name: CI

on:
  push:
    branches: ['main', '0.8.x']
  pull_request:
  merge_group:
  schedule:
    - cron: "21 3 * * 5"

jobs:
  test-freebsd:
  # see https://github.com/actions/runner/issues/385
  # use https://github.com/vmactions/freebsd-vm for now
    name: test on freebsd
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: test on freebsd
        uses: vmactions/freebsd-vm@v1
        with:
          usesh: true
          mem: 4096
          copyback: false
          prepare: |
            pkg install -y curl
            curl https://sh.rustup.rs -sSf --output rustup.sh
            sh rustup.sh -y --profile minimal --default-toolchain stable
          run: |
            export PATH="$HOME/.cargo/bin:$PATH"
            echo "===== rustc --version ====="
            rustc --version
            echo "===== freebsd-version ====="
            freebsd-version

            cargo build --locked --all-targets && cargo test --locked && cargo test --locked -- --ignored stress && cargo test --locked --manifest-path fuzz/Cargo.toml && cargo test --locked -p quinn-udp --benches

  test-solaris:
    name: test on solaris
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: test on Solaris
        uses: vmactions/solaris-vm@v1
        with:
          release: "11.4-gcc"
          usesh: true
          mem: 4096
          copyback: false
          prepare: |
            source <(curl -s https://raw.githubusercontent.com/psumbera/solaris-rust/refs/heads/main/sh.rust-web-install)
            echo "~~~~ rustc --version ~~~~"
            rustc --version
            echo "~~~~ Solaris-version ~~~~"
            uname -a
          # Unlike others, don't un-ignore stress tests, because they hang on Solaris
          run: |
            export PATH=$HOME/.rust_solaris/bin:$PATH
            # Workaround for https://github.com/quinn-rs/quinn/issues/2218
            export CARGO_HTTP_MULTIPLEXING=false
            cargo build --locked --all-targets && cargo test --locked --manifest-path fuzz/Cargo.toml && cargo test --locked -p quinn-udp --benches

  test-illumos:
    name: test on illumos
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: test on Illumos
        uses: vmactions/omnios-vm@v1
        with:
          usesh: true
          mem: 4096
          copyback: false
          prepare: |
            pkg install gcc14 curl pkg-config glib2
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
          run: |
            . "$HOME/.cargo/env"
            cargo build --locked --all-targets && cargo test --locked && cargo test --locked -- --ignored stress && cargo test --locked --manifest-path fuzz/Cargo.toml && cargo test --locked -p quinn-udp --benches

  test:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        rust: [stable, beta]
        exclude:
          - os: macos-latest
            rust: beta
          - os: windows-latest
            rust: beta

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --locked --all-targets
      - run: cargo test --locked
      - run: cargo test --locked -p quinn-udp --features fast-apple-datapath
        if: ${{ runner.os }} == "macOS"
      - run: cargo test --locked -- --ignored stress
      - run: cargo test --locked --manifest-path fuzz/Cargo.toml
        if: ${{ matrix.rust }} == "stable"
      - run: cargo test --locked -p quinn-udp --benches
      - run: cargo test --locked -p quinn-udp --benches --features fast-apple-datapath
        if: ${{ runner.os }} == "macOS"

  test-aws-lc-rs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      # Prevent feature unification from selecting *ring* as the crypto provider
      - run: RUST_BACKTRACE=1 cargo test --locked --manifest-path quinn-proto/Cargo.toml --no-default-features --features rustls-aws-lc-rs
      - run: RUST_BACKTRACE=1 cargo test --locked --manifest-path quinn/Cargo.toml --no-default-features --features rustls-aws-lc-rs,runtime-tokio
      - run: RUST_BACKTRACE=1 cargo test --locked --manifest-path quinn/Cargo.toml --no-default-features --features rustls-aws-lc-rs,runtime-tokio,__rustls-post-quantum-test
      # FIPS
      - run: RUST_BACKTRACE=1 cargo test --locked --manifest-path quinn-proto/Cargo.toml --no-default-features --features rustls-aws-lc-rs-fips
      - run: RUST_BACKTRACE=1 cargo test --locked --manifest-path quinn/Cargo.toml --no-default-features --features rustls-aws-lc-rs-fips,runtime-tokio
      - run: RUST_BACKTRACE=1 cargo test --locked --manifest-path quinn/Cargo.toml --no-default-features --features rustls-aws-lc-rs-fips,__rustls-post-quantum-test,runtime-tokio

  wasm_test:
    name: test wasm32-unknown-unknown
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - run: rustup target add wasm32-unknown-unknown
      - uses: actions/setup-node@v6
        with:
          node-version: 20
      - uses: bytecodealliance/actions/wasm-tools/setup@v1
      - uses: cargo-bins/cargo-binstall@main

      - run: cargo test --locked -p quinn-proto --target wasm32-unknown-unknown --no-run
      - run: cargo check --locked -p quinn-udp --target wasm32-unknown-unknown --no-default-features --features=tracing,log
      - run: cargo rustc --locked -p quinn --target wasm32-unknown-unknown --no-default-features --features=tracing-log,platform-verifier,rustls-ring --crate-type=cdylib

      # If the Wasm file contains any 'import "env"' declarations, then
      # some non-Wasm-compatible code made it into the final code.
      - name: Ensure no 'import "env"' in quinn_proto Wasm
        run: |
          ! wasm-tools print --skeleton target/wasm32-unknown-unknown/debug/deps/quinn_proto-*.wasm | grep 'import "env"'
      - name: Ensure no 'import "env"' in quinn Wasm
        run: |
          ! wasm-tools print --skeleton target/wasm32-unknown-unknown/debug/quinn.wasm | grep 'import "env"'

      # Match the version of wasm-bindgen used in `Cargo.lock`
      - run: cargo binstall wasm-bindgen-cli@0.2.105 --locked --no-confirm
      - run: cargo test --locked -p quinn-proto --target wasm32-unknown-unknown

  msrv:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      # Note that we must also update the README when changing the MSRV
      - uses: dtolnay/rust-toolchain@1.74.1
      - uses: Swatinem/rust-cache@v2
      - run: cargo check --locked --lib --all-features -p quinn-udp -p quinn-proto -p quinn

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo fmt --all -- --check
      - run: cargo check --locked --manifest-path quinn/Cargo.toml --all-targets --no-default-features
      - run: cargo clippy --locked --all-targets -- -D warnings
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - name: doc
        run: cargo doc --locked --no-deps --document-private-items
        env:
          RUSTDOCFLAGS: -Dwarnings
      - name: lint fuzz
        run: |
          cd fuzz
          cargo clippy --locked -- -D warnings

  audit:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v5
    - uses: EmbarkStudios/cargo-deny-action@v2

  test-android:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        target: [x86_64-linux-android, i686-linux-android]
        emulator-arch: [x86_64, x86]
        api-level: [26, 25]
        exclude:
          - target: x86_64-linux-android
            emulator-arch: x86
          - target: i686-linux-android
            emulator-arch: x86_64

    steps:
    - name: Set API level environment variable
      run: echo "API_LEVEL=${{ matrix.api-level }}" >> $GITHUB_ENV

    - name: Checkout code
      uses: actions/checkout@v5

    - name: Install JDK
      uses: actions/setup-java@v5
      with:
        distribution: 'zulu'
        java-version: '21'

    - name: Install Android SDK
      uses: android-actions/setup-android@v3

    - name: Install Android NDK
      run: sdkmanager --install "ndk;25.2.9519653"

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable
      with:
        toolchain: stable
        target: ${{ matrix.target }}

    - uses: Swatinem/rust-cache@v2

    - name: Install cargo-ndk
      run: cargo install cargo-ndk

    - name: Build unit tests for Android
      run: cargo ndk -t ${{ matrix.target }} test --no-run

    - name: Enable KVM group perms
      run: |
        echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
        sudo udevadm control --reload-rules
        sudo udevadm trigger --name-match=kvm

    - name: Set up Android Emulator and run tests
      env:
        TARGET: ${{ matrix.target }}
      uses: reactivecircus/android-emulator-runner@v2
      with:
        api-level: ${{ matrix.api-level }}
        arch: ${{ matrix.emulator-arch }}
        script: .github/workflows/rust-android-run-tests-on-emulator.sh

  features:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    env:
      RUSTFLAGS: -Dwarnings
      # skip FIPS features outside of Linux
      SKIP_FEATURES: ${{ matrix.os != 'ubuntu-latest' && 'rustls-aws-lc-rs-fips,aws-lc-rs-fips,__rustls-post-quantum-test' || '' }}
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: taiki-e/install-action@cargo-hack
      - run: cargo hack check --feature-powerset --depth 3 --optional-deps --no-dev-deps --ignore-private --skip "${{env.SKIP_FEATURES}}"