rust.yml

name: CI

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

permissions:
  contents: read
  security-events: write

env:
  CARGO_TERM_COLOR: always

jobs:
  # ─── Lint ────────────────────────────────────────────────────────────
  lint:
    name: Lint (clippy + fmt)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          components: clippy, rustfmt

      - name: Install system dependencies
        run: |
          sudo apt-get -o Acquire::Retries=3 update
          sudo apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
            libpipewire-0.3-dev libwayland-dev pkg-config

      - name: Cache cargo registry and build
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Check formatting
        run: cargo fmt -- --check

      - name: Install SARIF tools
        run: cargo install clippy-sarif sarif-fmt

      - name: Run clippy (SARIF + gate)
        shell: bash
        run: |
          set -o pipefail
          cargo clippy --all-targets --all-features --message-format=json -- -D warnings \
            | clippy-sarif \
            | tee rust-clippy-results.sarif \
            | sarif-fmt

      - name: Upload clippy results to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
        with:
          sarif_file: rust-clippy-results.sarif
          wait-for-processing: true
        if: always()

  # ─── Deny ────────────────────────────────────────────────────────────
  deny:
    name: Deny (licenses + advisories + bans)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Install cargo-deny
        run: cargo install cargo-deny --version 0.19.4 --locked

      - name: Run cargo deny
        run: cargo deny check

  # ─── Test ────────────────────────────────────────────────────────────
  test:
    name: Test (unit)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Install system dependencies
        run: |
          sudo apt-get -o Acquire::Retries=3 update
          sudo apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
            libpipewire-0.3-dev libwayland-dev pkg-config

      - name: Cache cargo registry and build
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      # NOTE: PipeWire integration tests (tests/pipewire_integration.rs) require
      # --features pipewire-test and a live PipeWire session. They are not run here.
      # Run manually: cargo test --features pipewire-test
      - name: Run unit tests
        run: cargo test --verbose

  # ─── Build ──────────────────────────────────────────────────────────
  build:
    name: Build (release)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Install system dependencies
        run: |
          sudo apt-get -o Acquire::Retries=3 update
          sudo apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
            libpipewire-0.3-dev libwayland-dev pkg-config

      - name: Cache cargo registry and build
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Build release binary
        run: cargo build --release

      - name: Check binary size
        run: |
          BINARY="target/release/honkhonk"
          SIZE=$(stat --format=%s "$BINARY")
          SIZE_MB=$(echo "scale=2; $SIZE / 1048576" | bc)
          echo "Binary size: ${SIZE_MB} MB"

          # Fail if binary exceeds 30 MB
          MAX_BYTES=$((30 * 1048576))
          if [ "$SIZE" -gt "$MAX_BYTES" ]; then
            echo "::error::Binary size ${SIZE_MB} MB exceeds 30 MB limit"
            exit 1
          fi

  # ─── LOC Check ──────────────────────────────────────────────────────
  # Only runs on pull requests — measures LOC delta vs base branch.
  loc-check:
    name: LOC delta check
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Compute LOC delta
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          # Count added+removed lines, excluding Cargo.lock, test fixtures, and generated files
          DELTA=$(git diff --stat "$BASE_SHA"..."$HEAD_SHA" -- \
            ':!Cargo.lock' \
            ':!tests/fixtures/**' \
            ':!src/generated/**' \
            | tail -1 \
            | grep -oP '\d+ insertion' | grep -oP '^\d+' || echo 0)

          DELETIONS=$(git diff --stat "$BASE_SHA"..."$HEAD_SHA" -- \
            ':!Cargo.lock' \
            ':!tests/fixtures/**' \
            ':!src/generated/**' \
            | tail -1 \
            | grep -oP '\d+ deletion' | grep -oP '^\d+' || echo 0)

          TOTAL=$((DELTA + DELETIONS))
          echo "LOC delta: +${DELTA} -${DELETIONS} (total churn: ${TOTAL})"

          if [ "$TOTAL" -gt 500 ]; then
            echo "::warning::LOC delta (${TOTAL}) exceeds 500-line limit. Consider splitting this PR."
          fi