ci.yml

name: CI

on:
  push:
    branches: [dev, main]
  pull_request:
    branches: [dev, main]

# Cancel superseded runs on the same ref (e.g. new pushes to a PR branch).
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  fmt:
    name: fmt
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # rust-toolchain.toml pins the channel/components; `rustup show` reads
      # it and installs a matching toolchain if one isn't already present, so
      # no third-party toolchain-install action is needed.
      - name: Install pinned toolchain
        run: rustup show

      - name: cargo fmt --check
        run: cargo fmt --all --check

  clippy:
    name: clippy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install pinned toolchain
        run: rustup show

      - name: Cache cargo artifacts
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      - name: cargo clippy
        run: cargo clippy --workspace --all-targets --locked -- -D warnings

  codegen:
    name: codegen
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install pinned toolchain
        run: rustup show

      - name: Cache cargo artifacts
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      - name: Verify the generated API client is up to date
        run: cargo xtask codegen --check

      - name: Generate man pages
        run: cargo xtask man target/man

      - name: Verify man pages exist
        run: |
          test -s target/man/hodeishield.1
          test -s target/man/hodeishield-vendors-list.1

  test:
    name: test
    strategy:
      fail-fast: false
      matrix:
        # windows-11-arm is the GitHub-hosted native Windows on Arm runner: the aarch64 Windows
        # build is tested where it runs, not only cross-compiled.
        os: [ubuntu-latest, macos-latest, windows-latest, windows-11-arm]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install pinned toolchain
        run: rustup show

      - name: Cache cargo artifacts
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: test-${{ matrix.os }}

      # Linux keyring backend is zbus-secret-service-keyring-store, a
      # pure-Rust D-Bus client (no libdbus / keychain required), so the test
      # suite does not need a D-Bus session or an OS keychain in CI.
      - name: cargo test
        run: cargo test --workspace --locked

      - name: cargo clippy (Windows on Arm)
        if: matrix.os == 'windows-11-arm'
        run: cargo clippy --workspace --all-targets --locked -- -D warnings

      # The Visual C++ runtime is not part of Windows: the executable must not import it (see
      # .cargo/config.toml).
      - name: Build the executable (Windows)
        if: runner.os == 'Windows'
        run: cargo build --locked -p hodeishield-cli

      - name: Check the executable needs no Visual C++ runtime
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $vswhere = Join-Path ${env:ProgramFiles(x86)} "Microsoft Visual Studio\Installer\vswhere.exe"
          if (-not (Test-Path -LiteralPath $vswhere)) { throw "vswhere.exe not found at $vswhere" }
          # The host's own toolset first (exactly what the x64 leg always used), any host otherwise.
          $arch = if ($env:RUNNER_ARCH -eq "ARM64") { "arm64" } else { "x64" }
          $dumpbin = & $vswhere -latest -products * -find "VC\Tools\MSVC\**\bin\Host$arch\$arch\dumpbin.exe" | Select-Object -First 1
          if (-not $dumpbin) { $dumpbin = & $vswhere -latest -products * -find "VC\Tools\MSVC\**\bin\Host*\*\dumpbin.exe" | Select-Object -First 1 }
          if (-not $dumpbin -or -not (Test-Path -LiteralPath $dumpbin)) { throw "dumpbin.exe not found through vswhere" }
          $exes = @(Get-ChildItem -LiteralPath target/debug -File -Filter hodeishield.exe)
          if ($exes.Count -eq 0) { throw "No .exe found to inspect in target/debug" }
          $failed = $false
          foreach ($exe in $exes) {
            $output = & $dumpbin /nologo /dependents $exe.FullName
            if ($LASTEXITCODE -ne 0) { throw "dumpbin failed on $($exe.FullName)" }
            $imports = @($output | ForEach-Object { $_.Trim() } | Where-Object { $_ -match '^\S+\.dll$' })
            if ($imports.Count -eq 0) { throw "No imports parsed from $($exe.FullName)" }
            Write-Host "$($exe.Name): $($imports -join ', ')"
            $runtime = @($imports | Where-Object { $_ -match '^(VCRUNTIME|MSVCP|CONCRT|VCOMP|VCCORLIB|MSVCR\d)' })
            if ($runtime.Count -gt 0) {
              Write-Host "::error::$($exe.Name) imports the Visual C++ runtime ($($runtime -join ', ')), which Windows does not include."
              $failed = $true
            }
          }
          if ($failed) { exit 1 }

      # The leg must build the architecture it is named after, not the host's by accident.
      - name: Check the executable targets the runner's architecture (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          EXPECTED: ${{ matrix.os == 'windows-11-arm' && 'AA64 machine (ARM64)' || '8664 machine (x64)' }}
        run: |
          $ErrorActionPreference = "Stop"
          $vswhere = Join-Path ${env:ProgramFiles(x86)} "Microsoft Visual Studio\Installer\vswhere.exe"
          # The host's own toolset first (exactly what the x64 leg always used), any host otherwise.
          $arch = if ($env:RUNNER_ARCH -eq "ARM64") { "arm64" } else { "x64" }
          $dumpbin = & $vswhere -latest -products * -find "VC\Tools\MSVC\**\bin\Host$arch\$arch\dumpbin.exe" | Select-Object -First 1
          if (-not $dumpbin) { $dumpbin = & $vswhere -latest -products * -find "VC\Tools\MSVC\**\bin\Host*\*\dumpbin.exe" | Select-Object -First 1 }
          if (-not $dumpbin -or -not (Test-Path -LiteralPath $dumpbin)) { throw "dumpbin.exe not found through vswhere" }
          $headers = & $dumpbin /nologo /headers target/debug/hodeishield.exe
          if ($LASTEXITCODE -ne 0) { throw "dumpbin /headers failed" }
          if (-not ($headers | Select-String -SimpleMatch $env:EXPECTED -Quiet)) {
            throw "hodeishield.exe is not a '$env:EXPECTED' executable"
          }

  deny:
    name: deny
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install pinned toolchain
        run: rustup show

      - name: Cache cargo artifacts
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      # Pinned to the version validated locally against deny.toml. Bumped by hand in the periodic
      # dependency review (CONTRIBUTING.md).
      - name: Install cargo-deny
        run: cargo install cargo-deny --locked --version 0.20.2

      # Each accepted advisory needs a reason and a review date that has not passed.
      - name: Accepted advisories
        run: |
          python3 -I .github/scripts/advisory-exceptions-test.py
          python3 .github/scripts/advisory-exceptions.py check

      - name: cargo deny check
        run: cargo deny check

  audit:
    name: audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install pinned toolchain
        run: rustup show

      - name: Cache cargo artifacts
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      # Pinned to the versions validated locally, the same as in the deny job and in the advisories
      # job of release.yml. Bumped by hand in the periodic dependency review (CONTRIBUTING.md).
      - name: Install cargo-audit and cargo-deny
        run: |
          cargo install cargo-audit --locked --version 0.22.2
          cargo install cargo-deny --locked --version 0.20.2

      # The check the release workflow runs on a tag: cargo audit and cargo deny, letting through
      # only the advisories accepted in deny.toml.
      - name: Advisory check
        run: bash .github/scripts/advisory-gate.sh

  # The install script: lint it, then install the latest published release with it, signature
  # check included.
  install-script:
    name: install-script
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: shellcheck
        run: shellcheck -s sh install.sh packaging/repo/*.sh packaging/build/*.sh

      # packaging/gpg.key, the README and the constant in keycheck.sh must all name the same key, and
      # the file must hold that one key and no other.
      - name: The repository key is the pinned one
        run: sh packaging/repo/keycheck.sh packaging/gpg.key README.md

      - name: Every curl call in install.sh is HTTPS-only
        run: |
          awk '
            { line = line $0 }
            /\\$/ { sub(/\\$/, "", line); next }
            line !~ /^[ \t]*#/ && line ~ /(^|[ (`;|&])curl -/ {
              seen++
              if (line !~ /--proto .=https./ || line !~ /--tlsv1\.2/) {
                print "install.sh: curl call without --proto =https and --tlsv1.2: " line; bad = 1
              }
            }
            { line = "" }
            END { if (bad || !seen) { if (!seen) print "install.sh: no curl call found"; exit 1 } }
          ' install.sh

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: "v3.1.3"

      - name: Install the latest release with the script
        run: |
          set -eu
          sh install.sh --dir "$RUNNER_TEMP/bin"
          test -x "$RUNNER_TEMP/bin/hodeishield"
          test -s "$RUNNER_TEMP/share/man/man1/hodeishield.1" || echo "no man pages in that release"
          if PATH=/usr/bin:/bin sh install.sh --dir "$RUNNER_TEMP/none" 2> "$RUNNER_TEMP/err"; then
            echo "::error::install.sh ran without cosign and without --no-verify"
            exit 1
          fi
          grep -q -- "--no-verify" "$RUNNER_TEMP/err"

      # cosign v2 reads the release's Sigstore bundles from 2.4 on, with a flag the script adds.
      - name: Install cosign v2.4
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: "v2.4.1"

      - name: Install the latest release with the script and cosign v2.4
        run: |
          set -eu
          cosign version | grep -q 'GitVersion: *v2\.4\.1'
          sh install.sh --dir "$RUNNER_TEMP/bin-v2" --no-man
          "$RUNNER_TEMP/bin-v2/hodeishield" --version

      # Older cosign versions cannot read them: the script must say which version it needs.
      - name: Install cosign v2.2
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: "v2.2.4"

      - name: The script names the cosign version it needs
        run: |
          set -eu
          cosign version | grep -q 'GitVersion: *v2\.2\.4'
          if sh install.sh --dir "$RUNNER_TEMP/bin-old" --no-man 2> "$RUNNER_TEMP/err-old"; then
            echo "::error::install.sh accepted cosign v2.2.4"
            exit 1
          fi
          grep -q "install cosign v3 (or v2.4 or newer)" "$RUNNER_TEMP/err-old"
          test ! -e "$RUNNER_TEMP/bin-old/hodeishield"

  # The repository freshness monitor must go red: its control builds small repositories with a
  # throwaway key, serves them from localhost and checks that every stale, altered, unsigned or
  # missing case fails and the current one passes. It also checks the live switch: inert only when
  # the domain serves nothing (all 404); a live repository without the key, or a fetch error that is
  # not a 404, is red.
  repo-freshness:
    name: repo-freshness
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run the control cases
        run: sh packaging/repo/freshness-test.sh

  # The script that reports OpenAPI drift in an issue, against a stand-in for gh.
  openapi-drift-issue:
    name: openapi-drift-issue
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: shellcheck
        run: shellcheck .github/scripts/openapi-drift-issue.sh .github/scripts/openapi-drift-issue-test.sh

      - name: Run the tests
        run: bash .github/scripts/openapi-drift-issue-test.sh

  # A pull request into main is a release: the version in Cargo.toml must have its notes.
  changelog:
    name: changelog
    if: github.event_name == 'pull_request' && github.base_ref == 'main'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Check the changelog has an entry for the version being released
        run: |
          set -euo pipefail
          version=$(sed -n '/^\[workspace.package\]/,/^\[/s/^version = "\(.*\)"/\1/p' Cargo.toml)
          echo "Version: $version"
          sh .github/scripts/changelog-section.sh "$version"

  commit-messages:
    name: commit-messages
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      # Same check as the local commit-msg hook (.githooks/check-message.sh).
      # Untrusted values go through env, never straight into the script.
      - name: Check commit messages and PR description
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_BODY: ${{ github.event.pull_request.body }}
          # Commits up to and including this one predate the rule and are not checked.
          MESSAGE_RULE_SINCE: f14c8b418bd37fb3c51e689edba0e668162fd90c
        run: |
          status=0
          for commit in $(git rev-list "$HEAD_SHA" ^"$BASE_SHA" ^"$MESSAGE_RULE_SINCE"); do
            if ! git log -1 --format=%B "$commit" | sh .githooks/check-message.sh 2>/dev/null; then
              echo "::error::Commit $commit mentions Claude (see CONTRIBUTING.md)"
              status=1
            fi
          done
          if ! printf '%s\n' "$PR_BODY" | sh .githooks/check-message.sh 2>/dev/null; then
            echo "::error::The PR description mentions Claude (see CONTRIBUTING.md)"
            status=1
          fi
          exit "$status"

      # Developer Certificate of Origin: every commit needs a matching
      # Signed-off-by trailer (.githooks/check-signoff.sh). Independent of the
      # step above: both run, and the job fails if either fails.
      - name: Check DCO sign-off
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          # Commits up to and including this one predate the DCO requirement and are not checked.
          DCO_SINCE: b6b722db7c85ecc89b95280d393c81b45136658c
        run: sh .githooks/check-signoff.sh "$HEAD_SHA" ^"$BASE_SHA" ^"$DCO_SINCE"