tests-rust.yml

name: Tests (Rust)

# The Rust half of packages/protect-ffi. Path-filtered and separate from
# tests.yml because it is the only Rust in the repo.
#
# Since the absorption these checks ran NOWHERE. Phase 1 deliberately moved
# `cargo test` + `cargo fmt --check` behind `test:cargo` and clippy behind
# `mise run lint:rust`, to keep cargo off every contributor's default
# `pnpm test` — but no root workflow picked them back up.
# `packages/protect-ffi/src/lintWiring.test.ts` asserts the split from the
# manifest side; this is the other half, and that test now reads this file.
#
# The filter is broader than `crates/**`: dependency, feature and toolchain
# changes all alter what cargo builds without touching a .rs file.

on:
  pull_request:
    paths:
      - 'packages/protect-ffi/crates/**'
      - 'packages/protect-ffi/Cargo.toml'
      - 'packages/protect-ffi/Cargo.lock'
      - 'packages/protect-ffi/mise.toml'
      - 'packages/protect-ffi/package.json'
      # Out of that package, and compiled by every check below all the same:
      # `crates/protect-ffi/Cargo.toml` carries
      # `eql-bindings = { path = "../../../eql/crates/eql-bindings" }`, so
      # `cargo test`, `cargo fmt --check` and both clippy passes build that
      # tree. A change there can break this job in a PR touching no file under
      # packages/protect-ffi at all. The workspace root manifest comes with it:
      # cargo reads it for the crate's workspace context, so a
      # `<key>.workspace = true` added to eql-bindings becomes a compile input
      # with no other trace. Same two entries as the native cache key in
      # `.github/actions/build-ffi-binding`, which is where the list is derived
      # from — pinned by
      # scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs.
      #
      # This is the only copy: `push:` below is `branches: [main]` with no
      # `paths:`, so main runs a superset of what PRs run (recorded as a
      # deliberate asymmetry in workflow-paths-filter-parity.test.mjs).
      - 'packages/eql/crates/**'
      - 'packages/eql/Cargo.toml'
      - '.github/workflows/tests-rust.yml'
  push:
    branches: [main]
  workflow_dispatch: {}

permissions:
  contents: read

defaults:
  run:
    shell: bash

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  rust:
    name: cargo test + clippy + rustfmt
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      # `working_directory` is load-bearing, not tidiness. mise reads config
      # from the current directory and its PARENTS, so an action running at the
      # repo root never sees packages/protect-ffi/mise.toml — it would install
      # nothing and leave the config untrusted. A later `mise run` then fails
      # with "Config files ... are not trusted", which reads as a toolchain
      # problem rather than a trust one.
      #
      # Caching is allowed here: this workflow publishes nothing, so
      # scripts/lint-no-workflow-caching.mjs does not cover it. That matters —
      # `cargo:cargo-zigbuild` builds from source, and the cache makes it a
      # one-off rather than a per-run cost.
      #
      # SHA-pinned rather than `@v3`: mise-action is a third-party trust
      # dependency the absorption introduced, and the tag is mutable. Same pin
      # as .github/actions/build-ffi-binding — keep the two in step.
      # scripts/__tests__/ffi-binding-action.test.mjs asserts both.
      - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
        with:
          install: true
          working_directory: packages/protect-ffi

      # `--all-targets` in the clippy invocation means all target KINDS (lib,
      # bins, tests, benches), not all platform targets — it lints the host and
      # nothing else. wasm32 needs its own invocation, and it is the build that
      # ships to edge runtimes with the least test coverage behind it.
      - name: Add wasm32 target
        run: rustup target add wasm32-unknown-unknown

      - uses: pnpm/action-setup@v6.0.10
        with:
          run_install: false

      - uses: actions/setup-node@v6.5.0
        with:
          node-version: 22
          cache: 'pnpm'

      # node-pty's install hook falls back to `node-gyp rebuild` when no
      # linux-x64 prebuild matches. pnpm/action-setup v6 no longer ships
      # node-gyp on PATH, so install it explicitly.
      #
      # This job compiles no JS and runs no pty — it needs `pnpm install` only
      # to reach the `test:cargo` script. But node-pty is the repo's one entry
      # in `pnpm.onlyBuiltDependencies`, its install hook fires on every
      # workspace install, and the 1.1.0 tarball ships prebuilds for darwin and
      # win32 ONLY. So the fallback is unconditional on a Linux runner, and
      # without this step the job dies in `Install dependencies` with
      # `sh: 1: node-gyp: not found` — before cargo is ever invoked.
      # Enforced by scripts/__tests__/workflow-node-gyp.test.mjs.
      - name: Install node-gyp
        run: npm install -g node-gyp

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: cargo test + rustfmt
        run: pnpm --filter @cipherstash/protect-ffi run test:cargo

      # `lint:rust` is the aggregate entry point, and running it by name rather
      # than its arms is the point: an arm reachable only by name is an arm
      # nobody runs (#145). lintWiring.test.ts asserts every `lint:rust:*` task
      # is in its `depends` list.
      - name: clippy (host + wasm32)
        working-directory: packages/protect-ffi
        run: mise run lint:rust