rust.yml

---   # rust-bitcoin CI: If you edit this file please update README.md
on:   # yamllint disable-line rule:truthy
  push:
    branches:
      - master
      - 'test-ci/**'
  pull_request:

name: Continuous integration

permissions: {}

jobs:
  Test:
    name: Test - ${{ matrix.toolchain }} toolchain, ${{ matrix.dep }} deps
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        toolchain: [stable, nightly, msrv]
        dep: [minimal, recent]
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@af3c2868415b17eedc808da6d0589e10b7482660
      - name: "Run tests"
        run: cargo rbmt test --toolchain ${{ matrix.toolchain }} --lock-file ${{ matrix.dep }}

  Check:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        task: [api, lint, docs, docsrs, bench]
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@af3c2868415b17eedc808da6d0589e10b7482660
      - name: "Run ${{ matrix.task }}"
        run: cargo rbmt ${{ matrix.task }}

  Prerelease:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          fetch-depth: 0 # History required for version bump detection.
      - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@af3c2868415b17eedc808da6d0589e10b7482660
      - name: "Run pre-release checks"
        run: cargo rbmt prerelease --baseline ${{ github.event.pull_request.base.sha || github.event.before }}

  # Non cargo-rbmt jobs manage their toolchain version directly.
  Prepare:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    outputs:
      nightly_version: ${{ steps.read_toolchain.outputs.nightly_version }}
    steps:
      - name: "Checkout repo"
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - name: "Read workspace versions"
        id: read_toolchain
        run: echo "nightly_version=$(cargo metadata --format-version 1 | jq -r '.metadata.rbmt.toolchains.nightly')" >> $GITHUB_OUTPUT

  Arch32bit:
    name: Test 32-bit version
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: "Checkout repo"
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - name: "Select toolchain"
        uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
      - name: "Add architecture i386 and install dependencies"
        run: |
          sudo dpkg --add-architecture i386
          sudo apt-get update -y
          sudo apt-get install -y \
            gcc-multilib \
            g++-multilib \
            libc6-dev-i386 \
            lib32stdc++-13-dev
      - name: "Install i686 gcc"
        run: sudo apt-get update -y && sudo apt-get install -y gcc-multilib
      - name: "Install target"
        run: rustup target add i686-unknown-linux-gnu
      - name: "Run test on i686"
        run: cargo test --target i686-unknown-linux-gnu

  Cross:
    name: Cross test - stable toolchain
    if: ${{ !github.event.act }}
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        target:
          - s390x-unknown-linux-gnu
          - aarch64-unknown-linux-gnu
    steps:
      - name: "Checkout repo"
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - name: "Select toolchain"
        uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
      - name: "Install target"
        run: rustup target add ${{ matrix.target }}
      - name: "Install cross"
        run: cargo install cross --locked
      - name: "Run cross test"
        run: cross test --target ${{ matrix.target }}

  Embedded:
    name: Embedded - nightly toolchain
    needs: Prepare
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    env:
      RUSTFLAGS: "-C link-arg=-Tlink.x"
      CARGO_TARGET_THUMBV7M_NONE_EABI_RUNNER: "qemu-system-arm -cpu cortex-m3 -machine mps2-an385 -nographic -semihosting-config enable=on,target=native -kernel"
    steps:
      - name: "Checkout repo"
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - name: "Set up QEMU"
        run: sudo apt update && sudo apt install -y qemu-system-arm gcc-arm-none-eabi
      - name: "Select toolchain"
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: ${{ needs.Prepare.outputs.nightly_version }}
          targets: thumbv7m-none-eabi
      - name: "Install rust-src"
        run: rustup component add rust-src
      - name: "Run bitcoin/embedded"
        run: cd bitcoin/embedded && cargo run --target thumbv7m-none-eabi
      - name: "Run hashes/embedded no alloc"
        run: cd hashes/embedded && cargo run --target thumbv7m-none-eabi
      - name: "Run hashes/embedded with alloc and no hex"
        run: cd hashes/embedded && cargo run --target thumbv7m-none-eabi --features=alloc
      - name: "Run hashes/embedded with alloc and hex"
        run: cd hashes/embedded && cargo run --target thumbv7m-none-eabi --features=alloc,hex

  ASAN:                         # hashes crate only.
    name: ASAN - nightly toolchain
    needs: Prepare
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        dep: [recent]
    steps:
      - name: "Checkout repo"
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - name: "Select toolchain"
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: ${{ needs.Prepare.outputs.nightly_version }}
      - name: "Install rust-src"
        run: rustup component add rust-src
      - name: "Set dependencies"
        run: cp Cargo-${{ matrix.dep }}.lock Cargo.lock
      - name: "Run sanitizer script"
        run: cd ./hashes && ./contrib/sanitizer.sh

  Kani:
    name: Kani codegen - stable toolchain
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: "Checkout repo"
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - name: "Build Kani proofs"
        uses: model-checking/kani-github-action@f838096619a707b0f6b2118cf435eaccfa33e51f # v1.1
        with:
          args: "--only-codegen"

  Policy:
    name: Enforce repo policy - stable toolchain
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    strategy:
      fail-fast: false
    steps:
      - name: "Checkout repo"
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - name: "Select toolchain"
        uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
      - name: "Run policy script"
        run: ./contrib/check-for-policy-violations.sh

  Re-exports:
    name: Check re-exports - stable toolchain
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    strategy:
      fail-fast: false
    steps:
      - name: "Checkout repo"
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - name: "Select toolchain"
        uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
      - name: "Run primitives API checker script"
        run: |
          contrib/generate-primitives-re-export-test.sh && (cd ./primitives && cargo test --all-features)
          contrib/generate-bitcoin-re-export-test.sh && (cd ./bitcoin && cargo test --all-features)

  DiffMutants:
    name: Check cargo mutants in diff - stable toolchain
    runs-on: ubuntu-24.04
    steps:
      - name: "Checkout repo"
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          fetch-depth: 0 # required for full diff context
      - name: "Select toolchain"
        uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
      - name: "Fetch base branch for diff"
        run: git fetch origin master
      - name: "Retrieve relative diff"
        run: git diff origin/master.. -- '*.rs' | tee git.diff
      - uses: taiki-e/install-action@81ee1d48d9194cdcab880cbdc7d36e87d39874cb # v2.62.45
        with:
          tool: cargo-mutants
      - run: cargo mutants --no-shuffle --in-diff git.diff