name: rustls

permissions:
  contents: read

on:
  push:
    branches: ['main', 'ci/*']
  pull_request:
  merge_group:
  schedule:
    - cron: '0 18 * * *'
  workflow_dispatch:

jobs:
  build:
    name: Build+test
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        # test a bunch of toolchains on ubuntu
        rust:
          - stable
          - beta
          - nightly
        os: [ubuntu-latest]
        # but only stable on macos/windows (slower platforms)
        include:
          - os: macos-latest
            rust: stable
          - os: windows-latest
            rust: stable
    steps:
      - name: Checkout sources
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Install ${{ matrix.rust }} toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}

      - name: Install NASM for aws-lc-rs on Windows
        if: runner.os == 'Windows'
        uses: ilammy/setup-nasm@v1

      - name: cargo build (debug; default features)
        run: cargo build --locked

      - name: cargo test (debug; default features)
        run: cargo test --locked
        env:
          RUST_BACKTRACE: 1

      - name: cargo test (debug; all features)
        run: cargo test --locked --all-features
        env:
          RUST_BACKTRACE: 1

      - name: cargo build (debug; no default features)
        run: cargo build --locked --no-default-features

      - name: cargo test (debug; no default features; no run)
        run: cargo test --locked --no-default-features --no-run

      - name: cargo test (release; no run)
        run: cargo test --locked --release --no-run

      # https://github.com/rustls/rustls-native-certs/issues/179
      # - name: run macOS integration test
      #  if: matrix.os == 'macos-latest'
      #  run: sudo bash integration-tests/macos.sh

  msrv:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - name: Checkout sources
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Install MSRV toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.71"

      - run: cargo check --locked --lib --all-features

  minimal-versions:
    name: Check minimum versions of direct dependencies
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Install rust toolchain
        uses: dtolnay/rust-toolchain@nightly

      - name: Install cargo-minimal-versions
        uses: taiki-e/install-action@cargo-minimal-versions

      # cargo-minimal-versions requires cargo-hack
      - name: Install cargo-hack
        uses: taiki-e/install-action@cargo-hack

      - name: Check direct-minimal-versions
        run: cargo minimal-versions --direct --ignore-private check

  semver:
    name: Check semver compatibility
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Check semver
        uses: obi1kenobi/cargo-semver-checks-action@v2

  docs:
    name: Check for documentation errors
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Install rust toolchain
        uses: dtolnay/rust-toolchain@nightly

      - name: cargo doc (rustls; all features)
        run: cargo doc --locked --all-features --no-deps --document-private-items
        env:
          RUSTDOCFLAGS: -Dwarnings

  format:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Install rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - name: Check formatting
        run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Install rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - run: cargo clippy --locked --all-features --all-targets -- --deny warnings

  clippy-nightly:
    name: Clippy (Nightly)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Install rust toolchain
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: clippy
      - run: cargo clippy --locked --all-features --all-targets -- --deny warnings