). Catches
  # load-time breakage such as a dyld-rejected install name.
  smoke-test-ruby-gems:
    name: Smoke — ${{ matrix.gem }} ${{ matrix.platform }} (Ruby ${{ matrix.ruby }})
    needs: check-ruby-gems
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        gem: [auth, model, email]
        ruby: ["3.1", "4.0"]
        platform: [x86_64-linux, aarch64-linux, arm64-darwin]
        include:
          - platform: x86_64-linux
            runner: ubuntu-latest
          - platform: aarch64-linux
            runner: ubuntu-24.04-arm
          - platform: arm64-darwin
            runner: macos-latest
          - gem: auth
            constant: SmbCloud::Auth
          - gem: model
            constant: Model
          - gem: email
            constant: SmbCloud::Email
    steps:
      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: ${{ matrix.ruby }}

      - name: Download gem artifact
        uses: actions/download-artifact@v7
        with:
          name: ci-gem-${{ matrix.gem }}-${{ matrix.platform }}
          path: gem

      - name: Install the gem
        shell: bash
        run: gem install gem/*.gem

      # No checkout in this job, so only the installed gem can satisfy the require.
      - name: Require the gem
        shell: bash
        run: ruby -e 'require "${{ matrix.gem }}"; puts ${{ matrix.constant }}'

  # Builds the source gem from git ls-files and installs it, compiling from
  # source once. Catches spec.files problems (symlinks, missing Cargo files)
  # that only surface on a user's machine.
  check-ruby-source-gems:
    name: SDK — ${{ matrix.gem }} source gem
    needs: changes
    if: needs.changes.outputs.gems == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        gem: [auth, model, email]
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Read Rust toolchain
        shell: bash
        run: |
          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
          if [ -z "$rust_toolchain" ]; then
            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
            exit 1
          fi
          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"

      - name: Install toolkit
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Use workspace Rust crates for the gem check
        shell: bash
        run: |
          mkdir -p sdk/gems/${{ matrix.gem }}/.cargo
          {
            echo "[patch.crates-io]"
            awk -F '=' '/^smbcloud-[[:alnum:]-]+[[:space:]]*=/ {
              name = $1
              gsub(/[[:space:]]/, "", name)
              print name " = { path = \"../../../crates/" name "\" }"
            }' sdk/gems/${{ matrix.gem }}/ext/${{ matrix.gem }}/Cargo.toml
          } > sdk/gems/${{ matrix.gem }}/.cargo/config.toml

      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: .ruby-version
          bundler-cache: true
          working-directory: sdk/gems/${{ matrix.gem }}

      # `gem build`, not `rake build`: the latter depends on :compile.
      - name: Build the source gem
        working-directory: sdk/gems/${{ matrix.gem }}
        run: |
          mkdir -p pkg
          gem build ${{ matrix.gem }}.gemspec --output pkg/${{ matrix.gem }}-source.gem

      - name: Check the source gem file list
        working-directory: sdk/gems/${{ matrix.gem }}
        shell: bash
        run: |
          files="$(gem spec pkg/${{ matrix.gem }}-source.gem files | sed -n 's/^- //p')"
          echo "$files"
          fail=0
          require() {
            if ! grep -Eq "$1" <<<"$files"; then
              echo "::error::source gem is missing $2" >&2
              fail=1
            fi
          }
          require "^ext/${{ matrix.gem }}/extconf\.rb$" "ext/${{ matrix.gem }}/extconf.rb"
          require '^ext/.*\.rs$' "ext/**/*.rs"
          require '(^|/)Cargo\.toml$' "Cargo.toml"
          require '(^|/)Cargo\.lock$' "Cargo.lock"
          if grep -Eq '(^|/)(target|tmp)/' <<<"$files"; then
            echo "::error::source gem contains target/ or tmp/ paths" >&2
            fail=1
          fi
          while IFS= read -r f; do
            if [ -L "$f" ]; then
              echo "::error::source gem contains the symlink $f" >&2
              fail=1
            fi
          done <<<"$files"
          exit "$fail"

      - name: Install the source gem
        working-directory: sdk/gems/${{ matrix.gem }}
        run: gem install pkg/${{ matrix.gem }}-source.gem