firezone/.github/workflows/_rust.yml

---
name: Rust
"on":
  workflow_call:

defaults:
  run:
    working-directory: ./rust

permissions:
  contents: "read"
  id-token: "write"

# Never tolerate warnings. Duplicated in `_tauri.yml`
env:
  RUSTFLAGS: "-Dwarnings --cfg tokio_unstable"
  RUSTDOCFLAGS: "-D warnings"

jobs:
  static-analysis:
    name: static-analysis-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        # TODO: https://github.com/rust-lang/cargo/issues/5220
        runs-on: [ubuntu-22.04, macos-14, windows-2022]
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./.github/actions/setup-rust
        id: setup-rust
      - uses: ./.github/actions/setup-tauri-v2
        timeout-minutes: 10
      - uses: taiki-e/install-action@84c20235bedc3797c7e1ddf685c574a4a6c666da # v2.52.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tool: cargo-udeps,cargo-deny
      - uses: taiki-e/install-action@84c20235bedc3797c7e1ddf685c574a4a6c666da # v2.52.2
        if: ${{ runner.os == 'Linux' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tool: bpf-linker

      - run: cargo clippy --all-targets --all-features ${{ steps.setup-rust.outputs.compile-packages }}
        name: cargo clippy
        shell: bash
      - run: cargo doc --all-features --no-deps --document-private-items ${{ steps.setup-rust.outputs.compile-packages }}
        name: cargo doc
        shell: bash
      - run: cargo fmt -- --check
      - run: cargo +${{ steps.setup-rust.outputs.nightly_version }} udeps --all-targets --all-features ${{ steps.setup-rust.outputs.compile-packages }}
        name: cargo udeps
      - run: cargo deny check --hide-inclusion-graph --deny unnecessary-skip
        shell: bash

  test:
    name: test-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        # TODO: https://github.com/rust-lang/cargo/issues/5220
        runs-on:
          [
            ubuntu-22.04,
            ubuntu-24.04,
            macos-13,
            macos-14,
            macos-15,
            windows-2019,
            windows-2022,
          ]
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./.github/actions/setup-rust
        id: setup-rust
      - uses: ./.github/actions/setup-tauri-v2
      - uses: taiki-e/install-action@84c20235bedc3797c7e1ddf685c574a4a6c666da # v2.52.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tool: ripgrep
      - uses: taiki-e/install-action@84c20235bedc3797c7e1ddf685c574a4a6c666da # v2.52.2
        if: ${{ runner.os == 'Linux' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tool: bpf-linker
      - name: "cargo test"
        shell: bash
        run: |

          set -x

          # First, run all tests.
          cargo test --all-features ${{ steps.setup-rust.outputs.test-packages }} -- --include-ignored --nocapture

          # Poor man's test coverage testing: Grep the generated logs for specific patterns / lines.
          rg --count --no-ignore SendIcmpPacket $TESTCASES_DIR
          rg --count --no-ignore SendUdpPacket $TESTCASES_DIR
          rg --count --no-ignore SendTcpPayload $TESTCASES_DIR
          rg --count --no-ignore SendDnsQueries $TESTCASES_DIR
          rg --count --no-ignore "Packet for DNS resource" $TESTCASES_DIR
          rg --count --no-ignore "Packet for CIDR resource" $TESTCASES_DIR
          rg --count --no-ignore "Packet for Internet resource" $TESTCASES_DIR
          rg --count --no-ignore "Performed IP-NAT46" $TESTCASES_DIR
          rg --count --no-ignore "Performed IP-NAT64" $TESTCASES_DIR
          rg --count --no-ignore "Truncating DNS response" $TESTCASES_DIR
          rg --count --no-ignore "Destination is unreachable" $TESTCASES_DIR
          rg --count --no-ignore "Forwarding query for DNS resource to corresponding site" $TESTCASES_DIR

        env:
          # <https://github.com/rust-lang/cargo/issues/5999>
          # Needed to create tunnel interfaces in unit tests
          CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER: "sudo --preserve-env"
          PROPTEST_VERBOSE: 0 # Otherwise the output is very long.
          PROPTEST_CASES: ${{ runner.os == 'Windows' && '0' || '256' }} # Default is only 256. Windows is very slow in GitHub Actions, so only run the regression cases there.
          CARGO_PROFILE_TEST_OPT_LEVEL: 1 # Otherwise the tests take forever.
          TESTCASES_DIR: "connlib/tunnel/testcases"

  # Runs the Tauri client smoke test, built in debug mode. We can't run it in release
  # mode because of a known issue: <https://github.com/firezone/firezone/blob/456e044f882c2bb314e19cc44c0d19c5ad817b7c/rust/windows-client/src-tauri/src/client.rs#L162-L164>
  gui-smoke-test:
    name: gui-smoke-test-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        runs-on: [ubuntu-22.04, ubuntu-24.04, windows-2019, windows-2022]
    runs-on: ${{ matrix.runs-on }}
    defaults:
      run:
        # Must be in this dir for `pnpm` to work
        working-directory: ./rust/gui-client
      # The Windows client ignores RUST_LOG because it uses a settings file instead
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./.github/actions/setup-node
      - uses: ./.github/actions/setup-rust
      - uses: ./.github/actions/setup-tauri-v2
        timeout-minutes: 10
        with:
          runtime: true
      - run: pnpm install
      - run: pnpm vite build
      - name: Build client
        run: cargo build -p firezone-gui-client --all-targets
      - uses: taiki-e/install-action@84c20235bedc3797c7e1ddf685c574a4a6c666da # v2.52.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tool: dump_syms
      - name: Run smoke test
        working-directory: ./rust
        run: cargo run -p gui-smoke-test
        timeout-minutes: 2

  headless-client:
    name: headless-client-${{ matrix.test }}-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { runs-on: windows-2019, test: token-path-windows.ps1 }
          - { runs-on: windows-2022, test: token-path-windows.ps1 }
          - { runs-on: ubuntu-22.04, test: linux-group.sh }
          - { runs-on: ubuntu-24.04, test: linux-group.sh }
          - { runs-on: ubuntu-22.04, test: token-path-linux.sh }
          - { runs-on: ubuntu-24.04, test: token-path-linux.sh }
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./.github/actions/setup-rust
      - uses: ./.github/actions/setup-tauri-v2
        timeout-minutes: 10
      - run: scripts/tests/${{ matrix.test }}
        name: "test script"
        working-directory: ./