rust.yml

name: Rust

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  rust:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8  # pinned SHA
        with:
          toolchain: stable
          components: clippy, rustfmt

      - name: Cache Rust artifacts
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0  # v2.9.3

      - name: Check formatting
        run: cargo fmt --all --check

      - name: Run tests
        run: cargo test --workspace

      - name: Run clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      # The published schemas are generated from the catalogs; a catalog change
      # that does not regenerate them would ship a stale contract.
      - name: Check generated JSON Schemas are current
        run: |
          cargo run -p rtblint-core --example export_json_schemas
          if ! git diff --quiet -- schemas; then
            echo "schemas/ is out of date. Run: cargo run -p rtblint-core --example export_json_schemas"
            git --no-pager diff --stat -- schemas
            exit 1
          fi

  proto:
    name: Proto contract
    runs-on: ubuntu-latest
    steps:
      # buf breaking compares this commit against the tip of main, so the job
      # needs real history rather than the default shallow clone.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
        with:
          node-version: '20'

      # buf comes from the npm devDependency, so its version is pinned by the
      # lockfile rather than by whatever the runner happens to have.
      - name: Install buf
        run: npm ci

      - name: buf lint
        run: npx buf lint

      - name: buf format check
        run: npx buf format --diff --exit-code

      # The backward-compatibility gate. Any change to a published field number,
      # field type, enum value, or RPC signature fails here rather than being
      # found by a consumer after release.
      #
      # Compare against the PR base SHA. `.git#branch=main` fails on pull_request
      # checkouts: they have origin/main as a remote-tracking ref, not a local
      # branch named main, so buf's clone of .git cannot find that ref.
      - name: buf breaking
        if: github.event_name == 'pull_request'
        run: npx buf breaking --against ".git#ref=${{ github.event.pull_request.base.sha }}"

  wasm:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8  # pinned SHA
        with:
          toolchain: stable
          targets: wasm32-unknown-unknown

      - name: Cache Rust artifacts
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0  # v2.9.3

      - name: Build WASM crate
        run: cargo build -p rtblint-wasm --target wasm32-unknown-unknown

      - name: Smoke-test committed npm package
        run: |
          workspace_version=$(grep '^version = ' Cargo.toml | head -1 | cut -d'"' -f2)
          node <<EOF
          const r = require("./npm/index.cjs");
          const out = r.validate(JSON.stringify({ id: "ci", imp: [{ id: "i", banner: {} }] }));
          if (!out.valid) {
            throw new Error("committed wasm artifact failed smoke test: " + JSON.stringify(out));
          }
          const pkg = require("./npm/package.json");
          if (r.coreVersion() !== "$workspace_version" || pkg.version !== "$workspace_version") {
            throw new Error("version drift: workspace $workspace_version, wasm " + r.coreVersion() + ", package.json " + pkg.version + ". Rebuild npm/wasm.");
          }
          console.log("npm wasm ok, core", r.coreVersion());
          EOF

  fuzz:
    name: Fuzz (${{ matrix.target }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target: [validate, validate_response, validate_artf]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8  # pinned SHA
        with:
          toolchain: nightly

      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0  # v2.9.3

      - name: Install cargo-fuzz
        run: cargo install cargo-fuzz

      - name: Seed corpus from test fixtures
        run: |
          mkdir -p fuzz/corpus/${{ matrix.target }}
          case "${{ matrix.target }}" in
            validate)
              cp crates/rtblint-core/tests/fixtures/bid-requests/*.json fuzz/corpus/${{ matrix.target }}/ 2>/dev/null || true
              ;;
            validate_response)
              cp crates/rtblint-core/tests/fixtures/bid-responses/*.json fuzz/corpus/${{ matrix.target }}/ 2>/dev/null || true
              ;;
            validate_artf)
              cp crates/rtblint-core/tests/fixtures/artf/*.json fuzz/corpus/${{ matrix.target }}/ 2>/dev/null || true
              ;;
          esac

      - name: Run fuzzer (30 s)
        run: |
          cargo +nightly fuzz run ${{ matrix.target }} \
            fuzz/corpus/${{ matrix.target }} \
            -- -max_total_time=30 -timeout=10