name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -D warnings

jobs:
  rust-check:
    name: Rust — check & clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      - uses: Swatinem/rust-cache@v2
      - run: sudo apt-get update && sudo apt-get install -y libelf-dev libbpf-dev clang linux-libc-dev
      - run: cargo fmt --all --check
      - run: cargo clippy --all-targets --all-features -- -D warnings
      - run: cargo check --all-features
      - run: cargo check --no-default-features --all-targets
      - name: XDP — build binaries
        run: cargo build --features xdp --bins
      - name: XDP — smoke-check BPF compilation (clang)
        run: |
          mkdir -p target/xdp
          clang -O2 -g -target bpf -c xdp/core/universal_filter.c -o target/xdp/universal_filter.o
          test -f target/xdp/universal_filter.o

  rust-test:
    name: Rust — test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --all-features

  repo-gates:
    name: Repo — module size & default secrets
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Module size gate
        run: bash scripts/check_module_size.sh
      - name: Default secrets gate
        run: bash scripts/check_default_secrets.sh

  rust-deny:
    name: Rust — cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check

  docker:
    name: Docker — build edge image
    runs-on: ubuntu-latest
    needs: [rust-test]
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - name: Build edge
        uses: docker/build-push-action@v6
        with:
          context: .
          file: deploy/docker/Dockerfile.edge
          load: true
          tags: rampart/edge:ci