build.yml

name: rustls-mbedcrypto-provider

permissions:
  contents: read

on:
  pull_request:
    paths-ignore:
      - '*.md'
      - 'LICENSE'
    branches:
      - master
      - ffdhe
  merge_group:
  schedule:
    - cron: '30 13 * * *'

env:
  CARGO_TERM_COLOR: always
  CARGO_NET_RETRY: 10
  CARGO_INCREMENTAL: 0

jobs:
  build:
    name: Build+test
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        # test a bunch of toolchains on ubuntu
        rust:
          - stable
          - beta
          - nightly
        os: [ubuntu-20.04]
        # but only stable on macos/windows (slower platforms)
        include:
          - os: macos-latest
            rust: stable
          - os: windows-latest
            rust: stable
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.rust }}-${{ matrix.os }}

      - name: Install ${{ matrix.rust }} toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}

      - name: cargo build (debug; default features)
        run: cargo build --locked
        shell: bash

      - name: cargo test (debug; all features)
        # all features include `rdrand` which is not available on macos which uses an arm cpu
        if: ${{ matrix.os != 'macos-latest' }}
        run: cargo test --locked --all-features
        shell: bash
        env:
          RUST_BACKTRACE: 1

      - name: cargo test (debug; all features available on macos)
        # all features include `rdrand` which is not available on macos which uses an arm cpu
        if: ${{ matrix.os == 'macos-latest' }}
        run: cargo test --locked --features fips
        shell: bash
        env:
          RUST_BACKTRACE: 1

      - name: cargo build (debug; rustls-mbedtls-provider-examples)
        run: cargo build --locked -p rustls-mbedtls-provider-examples

  features:
    name: Features
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2

      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: cargo build (debug; default features)
        run: cargo build --locked

      - name: cargo test (debug; default features)
        run: cargo test --locked
        env:
          RUST_BACKTRACE: 1

      - name: cargo test (debug; no default features)
        run: cargo test --locked --no-default-features --workspace

      - name: cargo test (rustls_mbedcrypto_provider; debug; no default features; tls12)
        run: cargo test --locked --no-default-features --features tls12 --package rustls-mbedcrypto-provider

      - name: cargo test (rustls_mbedcrypto_provider; debug; no default features; tls12, rdrand)
        run: cargo test --locked --no-default-features --features tls12,rdrand --package rustls-mbedcrypto-provider

      - name: cargo test + build (rustls_mbedcrypto_provider; debug; self_tests)
        run: |
          cargo build --tests --locked --features self_tests --package rustls-mbedcrypto-provider
          cargo test --locked --features self_tests --package rustls-mbedcrypto-provider

      - name: cargo test + build (rustls_mbedcrypto_provider; debug; fips)
        run: |
          cargo test --locked --features fips --package rustls-mbedcrypto-provider

      - name: cargo test (release; no run)
        run: cargo test --locked --release --no-run --workspace

# TODO: add fuzz tests

  benchmarks:
    name: Run benchmarks
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install nightly toolchain
        uses: dtolnay/rust-toolchain@nightly

      - name: Smoke-test benchmark program
        run: cargo run -p rustls-mbedcrypto-provider --release --locked --example bench
        env:
          # Ensure benchmark does not take too long time
          BENCH_MULTIPLIER: 0.3

      - name: Run micro-benchmarks
        run: cargo bench --locked --all-features
        env:
          RUSTFLAGS: --cfg=bench

  docs:
    name: Check for documentation errors
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install rust toolchain
        uses: dtolnay/rust-toolchain@nightly

      - name: cargo doc (all packages; all features)
        run: cargo doc --locked --all-features --no-deps --document-private-items
        env:
          RUSTDOCFLAGS: -Dwarnings

  coverage:
    name: Measure coverage
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2

      - name: Install rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools

      - name: Install cargo-llvm-cov
        run: cargo install cargo-llvm-cov

      - name: Measure coverage
        run: ./admin/coverage --lcov --output-path final.info

      - name: Report to codecov.io
        uses: codecov/codecov-action@v4
        with:
          file: final.info
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

  semver:
    name: Check semver compatibility
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Check semver
        uses: obi1kenobi/cargo-semver-checks-action@v2

  format:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Install rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - name: Check formatting
        run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2

      - name: Install rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - run: cargo clippy --locked --all-features --all-targets -- --deny warnings
      - run: cargo clippy --locked --no-default-features --all-targets -- --deny warnings

  clippy-nightly:
    name: Clippy (Nightly)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2

      - name: Install rust toolchain
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: clippy
      - run: cargo clippy --locked --all-features --all-targets
      - run: cargo clippy --locked --no-default-features --all-targets