rust.yml

name: rust
on:
  pull_request:
  push:
    branches:
      - main
env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -D warnings
  JUST_TIMESTAMP: true
  JUST_COLOR: always
  JUST_EXPLAIN: true
  JUST_VERBOSE: 4
  CARGO_PROFILE_LINT_DEBUG: 0
  CARGO_PROFILE_DOCS_DEBUG: 0
  CARGO_PROFILE_COVERAGE_DEBUG: line-tables-only
  CARGO_PROFILE_NEXTEST_DEBUG: 0
  CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER: rust-lld.exe
  # Use content checksums instead of file mtimes for cargo's fingerprints.
  # `actions/checkout` rewrites source mtimes on every run, which would
  # otherwise invalidate cached workspace-crate artifacts even when the
  # content is unchanged. See rust-lang/cargo#14136.
  CARGO_UNSTABLE_CHECKSUM_FRESHNESS: "true"
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/') }}
jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      lint: ${{ steps.filter.outputs.lint }}
      fmt: ${{ steps.filter.outputs.fmt }}
      fmt-comments: ${{ steps.filter.outputs.fmt-comments }}
      fmt-markdown: ${{ steps.filter.outputs.fmt-markdown }}
      typecheck-js: ${{ steps.filter.outputs.typecheck-js }}
      test: ${{ steps.filter.outputs.test }}
      docs: ${{ steps.filter.outputs.docs }}
      coverage: ${{ steps.filter.outputs.coverage }}
      deny: ${{ steps.filter.outputs.deny }}
      insta: ${{ steps.filter.outputs.insta }}
      shear: ${{ steps.filter.outputs.shear }}
      vet: ${{ steps.filter.outputs.vet }}
      qual: ${{ steps.filter.outputs.qual }}
    steps:
      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6
        with:
          fetch-depth: 0
      - id: filter
        shell: bash
        run: |
          set -euo pipefail

          if [ "${{ github.event_name }}" = "pull_request" ]; then
            git diff --name-only HEAD^1 HEAD > changed-files.txt
          else
            before="${{ github.event.before }}"
            if [ "$before" = "0000000000000000000000000000000000000000" ]; then
              git diff-tree --no-commit-id --name-only -r HEAD > changed-files.txt
            else
              git diff --name-only "$before" HEAD > changed-files.txt
            fi
          fi

          matches() {
            grep -Eq "$1" changed-files.txt
          }

          set_task() {
            if matches "$2"; then
              echo "$1=true" >> "$GITHUB_OUTPUT"
            else
              echo "$1=false" >> "$GITHUB_OUTPUT"
            fi
          }

          workflow='^\.github/workflows/rust\.yml$'
          justfile='^justfile$'
          cargo='(^|/)Cargo\.toml$|^Cargo\.lock$|^rust-toolchain\.toml$'
          rust='\.rs$'
          markdown='\.md$|\.markdown$'
          javascript='\.js$|\.d\.ts$|(^|/)tsconfig\.json$'
          snapshots='\.snap$|^\.config/insta\.yaml$'
          source="$rust|$cargo|$workflow|$justfile"

          set_task lint "$source|^\.clippy\.toml$"
          set_task fmt "$rust|^\.rustfmt\.toml$|$workflow|$justfile"
          set_task fmt-comments "$rust|$workflow|$justfile"
          set_task fmt-markdown "$markdown|$workflow|$justfile"
          set_task typecheck-js "$javascript|$workflow|$justfile"
          set_task test "$source|$snapshots"
          set_task docs "$source"
          set_task coverage "$source|$snapshots"
          set_task deny "$cargo|^deny\.toml$|^\.config/supply-chain/|$workflow|$justfile"
          set_task insta "$source|$snapshots"
          set_task shear "$source"
          set_task vet "$cargo|^\.config/supply-chain/|$workflow|$justfile"
          set_task qual "$source|^\.config/rustqual/"
  rust:
    needs: changes
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest]
        task: [lint, fmt, fmt-comments, fmt-markdown, typecheck-js, test, docs, coverage, deny, insta, shear, vet, qual]
        include:
          - task: test
            os: windows-latest
            name_suffix: " (windows)"
            cache_suffix: "-windows"
            # Restoring a 3.9 GB `target/` cache costs Windows more than
            # compiling from a warm sccache does, so this job caches only
            # `~/.cargo` and lets sccache carry compilation.
            cache_targets: "false"
            # Windows pays a steep per-file cost to unpack, compile and link, so
            # PR runs cover only the crates that make up `jp` itself. The Linux
            # `test` job still builds and tests everything on every PR, and
            # `main` covers the full workspace on Windows too.
            scope: ${{ github.ref == 'refs/heads/main' && 'workspace' || 'jp-only' }}
    name: ${{ matrix.task }}${{ matrix.name_suffix }}
    # A run without a target cache falls back to a full build. Cap it so a
    # pathological run doesn't burn an hour of Windows minutes unnoticed.
    timeout-minutes: 60
    steps:
      - name: Decide whether to run task
        id: task
        shell: bash
        env:
          TASK: ${{ matrix.task }}
          LINT: ${{ needs.changes.outputs.lint }}
          FMT: ${{ needs.changes.outputs.fmt }}
          FMT_COMMENTS: ${{ needs.changes.outputs.fmt-comments }}
          FMT_MARKDOWN: ${{ needs.changes.outputs.fmt-markdown }}
          TYPECHECK_JS: ${{ needs.changes.outputs.typecheck-js }}
          TEST: ${{ needs.changes.outputs.test }}
          DOCS: ${{ needs.changes.outputs.docs }}
          COVERAGE: ${{ needs.changes.outputs.coverage }}
          DENY: ${{ needs.changes.outputs.deny }}
          INSTA: ${{ needs.changes.outputs.insta }}
          SHEAR: ${{ needs.changes.outputs.shear }}
          VET: ${{ needs.changes.outputs.vet }}
          QUAL: ${{ needs.changes.outputs.qual }}
        run: |
          set -euo pipefail

          case "$TASK" in
            lint) run="$LINT" ;;
            fmt) run="$FMT" ;;
            fmt-comments) run="$FMT_COMMENTS" ;;
            fmt-markdown) run="$FMT_MARKDOWN" ;;
            typecheck-js) run="$TYPECHECK_JS" ;;
            test) run="$TEST" ;;
            docs) run="$DOCS" ;;
            coverage) run="$COVERAGE" ;;
            deny) run="$DENY" ;;
            insta) run="$INSTA" ;;
            shear) run="$SHEAR" ;;
            vet) run="$VET" ;;
            qual) run="$QUAL" ;;
            *) echo "unknown task: $TASK" >&2; exit 1 ;;
          esac

          echo "run=$run" >> "$GITHUB_OUTPUT"
          if [ "$run" != "true" ]; then
            echo "Skipping $TASK because no relevant files changed."
          fi
      - if: ${{ steps.task.outputs.run == 'true' }}
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6
      - if: ${{ steps.task.outputs.run == 'true' }}
        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
        id: restore-cache
        with:
          path: |
            ~/.rustup
          key: toolchain-${{ matrix.task }}${{ matrix.cache_suffix }}-${{ hashFiles('rust-toolchain.toml') }}
          # Prefix match, so a toolchain bump falls back to the previous entry
          # instead of paying for a full rustup download.
          restore-keys: |
            toolchain-${{ matrix.task }}${{ matrix.cache_suffix }}
      - if: ${{ steps.task.outputs.run == 'true' }}
        uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3
      - if: ${{ steps.task.outputs.run == 'true' }}
        uses: Swatinem/rust-cache@7e1e2d0a10862b34e5df481373b2b0f295d1a2ef # v2
        with:
          key: ${{ matrix.task }}
          cache-bin: false
          cache-workspace-crates: true
          cache-targets: ${{ matrix.cache_targets || 'true' }}
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - if: ${{ steps.task.outputs.run == 'true' && matrix.task != 'coverage' && matrix.task != 'shear' }}
        uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # V0.10
      - if: ${{ steps.task.outputs.run == 'true' && matrix.task != 'coverage' && matrix.task != 'shear' }}
        # `bash` is required: on Windows the default shell is PowerShell, where
        # `$GITHUB_ENV` is an empty PowerShell variable rather than a bash env
        # reference, so the redirect silently appends to nothing and the wrapper
        # never propagates to `cargo`.
        shell: bash
        run: |
          echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
          echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
      # `rust-cache` strips `~/.cargo/registry/src` before saving, so the first
      # cargo invocation of the job re-extracts every `.crate` archive. That is
      # the single most expensive non-build phase on Windows. Doing it in a
      # named step keeps the cost visible instead of burying it in the silent
      # `cargo metadata` that `cargo nextest run` shells out to on startup.
      - name: Warm the registry source tree
        if: ${{ steps.task.outputs.run == 'true' && matrix.task == 'test' }}
        shell: bash
        run: cargo metadata --locked --format-version 1 > /dev/null
      - if: ${{ steps.task.outputs.run == 'true' && matrix.task == 'typecheck-js' }}
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      - if: ${{ steps.task.outputs.run == 'true' }}
        run: just ${{ matrix.task }}-ci ${{ matrix.scope }}
      - if: ${{ matrix.task == 'coverage' && steps.task.outputs.run == 'true' }}
        uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2
        with:
          file: lcov.info
          fail-on-error: false
      - if: ${{ github.ref == 'refs/heads/main' && steps.task.outputs.run == 'true' && steps.restore-cache.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
        with:
          path: |
            ~/.rustup
          key: ${{ steps.restore-cache.outputs.cache-primary-key }}