ci.yml

name: CI

permissions:
  # Doing it explicitly because the default permission only includes metadata: read.
  contents: read

on:
  workflow_dispatch:
  pull_request:
    # `labeled` reruns CI when a pull request gets the `ci: full` label, which
    # adds the jobs that pull requests otherwise skip.
    types: [opened, synchronize, labeled]
  push:
    branches:
      - main
    paths-ignore:
      - '**/*.md'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.ref_name != 'main' }}

defaults:
  run:
    shell: bash

jobs:
  detect-changes:
    runs-on: namespace-profile-linux-x64-default
    permissions:
      contents: read
      pull-requests: read
    outputs:
      code-changed: ${{ steps.filter.outputs.code }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        id: filter
        with:
          filters: |
            code:
              - '!**/*.md'

  clippy:
    needs: detect-changes
    if: needs.detect-changes.outputs.code-changed == 'true'
    name: Clippy
    runs-on: namespace-profile-linux-x64-default
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Update submodules
        run: git submodule update --init --recursive

      - uses: oxc-project/setup-rust@3d6fb132fbe7cdcb66bf8ec193911c2945369d12 # v1.0.17
        with:
          save-cache: ${{ github.ref_name == 'main' }}
          cache-key: clippy
          components: clippy

      - run: rustup target add x86_64-unknown-linux-musl
      - run: pipx install cargo-zigbuild
      # pipx isolates cargo-zigbuild in its own venv, so its ziglang dependency
      # (which bundles zig) isn't on PATH. Install zig separately.
      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1

      # --locked: verify Cargo.lock is up to date (replaces the removed `cargo check --locked`)
      - run: cargo clippy --locked --all-targets --all-features -- -D warnings

  # fspy builds only on Windows, macOS, and Linux, but vp must still build
  # without it on other platforms. Cross-building `vt_bin` for FreeBSD catches
  # fspy crates or fspy-only code leaking into its dependency graph. The rest
  # of the workspace includes the fspy crates, which don't build there.
  build-freebsd:
    needs: detect-changes
    if: needs.detect-changes.outputs.code-changed == 'true'
    name: Build (freebsd)
    runs-on: namespace-profile-linux-x64-default
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - uses: oxc-project/setup-rust@3d6fb132fbe7cdcb66bf8ec193911c2945369d12 # v1.0.17
        with:
          save-cache: ${{ github.ref_name == 'main' }}
          cache-key: freebsd

      - run: rustup target add x86_64-unknown-freebsd
      - run: pipx install cargo-zigbuild
      # pipx isolates cargo-zigbuild in its own venv, so its ziglang dependency
      # (which bundles zig) isn't on PATH. Install zig separately.
      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1

      - run: cargo-zigbuild build --locked -p vt_bin --target x86_64-unknown-freebsd

  test:
    needs: detect-changes
    if: needs.detect-changes.outputs.code-changed == 'true'
    name: Test (${{ matrix.shard }})
    env:
      # The steps, shared with `test-macos-x64`, read these instead of `matrix`.
      TEST_TARGET: ${{ matrix.target }}
      TEST_CARGO_CMD: ${{ matrix.cargo_cmd }}
      TEST_BUILD_TARGET: ${{ matrix.build_target }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: namespace-profile-linux-x64-default
            target: x86_64-unknown-linux-gnu
            cargo_cmd: cargo-zigbuild
            build_target: x86_64-unknown-linux-gnu.2.17
            shard: linux-gnu
          - os: namespace-profile-mac-default
            target: aarch64-apple-darwin
            cargo_cmd: cargo
            build_target: aarch64-apple-darwin
            shard: macos-arm64
    runs-on: ${{ matrix.os }}
    steps: &test-steps
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Update submodules
        run: git submodule update --init --recursive

      - uses: oxc-project/setup-rust@3d6fb132fbe7cdcb66bf8ec193911c2945369d12 # v1.0.17
        with:
          save-cache: ${{ github.ref_name == 'main' }}
          cache-key: test

      - run: rustup target add $TEST_TARGET

      - run: rustup target add x86_64-unknown-linux-musl
        if: env.TEST_TARGET == 'x86_64-unknown-linux-gnu'

      - run: pipx install cargo-zigbuild
        if: env.TEST_TARGET == 'x86_64-unknown-linux-gnu'

      # pipx isolates cargo-zigbuild in its own venv, so its ziglang dependency
      # (which bundles zig) isn't on PATH. Install zig separately.
      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
        if: env.TEST_TARGET == 'x86_64-unknown-linux-gnu'

      - name: Build tests
        run: $TEST_CARGO_CMD test --no-run --target $TEST_BUILD_TARGET

      # Default `cargo test` runs only tests that need nothing beyond the
      # Rust toolchain; this step verifies that contract before Node.js
      # and pnpm enter the picture.
      - name: Run tests
        run: $TEST_CARGO_CMD test --target $TEST_BUILD_TARGET

      # x86_64-apple-darwin runs on arm64 runner under Rosetta; install x64 Node
      # so fspy's x86_64 preload dylib can be injected into spawned node procs.
      - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1
        with:
          architecture: ${{ env.TEST_TARGET == 'x86_64-apple-darwin' && 'x64' || '' }}

      - name: Install runtime binaries
        run: |
          if [[ "$TEST_TARGET" == 'x86_64-apple-darwin' ]]; then
            # Bun normally prefers the native arm64 binary under Rosetta, but
            # this job needs x64 Bun so the x64 preload dylib can be injected.
            PATH="$(dirname "$(command -v node)"):$PNPM_HOME:/usr/bin:/bin" \
              pnpm --filter vite-task-tools rebuild --pending
          else
            pnpm --filter vite-task-tools rebuild --pending
          fi

      - name: Install Chromium system dependencies
        if: env.TEST_TARGET == 'x86_64-unknown-linux-gnu'
        run: pnpm --filter vite-task-tools exec playwright install-deps chromium

      - name: Run ignored tests
        run: |
          pnpm --filter vite-task-tools test
          $TEST_CARGO_CMD test --target $TEST_BUILD_TARGET -- --ignored

  # Running x64 binaries under Rosetta makes this the slowest job, so pull
  # requests run it only with the `ci: full` label.
  test-macos-x64:
    needs: detect-changes
    if: >-
      needs.detect-changes.outputs.code-changed == 'true' &&
      (github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'ci: full'))
    # No matrix: a skipped matrix job is listed under its unexpanded name.
    name: Test (macos-x64)
    runs-on: namespace-profile-mac-default
    env:
      TEST_TARGET: x86_64-apple-darwin
      TEST_CARGO_CMD: cargo
      TEST_BUILD_TARGET: x86_64-apple-darwin
      # Playwright detects the physical Apple Silicon CPU under Rosetta. Force
      # its x64 browser so fspy can inject its x64 preload.
      PLAYWRIGHT_HOST_PLATFORM_OVERRIDE: mac15
    steps: *test-steps

  # Windows tests are cross-compiled on a fast Linux runner with cargo-xwin
  # (clang-cl + lld-link against the xwin-downloaded MSVC CRT/Windows SDK)
  # and packed into a portable nextest archive. The Windows runners then only
  # download the archive and run it: no Rust toolchain or compilation on the
  # slow runners. Two nextest partitions avoid most repeated setup while keeping
  # enough parallelism for the Windows-heavy default test workload. The much
  # smaller Node-backed ignored suite runs once in its own job, avoiding
  # duplicate Windows Node setup.
  build-windows-tests:
    needs: detect-changes
    if: needs.detect-changes.outputs.code-changed == 'true'
    name: Build Windows tests
    runs-on: namespace-profile-linux-x64-default
    env:
      XWIN_ACCEPT_LICENSE: '1'
      # The MSVC STL from xwin's VS17 manifest static-asserts a minimum Clang
      # version newer than what runner images ship. Microsoft's documented
      # escape hatch lets Detours (the only C++ in the workspace, and far older
      # than any STL/clang concern here) compile with the system clang-cl.
      # cargo-xwin folds a pre-set CXXFLAGS into the env it generates.
      CXXFLAGS: -D_ALLOW_COMPILER_AND_STL_VERSION_MISMATCH
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Update submodules
        run: git submodule update --init --recursive

      # llvm-tools provides llvm-ar in the toolchain's rustlib bin dir;
      # cargo-xwin symlinks the MSVC-style llvm-lib/llvm-dlltool (used by cc-rs
      # to archive Detours) and lld-link from there when the runner image has
      # no system LLVM.
      - uses: oxc-project/setup-rust@3d6fb132fbe7cdcb66bf8ec193911c2945369d12 # v1.0.17
        with:
          save-cache: ${{ github.ref_name == 'main' }}
          cache-key: windows-cross
          components: llvm-tools

      - run: rustup target add x86_64-pc-windows-msvc

      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
        with:
          tool: cargo-nextest,cargo-xwin

      # Downloading and unpacking the MSVC CRT/Windows SDK dominates this
      # job's wall time on a cold cache; the unpacked result is immutable for a
      # given manifest version, so cache it. Bump the key when bumping the
      # xwin version.
      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: xwin-cache
        with:
          path: ~/.cache/cargo-xwin
          key: cargo-xwin-msvc-17

      - name: Build test archive
        run: |
          # cargo-xwin resolves the rustflags configured in .cargo/config.toml,
          # appends its -Lnative Windows SDK paths, and re-exports the result as
          # CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_RUSTFLAGS, so the plain cargo
          # that nextest invokes cross-compiles exactly like `cargo xwin` would.
          eval "$(cargo xwin env --target x86_64-pc-windows-msvc | grep '^export ')"
          # `cargo xwin env` renders its intended *removal* of RUSTFLAGS as
          # `export RUSTFLAGS="";` — actually remove it so it cannot shadow the
          # target-specific rustflags set above.
          unset RUSTFLAGS
          cargo nextest archive --workspace --target x86_64-pc-windows-msvc --archive-file windows-tests.tar.zst

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: windows-test-archive
          path: windows-tests.tar.zst
          retention-days: 7

      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        if: steps.xwin-cache.outputs.cache-hit != 'true'
        with:
          path: ~/.cache/cargo-xwin
          key: cargo-xwin-msvc-17

  test-windows:
    needs: build-windows-tests
    name: Test (${{ matrix.shard }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - shard: windows-1
            partition: count:1/2
            mode: default
          - shard: windows-2
            partition: count:2/2
            mode: default
          - shard: windows-ignored
            partition: ''
            mode: ignored
    runs-on: namespace-profile-windows-4c-8g
    env:
      PARTITION: ${{ matrix.partition }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      # The Detours submodule is needed at run time: fspy_detours_sys's
      # bindings test re-generates bindgen bindings against the checked-out
      # headers.
      - name: Update submodules
        run: git submodule update --init --recursive

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: windows-test-archive

      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
        with:
          tool: cargo-nextest

      # The default (non-ignored) test set needs nothing beyond the test
      # binaries themselves; this step verifies that contract before Node.js
      # and pnpm enter the picture. `cargo-nextest` is invoked directly so the
      # job never depends on the runner's Rust toolchain.
      - name: Run tests
        if: matrix.mode == 'default'
        run: cargo-nextest nextest run --archive-file windows-tests.tar.zst --workspace-remap . --partition "$PARTITION"

      - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1
        if: matrix.mode == 'ignored'

      - name: Install runtime binaries
        if: matrix.mode == 'ignored'
        run: pnpm --filter vite-task-tools rebuild --pending

      - name: Run ignored tests
        if: matrix.mode == 'ignored'
        run: |
          pnpm --filter vite-task-tools test
          cargo-nextest nextest run --archive-file windows-tests.tar.zst --workspace-remap . --run-ignored ignored-only

  # Building without a Rust cache inside the Alpine container makes this one of
  # the slowest jobs, so pull requests run it only with the `ci: full` label.
  test-musl:
    needs: detect-changes
    if: >-
      needs.detect-changes.outputs.code-changed == 'true' &&
      (github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'ci: full'))
    name: Test (musl)
    runs-on: namespace-profile-linux-x64-default
    container:
      image: node:25-alpine3.21
      options: --shm-size=256m # shm_io tests need bigger shared memory
    env:
      # Override all rustflags to skip the zig cross-linker from .cargo/config.toml.
      # Alpine's cc is already musl-native, so no custom linker is needed.
      # Must mirror [build].rustflags and target rustflags from .cargo/config.toml
      # (RUSTFLAGS env var overrides both levels).
      # -crt-static: vite-task is shipped as a NAPI module in vite+, and musl Node
      # with native modules links to musl libc dynamically, so we must do the same.
      RUSTFLAGS: -D warnings -C target-feature=-crt-static
      # On musl, concurrent PTY operations can trigger SIGSEGV in musl internals.
      # Run test threads sequentially to avoid the race.
      RUST_TEST_THREADS: 1
      # Playwright's bundled Chromium does not support musl. The browser fixture
      # is filtered out there, so avoid downloading an unusable glibc binary.
      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
    steps:
      - name: Install Alpine dependencies
        shell: sh {0}
        run: apk add --no-cache bash curl git musl-dev gcc g++ python3

      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Update submodules
        run: git submodule update --init --recursive

      - name: Install rustup
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain none
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Install Rust toolchain
        run: rustup show

      - name: Build tests
        run: cargo test --no-run

      # Default `cargo test` runs only tests that need nothing beyond the
      # Rust toolchain; this step verifies that contract before pnpm
      # populates `packages/tools/node_modules`.
      - name: Run tests
        run: cargo test

      - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1

      - name: Run ignored tests
        run: |
          pnpm --filter vite-task-tools test
          cargo test -- --ignored

  fmt:
    name: Format and Check Deps
    runs-on: namespace-profile-linux-x64-default
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Update submodules
        run: git submodule update --init --recursive

      - uses: oxc-project/setup-rust@3d6fb132fbe7cdcb66bf8ec193911c2945369d12 # v1.0.17
        with:
          save-cache: ${{ github.ref_name == 'main' }}
          cache-key: fmt
          tools: cargo-shear@1.11.1,cargo-autoinherit@0.1.6
          components: clippy rust-docs rustfmt

      - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1
      - run: pnpm exec vp fmt --check
      - run: cargo autoinherit && git diff --exit-code
      - run: cargo shear --deny-warnings
      - run: cargo fmt --check
      # --exclude fspy_benchmark: documenting it would build its musl artifact
      # dependency, which needs a rust-std this job otherwise has no use for.
      - run: RUSTDOCFLAGS='-D warnings' cargo doc --workspace --exclude fspy_benchmark --no-deps --document-private-items

      - uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
        with:
          files: .

      - name: Deduplicate dependencies
        run: pnpm dedupe --check

      - name: Check vite-task-client types are not stale
        run: |
          pnpm build-vite-task-client-types
          git diff --exit-code packages/vite-task-client/src/index.d.ts

      - name: Check test utility types
        run: pnpm --filter vite-task-tools check

  done:
    runs-on: namespace-profile-linux-x64-default
    if: always()
    needs:
      - clippy
      - build-freebsd
      - test
      - test-macos-x64
      - test-musl
      - build-windows-tests
      - test-windows
      - fmt
    steps:
      - run: exit 1
        # Thank you, next https://github.com/vercel/next.js/blob/canary/.github/workflows/build_and_test.yml#L379
        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}