# Run all tests, with or without flaky tests.

name: Tests

on:
  workflow_call:
    inputs:
      rust-version:
        description: "The version of the rust compiler to run"
        type: string
        default: "stable"
      flaky:
        description: "Whether to also run flaky tests"
        type: boolean
        default: false
      git-ref:
        description: "Which git ref to checkout"
        type: string
        default: ${{ github.ref }}

env:
  RUST_BACKTRACE: 1
  RUSTFLAGS: -Dwarnings
  RUSTDOCFLAGS: -Dwarnings
  SCCACHE_CACHE_SIZE: "10G"
  CRATES_LIST: "noq,noq-proto,noq-udp"
  NEXTEST_VERSION: "0.9.80"

# Default to read-only; jobs that need more grant it explicitly.
permissions:
  contents: read

jobs:
  build_and_test_nix:
    timeout-minutes: 30
    name: "Tests"
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        name: [ubuntu-latest, macOS-arm-latest]
        rust: ["${{ inputs.rust-version }}"]
        features: [all, none, default]
        include:
          - name: ubuntu-latest
            os: ubuntu-latest
            release-os: linux
            release-arch: amd64
            runner: [self-hosted, linux, X64]
          - name: macOS-arm-latest
            os: macOS-latest
            release-os: darwin
            release-arch: aarch64
            runner: [self-hosted, macOS, ARM64]
    env:
      # Using self-hosted runners so use local cache for sccache and
      # not SCCACHE_GHA_ENABLED.
      RUSTC_WRAPPER: "sccache"
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ inputs.git-ref }}
          persist-credentials: false

      - name: Install ${{ matrix.rust }} rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        with:
          toolchain: ${{ matrix.rust }}

      - name: Install cargo-nextest
        uses: taiki-e/install-action@b20dedce73af6905cdc30d6611090c9b67557c8d # v2.85.12
        with:
          tool: nextest@${{ env.NEXTEST_VERSION }}

      - name: Install sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      # Go is required for FIPS builds (aws-lc-rs-fips feature)
      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "stable"

      - name: Select features
        run: |
          case "${{ matrix.features }}" in
              all)
                  echo "FEATURES=--all-features" >> "$GITHUB_ENV"
                  ;;
              none)
                  echo "FEATURES=--no-default-features" >> "$GITHUB_ENV"
                  ;;
              default)
                  echo "FEATURES=" >> "$GITHUB_ENV"
                  ;;
              *)
                  exit 1
          esac

      - name: check features
        if: ${{ ! inputs.flaky }}
        run: |
          for i in ${CRATES_LIST//,/ }
          do
            echo "Checking $i $FEATURES"
            targets="--lib --bins"
            echo cargo check --locked -p $i $FEATURES $targets
            cargo check --locked -p $i $FEATURES $targets
          done
        env:
          RUST_LOG: ${{ runner.debug && 'TRACE' || 'DEBUG'}}

      - name: build tests
        run: |
          cargo nextest run --locked --workspace --exclude fuzz $FEATURES --lib --bins --tests --no-run

      - name: list ignored tests
        run: |
          cargo nextest list --locked --workspace --exclude fuzz $FEATURES --lib --bins --tests --run-ignored ignored-only

      - name: run tests
        run: |
          mkdir -p output
          cargo nextest run --locked --workspace --exclude fuzz $FEATURES --lib --bins --tests --profile ci --run-ignored "$RUN_IGNORED" $VERBOSE --no-fail-fast --message-format "$MSG_FORMAT" > "output/${OUT_NAME}.json"
        env:
          RUST_LOG: ${{ runner.debug && 'TRACE' || 'DEBUG'}}
          NEXTEST_EXPERIMENTAL_LIBTEST_JSON: 1
          RUN_IGNORED: ${{ inputs.flaky && 'all' || 'default' }}
          VERBOSE: ${{ inputs.flaky && '--verbose' || '' }}
          MSG_FORMAT: ${{ inputs.flaky && 'libtest-json' || 'human' }}
          OUT_NAME: ${{ matrix.name }}_${{ matrix.features }}_${{ matrix.rust }}

      - name: upload results
        if: ${{ failure() && inputs.flaky }}
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: libtest_run_${{ github.run_number }}-${{ github.run_attempt }}-${{ matrix.name }}_${{ matrix.features }}_${{ matrix.rust }}.json
          path: output
          retention-days: 7
          compression-level: 0

      - name: doctests
        if: ${{ (! inputs.flaky) && matrix.features == 'all' }}
        env:
          RUST_LOG: ${{ runner.debug && 'TRACE' || 'DEBUG'}}
        run: |
          cargo test --locked --workspace --all-features --doc

      - name: Check doctest features
        if: ${{ ! inputs.flaky }}
        env:
          RUST_LOG: ${{ runner.debug && 'TRACE' || 'DEBUG'}}
        run: |
          for i in ${CRATES_LIST//,/ }
          do
            echo "Checking $i doctest $FEATURES"
            echo cargo test --locked -p $i --doc $FEATURES
            cargo test --locked -p $i --doc $FEATURES
          done

      - uses: taiki-e/install-action@b20dedce73af6905cdc30d6611090c9b67557c8d # v2.85.12
        with:
          tool: cargo-make

      - name: run proptests (1 minute minimum)
        if: ${{ ! inputs.flaky }}
        run: cargo make proptests-light

  build_and_test_windows:
    timeout-minutes: 30
    name: "Tests"
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        name: [windows-latest]
        rust: ["${{ inputs.rust-version}}"]
        features: [all, none, default]
        target:
          - x86_64-pc-windows-msvc
        include:
          - name: windows-latest
            os: windows
            runner: [self-hosted, windows, x64]
    env:
      # Using self-hosted runners so use local cache for sccache and
      # not SCCACHE_GHA_ENABLED.
      RUSTC_WRAPPER: "sccache"
      # Force clang/bindgen to use MSVC target to avoid mingw headers from msys2
      BINDGEN_EXTRA_CLANG_ARGS: "--target=x86_64-pc-windows-msvc"
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ inputs.git-ref }}
          persist-credentials: false

      - name: Install ${{ matrix.rust }}
        env:
          RUST_TOOLCHAIN: ${{ matrix.rust }}
          RUST_TARGET: ${{ matrix.target }}
        run: |
          rustup toolchain install $env:RUST_TOOLCHAIN
          rustup toolchain default $env:RUST_TOOLCHAIN
          rustup target add $env:RUST_TARGET
          rustup set default-host $env:RUST_TARGET

      - name: Cache cargo-nextest
        id: cache-nextest
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ~/.cargo/bin/cargo-nextest.exe
          key: nextest-windows-${{ env.NEXTEST_VERSION }}

      - name: Install cargo-nextest
        if: steps.cache-nextest.outputs.cache-hit != 'true'
        shell: powershell
        run: |
          $tmp = New-TemporaryFile | Rename-Item -NewName { $_ -replace 'tmp$', 'zip' } -PassThru
          Invoke-WebRequest -OutFile $tmp https://get.nexte.st/${{ env.NEXTEST_VERSION }}/windows
          $outputDir = if ($Env:CARGO_HOME) { Join-Path $Env:CARGO_HOME "bin" } else { "~/.cargo/bin" }
          $tmp | Expand-Archive -DestinationPath $outputDir -Force
          $tmp | Remove-Item

      - name: Select features
        run: |
          switch ("${{ matrix.features }}") {
              "all" {
                  echo "FEATURES=--all-features" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
              }
              "none" {
                  echo "FEATURES=--no-default-features" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
              }
              "default" {
                  echo "FEATURES=" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
              }
              default {
                  Exit 1
              }
          }

      - name: Install sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
        with:
          release: false

      # FIPS dependencies for Windows
      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "stable"

      - name: Install NASM
        uses: ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b # v1.5.2

      - name: Cache Strawberry Perl
        id: cache-perl
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: C:\Strawberry
          key: strawberry-perl-5.38.2.2

      - name: Install Strawberry Perl
        if: steps.cache-perl.outputs.cache-hit != 'true'
        run: |
          Invoke-WebRequest -Uri "https://github.com/StrawberryPerl/Perl-Dist-Strawberry/releases/download/SP_53822_64bit/strawberry-perl-5.38.2.2-64bit-portable.zip" -OutFile perl.zip
          Expand-Archive perl.zip -DestinationPath C:\Strawberry -Force

      - name: Add Perl to PATH
        run: |
          echo "C:\Strawberry\perl\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          echo "C:\Strawberry\c\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

      - name: Install cmake
        uses: lukka/get-cmake@fffaaafeea488556c2c12dad60690008bc1caacb # v4.4.2

      # Install LLVM for libclang (required by bindgen for aws-lc-fips-sys)
      - name: Cache LLVM
        id: cache-llvm
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: C:\Program Files\LLVM
          key: llvm-17.0.6-windows

      - name: Install LLVM
        if: steps.cache-llvm.outputs.cache-hit != 'true'
        run: |
          $llvmUrl = "https://github.com/llvm/llvm-project/releases/download/llvmorg-17.0.6/LLVM-17.0.6-win64.exe"
          Invoke-WebRequest -Uri $llvmUrl -OutFile llvm-installer.exe
          Start-Process -FilePath .\llvm-installer.exe -ArgumentList "/S" -Wait

      - name: Add LLVM to PATH
        run: |
          echo "C:\Program Files\LLVM\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          echo "LIBCLANG_PATH=C:\Program Files\LLVM\bin" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Setup MSVC dev environment
        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0

      - name: build tests
        env:
          RUST_TARGET: ${{ matrix.target }}
        run: |
          $feat = if ($env:FEATURES) { $env:FEATURES -split '\s+' } else { @() }
          cargo nextest run --locked --workspace --exclude fuzz @feat --lib --bins --tests --target $env:RUST_TARGET --no-run

      - name: list ignored tests
        env:
          RUST_TARGET: ${{ matrix.target }}
        run: |
          $feat = if ($env:FEATURES) { $env:FEATURES -split '\s+' } else { @() }
          cargo nextest list --locked --workspace --exclude fuzz @feat --lib --bins --tests --target $env:RUST_TARGET --run-ignored ignored-only

      - name: tests
        run: |
          mkdir -p output
          $feat = if ($env:FEATURES) { $env:FEATURES -split '\s+' } else { @() }
          cargo nextest run --locked --workspace --exclude fuzz @feat --lib --bins --tests --profile ci --target $env:RUST_TARGET --run-ignored $env:RUN_IGNORED --no-fail-fast --message-format $env:MSG_FORMAT > "output/$($env:OUT_NAME).json"
        env:
          RUST_LOG: ${{ runner.debug && 'TRACE' || 'DEBUG'}}
          NEXTEST_EXPERIMENTAL_LIBTEST_JSON: 1
          RUST_TARGET: ${{ matrix.target }}
          RUN_IGNORED: ${{ inputs.flaky && 'all' || 'default' }}
          MSG_FORMAT: ${{ inputs.flaky && 'libtest-json' || 'human' }}
          OUT_NAME: ${{ matrix.name }}_${{ matrix.features }}_${{ matrix.rust }}

      - name: upload results
        if: ${{ failure() && inputs.flaky }}
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: libtest_run_${{ github.run_number }}-${{ github.run_attempt }}-${{ matrix.name }}_${{ matrix.features }}_${{ matrix.rust }}.json
          path: output
          retention-days: 1
          compression-level: 0

      - name: Cache cargo-make
        id: cache-cargo-make
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ~/.cargo/bin/cargo-make.exe
          key: cargo-make-windows-0.37.24

      - name: Install cargo-make
        if: steps.cache-cargo-make.outputs.cache-hit != 'true'
        run: cargo install cargo-make --version 0.37.24 --locked

      - name: run proptests (1 minute minimum)
        if: ${{ ! inputs.flaky }}
        run: cargo make proptests-light

  minimal-crates:
    timeout-minutes: 45
    # Ephemeral only: this job runs build scripts from unvetted versions.
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        name: [ubuntu-latest, macOS-arm-latest]
        include:
          - name: ubuntu-latest
            os: ubuntu-latest
            release-os: linux
            release-arch: amd64
            runner: ubuntu-latest
          - name: macOS-arm-latest
            os: macOS-latest
            release-os: darwin
            release-arch: aarch64
            runner: macos-latest
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # Keep the token out of .git/config, readable by any build script.
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        with:
          toolchain: nightly
      - name: Install Go (required for aws-lc-rs FIPS)
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "stable"
          cache: false
      - name: cargo check
        # No --locked: re-resolving is the point, so -Z min-publish-age guards
        # the versions the lockfile has never seen. Inline flag only, the
        # config.toml form is ignored on stable.
        run: |
          rm -f Cargo.lock
          cargo +nightly check -Z minimal-versions -Z min-publish-age \
            --config 'registry.global-min-publish-age="3 days"' \
            --workspace --exclude fuzz --all-features --lib --bins

  minimal-crates-windows:
    timeout-minutes: 30
    name: "Minimal Crates (Windows)"
    # Still self-hosted; moving to windows-latest needs sccache switched to
    # SCCACHE_GHA_ENABLED. Follow-up.
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        name: [windows-latest]
        rust: ["${{ inputs.rust-version}}"]
        target:
          - x86_64-pc-windows-msvc
        include:
          - name: windows-latest
            os: windows
            runner: [self-hosted, windows, x64]
    env:
      # Using self-hosted runners so use local cache for sccache and
      # not SCCACHE_GHA_ENABLED.
      RUSTC_WRAPPER: "sccache"
      # Force clang/bindgen to use MSVC target to avoid mingw headers from msys2
      BINDGEN_EXTRA_CLANG_ARGS: "--target=x86_64-pc-windows-msvc"
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ inputs.git-ref }}
          persist-credentials: false

      - name: Install Rust nightly
        run: |
          rustup toolchain install nightly
          rustup target add ${{ matrix.target }}
          rustup set default-host ${{ matrix.target }}

      - name: Install sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
        with:
          release: false

      - name: Install cmake
        uses: lukka/get-cmake@fffaaafeea488556c2c12dad60690008bc1caacb # v4.4.2

      - name: Install NASM
        uses: ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b # v1.5.2

      - name: Cache Strawberry Perl
        id: cache-perl
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: C:\Strawberry
          key: strawberry-perl-5.38.2.2

      - name: Install Strawberry Perl
        if: steps.cache-perl.outputs.cache-hit != 'true'
        run: |
          Invoke-WebRequest -Uri "https://github.com/StrawberryPerl/Perl-Dist-Strawberry/releases/download/SP_53822_64bit/strawberry-perl-5.38.2.2-64bit-portable.zip" -OutFile perl.zip
          Expand-Archive perl.zip -DestinationPath C:\Strawberry -Force

      - name: Add Perl to PATH
        run: |
          echo "C:\Strawberry\perl\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          echo "C:\Strawberry\c\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

      - name: Install Go (required for aws-lc-rs FIPS)
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "stable"
          cache: false

      # Install LLVM for libclang (required by bindgen for aws-lc-fips-sys)
      - name: Cache LLVM
        id: cache-llvm
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: C:\Program Files\LLVM
          key: llvm-17.0.6-windows

      - name: Install LLVM
        if: steps.cache-llvm.outputs.cache-hit != 'true'
        run: |
          $llvmUrl = "https://github.com/llvm/llvm-project/releases/download/llvmorg-17.0.6/LLVM-17.0.6-win64.exe"
          Invoke-WebRequest -Uri $llvmUrl -OutFile llvm-installer.exe
          Start-Process -FilePath .\llvm-installer.exe -ArgumentList "/S" -Wait

      - name: Add LLVM to PATH
        run: |
          echo "C:\Program Files\LLVM\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          echo "LIBCLANG_PATH=C:\Program Files\LLVM\bin" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      # Set up MSVC environment to ensure clang/bindgen uses MSVC headers instead of mingw
      - name: Setup MSVC dev environment
        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0

      - name: cargo check
        # No --locked: re-resolving is the point, so -Z min-publish-age guards
        # the versions the lockfile has never seen. Inline flag only, the
        # config.toml form is ignored on stable.
        run: |
          rm -Force Cargo.lock
          cargo +nightly check -Z minimal-versions -Z min-publish-age `
            --config 'registry.global-min-publish-age="3 days"' `
            --workspace --exclude fuzz --all-features --lib --bins