name: ci

on:
  push:
  pull_request:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  # Oracle-backed interoperability tests must run, not skip, in CI.
  VAULT_REQUIRE_ORACLE: "1"

jobs:
  lint:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5
      - run: rustup show active-toolchain || rustup toolchain install
      - run: cargo fmt --check
      - run: cargo clippy --locked --all-targets --all-features -- -D warnings

  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, ubuntu-24.04-arm, macos-15, macos-15-intel, windows-2025]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
      # The Go toolchain builds the test-only oracle; vault itself needs no Go.
      - uses: actions/setup-go@v6
        with:
          go-version: "1.26.x"
          cache-dependency-path: oracle/go/go.sum
      - run: rustup show active-toolchain || rustup toolchain install
      - name: test
        shell: bash
        run: |
          if [[ $RUNNER_OS == Windows ]]; then unset VAULT_REQUIRE_ORACLE; fi
          cargo test --locked --all-targets --all-features
      - run: cargo test --locked --doc
      - run: cargo build --locked --release
      - name: oracle self-test
        if: runner.os == 'Linux'
        working-directory: oracle/go
        run: go test ./...

  cross:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-go@v6
        with:
          go-version: "1.26.x"
          cache-dependency-path: oracle/go/go.sum
      - run: rustup show active-toolchain || rustup toolchain install
      - name: zig and cargo-zigbuild
        run: |
          curl -sSLo zig.tar.xz https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz
          echo "70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00  zig.tar.xz" | sha256sum -c
          mkdir -p "$HOME/zig" && tar -xJf zig.tar.xz -C "$HOME/zig" --strip-components=1
          echo "$HOME/zig" >>"$GITHUB_PATH"
          cargo install cargo-zigbuild --version 0.23.4 --locked
          cargo install cross --version 0.2.5 --locked
      - name: targets
        run: |
          rustup target add x86_64-unknown-linux-musl aarch64-unknown-linux-musl i686-unknown-linux-musl \
            arm-unknown-linux-musleabihf armv7-unknown-linux-musleabihf riscv64gc-unknown-linux-musl \
            loongarch64-unknown-linux-musl powerpc64le-unknown-linux-musl \
            s390x-unknown-linux-gnu x86_64-pc-windows-gnu i686-pc-windows-gnu aarch64-pc-windows-gnullvm \
            x86_64-unknown-freebsd i686-unknown-freebsd
      - name: build
        run: |
          # Everything but macOS, which the test job builds on a Mac.
          TARGETS="linux/amd64 linux/arm64 linux/386 linux/armv6 linux/armv7 linux/riscv64 linux/loong64 \
            linux/ppc64le linux/s390x windows/amd64 windows/386 windows/arm64 freebsd/amd64 freebsd/386" ./build.sh
      - name: run builds under qemu, cross-checked with the Go oracle
        run: |
          sudo apt-get update -q && sudo apt-get install -yq qemu-user libc6-s390x-cross
          (cd oracle/go && go build -o ../../target/vault-go .)
          for t in "arm64 qemu-aarch64" "armv7 qemu-arm" "riscv64 qemu-riscv64" "ppc64le qemu-ppc64le" \
                   "s390x qemu-s390x -L /usr/s390x-linux-gnu"; do
            EMU="${t#* }" scripts/smoke.sh "dist/vault-linux-${t%% *}" target/vault-go
          done
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  supply-chain:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5
      - run: rustup show active-toolchain || rustup toolchain install
      - run: cargo install cargo-deny --version 0.20.2 --locked
      - run: cargo deny --locked check

  fuzz:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5
      - run: rustup toolchain install nightly-2026-10-01 --profile minimal
      - run: cargo +nightly-2026-10-01 install cargo-fuzz --version 0.13.2 --locked
      - name: a short run of every target
        working-directory: fuzz
        run: |
          for t in $(cargo +nightly-2026-10-01 fuzz list); do
            cargo +nightly-2026-10-01 fuzz run "$t" -- -max_total_time=60
          done