firezone/.github/workflows/_rust.yml

name: Rust
on:
  workflow_call:

defaults:
  run:
    working-directory: ./rust

permissions:
  contents: 'read'
  id-token: 'write'

jobs:
  static-analysis:
    name: static-analysis-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        runs-on:
          # We only need to run static analysis checks per OS family
          - ubuntu-22.04
          - macos-14
          - windows-2022
        # TODO: https://github.com/rust-lang/cargo/issues/5220
        include:
          - runs-on: ubuntu-22.04
            packages: # Intentionally blank as a package catch-all linter
          - runs-on: macos-14
            packages: -p connlib-client-apple -p snownet
          - runs-on: windows-2022
            packages: -p connlib-client-shared -p firezone-windows-client -p snownet
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-rust
      - run: cargo fmt -- --check
      - run: |
          cargo doc --all-features --no-deps --document-private-items ${{ matrix.packages }}
        env:
          RUSTDOCFLAGS: "-D warnings"
      - run: |
          cargo clippy --all-targets --all-features ${{ matrix.packages }} -- -D warnings

  test:
    name: test-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        # TODO: https://github.com/rust-lang/cargo/issues/5220
        include:
          - runs-on: ubuntu-20.04
            packages: -p firezone-linux-client -p firezone-gateway -p connlib-client-android -p snownet
          - runs-on: ubuntu-22.04
            packages: -p firezone-linux-client -p firezone-gateway -p connlib-client-android -p snownet
          - runs-on: macos-12
            packages: -p connlib-client-apple -p snownet
          - runs-on: macos-13
            packages: -p connlib-client-apple -p snownet
          - runs-on: macos-14
            packages: -p connlib-client-apple -p snownet
          - runs-on: windows-2019
            packages: -p firezone-windows-client -p connlib-client-shared -p snownet
          - runs-on: windows-2022
            packages: -p firezone-windows-client -p connlib-client-shared -p snownet
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-rust
      - run: cargo test --all-features ${{ matrix.packages }}

  # Runs the Windows client smoke test, built in debug mode. We can't run it in release
  # mode because of a known issue: <https://github.com/firezone/firezone/blob/456e044f882c2bb314e19cc44c0d19c5ad817b7c/rust/windows-client/src-tauri/src/client.rs#L162-L164>
  windows-smoke-test:
    name: windows-smoke-test
    runs-on: windows-2019
    defaults:
      run:
        working-directory: ./rust/windows-client
    env:
      CONNLIB_LOG_UPLOAD_INTERVAL_SECS: 300
      # The Windows client ignores RUST_LOG because it uses a settings file instead
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-node
        with:
          node-version: '20'
      - uses: ./.github/actions/setup-rust
        with:
          targets: x86_64-pc-windows-msvc
        # This is the "Evergreen" bootstrapper from Microsoft
        # <https://developer.microsoft.com/en-us/microsoft-edge/webview2/?form=MA13LH#download>
        # Unfortunately, this makes the test non-deterministic.
        # Controlling the version would be difficult.
      - name: Download WebView2 bootstrapper
        run: Invoke-WebRequest -Uri https://go.microsoft.com/fwlink/p/?LinkId=2124703 -OutFile WebView2Installer.exe
        # This downloads about 200 MB and takes about 5 minutes on my VM
        # So we could fault in WebView2 from the client exe without the MSI if we needed.
        # Currently the MSI does this and it's a little janky.
      - name: Install WebView2
        run: Start-Process WebView2Installer.exe -ArgumentList "/install" -Wait
      - name: pnpm install
        run: |
          pnpm install
          cp "node_modules/flowbite/dist/flowbite.min.js" "src/"
      - name: Compile TypeScript
        run: pnpm tsc
      - name: Compile Tailwind
        run: pnpm tailwindcss -i src/input.css -o src/output.css
      - name: Build client
        run: cargo build -p firezone-windows-client
      - name: Run smoke test
        run: cargo run -p firezone-windows-client -- smoke-test
      - name: Test that the crash handler produces a crash dump
        run: bash scripts/crash-handling-smoke-test.bash

  # This should be identical to `build-push-windows-release-artifacts` in `cd.yml` except for the Github permissions, needs tag, and uploading step
  build-tauri:
    name: build-tauri-${{ matrix.name }}
    runs-on: windows-2019
    defaults:
      run:
        working-directory: ./rust/windows-client
    strategy:
      fail-fast: false
      # The matrix is 1x1 to match the style of build-push-linux-release-artifacts
      # In the future we could try to cross-compile aarch64-windows here.
      matrix:
        include:
          - package: firezone-windows-client
            artifact: firezone-windows-client
            name: windows-client
    env:
      BINARY_DEST_PATH: ${{ matrix.artifact }}
      CONNLIB_LOG_UPLOAD_INTERVAL_SECS: 300
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-node
        with:
          node-version: '20'
      - uses: ./.github/actions/setup-rust
        with:
          targets: x86_64-pc-windows-msvc
      - name: Install pnpm deps
        run: pnpm install
      - name: Build release exe and MSI
        run: pnpm build
      - name: Compute SHA256 and rename
        run: |
          # Used for release artifact
          # In release mode the name comes from tauri.conf.json
          cp "../target/release/Firezone.exe" "${{ env.BINARY_DEST_PATH }}-x64.exe"
          cp "../target/release/bundle/msi/*.msi" "${{ env.BINARY_DEST_PATH }}-x64.msi"
          cp "../target/release/firezone_windows_client.pdb" "${{ env.BINARY_DEST_PATH }}-x64.pdb"

          Get-FileHash ${{ env.BINARY_DEST_PATH }}-x64.exe -Algorithm SHA256 | Select-Object Hash > ${{ env.BINARY_DEST_PATH }}-x64.exe.sha256sum.txt
          Get-FileHash ${{ env.BINARY_DEST_PATH }}-x64.msi -Algorithm SHA256 | Select-Object Hash > ${{ env.BINARY_DEST_PATH }}-x64.msi.sha256sum.txt
          Get-FileHash ${{ env.BINARY_DEST_PATH }}-x64.pdb -Algorithm SHA256 | Select-Object Hash > ${{ env.BINARY_DEST_PATH }}-x64.pdb.sha256sum.txt

          # This might catch regressions in #3384, depending how CI runners
          # handle exit codes
          git diff --exit-code
      - name: Save Windows client
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}-x64
          path: |
            ${{ github.workspace }}/rust/windows-client/${{ matrix.artifact }}-x64.exe
            ${{ github.workspace }}/rust/windows-client/${{ matrix.artifact }}-x64.exe.sha256sum.txt
      - name: Save Windows installer
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}-x64-msi
          path: |
            ${{ github.workspace }}/rust/windows-client/${{ matrix.artifact }}-x64.msi
            ${{ github.workspace }}/rust/windows-client/${{ matrix.artifact }}-x64.msi.sha256sum.txt
      - name: Save Windows debug symbols
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}-x64-pdb
          path: |
            ${{ github.workspace }}/rust/windows-client/${{ matrix.artifact }}-x64.pdb
            ${{ github.workspace }}/rust/windows-client/${{ matrix.artifact }}-x64.pdb.sha256sum.txt

  smoke-test-relay:
    runs-on: ubuntu-22.04
    defaults:
      run:
        working-directory: ./rust/relay
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-rust
      - run: ./run_smoke_test.sh