rust.yml

# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
name: Rust
# Build + test + clippy gate for the three standalone Rust crates.
# Added after a non-compiling crate (robot-repo-automaton) reached `main`
# unnoticed: the only prior Rust CI was CodeQL in build-mode `none`
# (buildless), so nothing actually compiled or tested these crates.
on:
  push:
    branches: [main]
  pull_request:
    branches: ['**']
permissions:
  actions: read
  contents: read
env:
  CARGO_TERM_COLOR: always
  # reqwest=rustls-tls, git2=vendored-openssl, gix=rust-tls. OPENSSL_NO_VENDOR
  # makes openssl-sys link the runner's preinstalled system OpenSSL instead of
  # recompiling the vendored copy (matches the documented local build).
  OPENSSL_NO_VENDOR: '1'
jobs:
  rust:
    name: build · test · clippy (${{ matrix.module }})
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        # `module` is the label used in the job name; `dir` is where the crate
        # actually lives. They differ for rhodibot, which sits under bots/ --
        # naming it `rhodibot` alone sent the job looking for a top-level
        # directory that does not exist.
        #
        # rhodibot was missing entirely until 2026-09-19, so the crate that
        # implements the GitHub App had never been built, tested or linted in
        # CI; its verification was whatever a human remembered to run locally.
        include:
          - module: robot-repo-automaton
            dir: robot-repo-automaton
          - module: shared-context
            dir: shared-context
          - module: dashboard
            dir: dashboard
          - module: rhodibot
            dir: bots/rhodibot
          # panicbot was built (panicbot-sweep.yml) but never tested or linted
          # in CI, so its private PA numbering went unnoticed until 2026-11-04.
          - module: panicbot
            dir: bots/panicbot
          - module: idris-dependents
            dir: idris-dependents
    defaults:
      run:
        working-directory: ${{ matrix.dir }}
    steps:
      - uses: actions/checkout@v7.0.1
      - name: Canon pin drift (rhodibot)
        # The rule set is copied from hyperpolymath/standards and pinned by
        # digest. This fails when the canon has moved since that pin, so a rule
        # change arrives as a reviewable commit rather than silently changing
        # what every repository is measured against.
        if: matrix.module == 'rhodibot'
        run: bash "$GITHUB_WORKSPACE/scripts/check-canon-drift.sh"
      - name: Ensure clippy + rustfmt components
        run: rustup component add clippy rustfmt
      - name: Build (all targets)
        run: cargo build --locked --all-targets --verbose
      - name: Test
        run: cargo test --locked --verbose
      - name: Clippy (deny warnings)
        run: cargo clippy --locked --all-targets -- -D warnings
      - name: Rustfmt check
        # A hard gate since 2026-10-19: all four matrix crates were measured
        # rustfmt-clean, so `continue-on-error` (hypatia RE005, a silent
        # green) no longer buys anything.
        run: cargo fmt --check

  dispatch-contracts:
    name: Dispatch path and outcome contracts
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7.0.1
        with:
          persist-credentials: false
      - run: bash scripts/tests/dispatch-paths.sh
      - name: Workflow-pin fix scripts keep their contracts
        run: bash scripts/tests/fix-workflow-pins.sh
      - name: Pre-push gate rejects missing and failed scans
        run: bash tests/pre-push-gate-test.sh

  gsbot:
    name: GSBot build, tests and dependency security
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    defaults:
      run:
        working-directory: bots/gsbot
    steps:
      - uses: actions/checkout@v7.0.1
        with:
          persist-credentials: false
      - name: Install native TLS build dependencies
        run: sudo apt-get update && sudo apt-get install -y pkg-config libssl-dev
      - name: Build and test SQLite services
        run: cargo test --locked --all-targets
      - name: Install dependency graph auditor
        run: cargo install cargo-deny --version 0.20.2 --locked
      - name: Audit enabled dependencies (no advisory exclusions)
        # Poise's unmaintained derive macro is reported as maintenance debt;
        # vulnerabilities, unsoundness and yanked crates remain blocking.
        run: |
          set -uo pipefail
          set +e
          cargo deny --locked --config deny.toml check advisories --warn unmaintained 2>&1 | tee "$RUNNER_TEMP/gsbot-advisories.log"
          statuses=("${PIPESTATUS[@]}")
          set -e
          rc=${statuses[0]}
          if [ "${statuses[1]}" -ne 0 ] && [ "$rc" -eq 0 ]; then rc=${statuses[1]}; fi
          if [ "$rc" -ne 0 ]; then
            detail=$(grep -Ei -C 3 'RUSTSEC-|error:|vulnerab|advisories FAILED|failed to|error\[' "$RUNNER_TEMP/gsbot-advisories.log" | head -c 5000 || true)
            [ -n "$detail" ] || detail='Audit failed; inspect the full job log.'
            detail=${detail//'%'/'%25'}
            detail=${detail//$'\r'/'%0D'}
            detail=${detail//$'\n'/'%0A'}
            echo "::error::GSBot dependency audit failed (exit $rc): $detail"
          fi
          exit "$rc"