lint.yml

name: Lint

on:
  workflow_dispatch:
  push:
    branches: ["main"]
  pull_request:

permissions: {}

env:
  CARGO_TERM_COLOR: always

jobs:
  check:
    name: Check Style
    runs-on: ubuntu-24.04
    needs: style
    if: always()
    steps:
      - name: Verify all style checks passed
        if: ${{ needs.style.result != 'success' }}
        run: exit 1

  style:
    name: ${{ matrix.check }}

    runs-on: ubuntu-24.04

    permissions:
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        include:
          - check: fmt
            needs_rust: true
            needs_rust_nightly: true
          - check: clippy
            needs_rust: true
          - check: sort
            needs_rust: true
          - check: udeps
            needs_rust: true
            needs_rust_nightly: true
          - check: dylint
            needs_rust: true
          - check: doc
            needs_rust: true
          - check: prettier
            needs_node: true
          - check: dep-ownership
            needs_node: true
          - check: cargo-lock
            needs_rust: true

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set Rust toolchain version
        if: matrix.needs_rust
        id: toolchain
        shell: bash
        run: |
          RUST_TOOLCHAIN="$(grep -oP '^channel.*"(\K.*?)(?=")' rust-toolchain.toml)"
          echo "RUST_TOOLCHAIN=${RUST_TOOLCHAIN}" | tee -a "${GITHUB_OUTPUT}"

      - name: Set Rust nightly toolchain version
        if: matrix.needs_rust_nightly
        id: nightly-toolchain
        shell: bash
        run: |
          RUST_NIGHTLY_TOOLCHAIN="$(grep -oP '^nightly-channel.*"(\K.*?)(?=")' rust-toolchain.toml)"
          echo "RUST_NIGHTLY_TOOLCHAIN=${RUST_NIGHTLY_TOOLCHAIN}" | tee -a "${GITHUB_OUTPUT}"

      - name: Install Rust
        if: matrix.needs_rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: "${{ steps.toolchain.outputs.RUST_TOOLCHAIN }}"
          components: clippy, rustfmt

      - name: Install Rust nightly
        if: matrix.needs_rust_nightly
        env:
          RUST_NIGHTLY_TOOLCHAIN: ${{ steps.nightly-toolchain.outputs.RUST_NIGHTLY_TOOLCHAIN }}
        run: |
          rustup toolchain install "${RUST_NIGHTLY_TOOLCHAIN}"
          rustup component add rustfmt --toolchain "${RUST_NIGHTLY_TOOLCHAIN}"-x86_64-unknown-linux-gnu

      - name: Cache cargo registry
        if: matrix.needs_rust
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2

      # Cache cargo-run-bin's built tools (.bin) separately from rust-cache. The
      # tools depend only on their pinned versions (Cargo.toml) and the toolchain,
      # not on Cargo.lock, so this key avoids rust-cache's lockfile rotation. Keyed
      # per check so each one caches only the tools it builds, with no contention
      # (rust-cache keys all matrix checks under one shared job-based key).
      - name: Cache cargo-run-bin tools
        if: matrix.needs_rust
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: .bin
          key: cargo-bin-${{ runner.os }}-${{ matrix.check }}-${{ hashFiles('Cargo.toml', 'rust-toolchain.toml') }}
          restore-keys: |
            cargo-bin-${{ runner.os }}-${{ matrix.check }}-

      - name: Install cargo-run-bin
        if: matrix.needs_rust
        run: cargo install cargo-run-bin --locked --version 1.7.4

      - name: Check cargo-binstall is not configured
        if: matrix.needs_rust
        run: ./scripts/check-no-binstall.sh

      - name: Run clippy with SARIF output
        if: matrix.check == 'clippy'
        # Pass `-D warnings` to clippy directly rather than via RUSTFLAGS so the
        # deny level applies only to the linted crates, not to the from-source
        # builds of clippy-sarif/sarif-fmt that `cargo bin` triggers in this step
        # (some of their transitive deps emit warnings we don't control).
        run: cargo clippy --all-features --all-targets --message-format=json -- -D warnings |
          cargo bin clippy-sarif | tee clippy_result.sarif | cargo bin sarif-fmt

      - name: Upload clippy results to GitHub
        if: matrix.check == 'clippy'
        uses: github/codeql-action/upload-sarif@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v4.32.1
        with:
          sarif_file: clippy_result.sarif
          sha: ${{ contains(github.event_name, 'pull_request') && github.event.pull_request.head.sha || github.sha }}
          ref: ${{ contains(github.event_name, 'pull_request') && format('refs/pull/{0}/head', github.event.pull_request.number) || github.ref }}

      - name: Set up Node
        if: matrix.needs_node
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          cache: "npm"
          cache-dependency-path: "package-lock.json"
          node-version: "16"

      - name: NPM setup
        if: matrix.needs_node
        run: npm ci

      - name: Run lint --only ${{ matrix.check }}
        run: ./scripts/lint.sh --only ${{ matrix.check }}