firezone/.github/workflows/_rust.yml

name: Rust
on:
  workflow_call:

defaults:
  run:
    working-directory: ./rust

permissions:
  contents: 'read'
  id-token: 'write'

jobs:
  static-analysis:
    name: static-analysis-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        runs-on:
          # We only need to run static analysis checks per OS family
          - ubuntu-22.04
          - macos-14
          - windows-2022
        # TODO: https://github.com/rust-lang/cargo/issues/5220
        include:
          - runs-on: ubuntu-22.04
            packages: # Intentionally blank as a package catch-all linter
          - runs-on: macos-14
            packages: -p connlib-client-apple -p snownet
          - runs-on: windows-2022
            packages: -p connlib-client-shared -p firezone-windows-client -p snownet
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-rust
      - run: cargo fmt -- --check
      - run: |
          cargo doc --all-features --no-deps --document-private-items ${{ matrix.packages }}
        env:
          RUSTDOCFLAGS: "-D warnings"
      - run: |
          cargo clippy --all-targets --all-features ${{ matrix.packages }} -- -D warnings

  test:
    name: test-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        # TODO: https://github.com/rust-lang/cargo/issues/5220
        include:
          - runs-on: ubuntu-20.04
            packages: -p firezone-linux-client -p firezone-gateway -p connlib-client-android -p snownet
          - runs-on: ubuntu-22.04
            packages: -p firezone-linux-client -p firezone-gateway -p connlib-client-android -p snownet
          - runs-on: macos-12
            packages: -p connlib-client-apple -p snownet
          - runs-on: macos-13
            packages: -p connlib-client-apple -p snownet
          - runs-on: macos-14
            packages: -p connlib-client-apple -p snownet
          - runs-on: windows-2019
            packages: -p firezone-windows-client -p connlib-client-shared -p snownet
          - runs-on: windows-2022
            packages: -p firezone-windows-client -p connlib-client-shared -p snownet
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-rust
      - run: cargo test --all-features ${{ matrix.packages }}

  # This should be identical to `build-push-windows-release-artifacts` in `cd.yml` except for the Github permissions, needs tag, and uploading step
  build-tauri:
    name: build-tauri-${{ matrix.artifact }}
    runs-on: windows-2019
    defaults:
      run:
        working-directory: ./rust/windows-client
    strategy:
      fail-fast: false
      # The matrix is 1x1 to match the style of build-push-linux-release-artifacts
      # In the future we could try to cross-compile aarch64-windows here.
      matrix:
        include:
          - package: firezone-windows-client
            artifact: windows-client
    env:
      BINARY_DEST_PATH: ${{ matrix.artifact }}
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-node
      - uses: ./.github/actions/setup-rust
        with:
          targets: x86_64-pc-windows-msvc
      - name: Build release binaries
        run: |
          # Build Windows Tauri GUI
          pnpm install
          pnpm build

          # Used for release artifact
          # In release mode the name comes from tauri.conf.json
          cp "../target/release/Firezone.exe" "${{ env.BINARY_DEST_PATH }}-x64.exe"
          cp "../target/release/bundle/msi/*.msi" "${{ env.BINARY_DEST_PATH }}-x64.msi"
          cp "../target/release/firezone_windows_client.pdb" "${{ env.BINARY_DEST_PATH }}-x64.pdb"

          Get-FileHash ${{ env.BINARY_DEST_PATH }}-x64.exe -Algorithm SHA256 | Select-Object Hash > ${{ env.BINARY_DEST_PATH }}-x64.exe.sha256sum.txt
          Get-FileHash ${{ env.BINARY_DEST_PATH }}-x64.msi -Algorithm SHA256 | Select-Object Hash > ${{ env.BINARY_DEST_PATH }}-x64.msi.sha256sum.txt
          Get-FileHash ${{ env.BINARY_DEST_PATH }}-x64.pdb -Algorithm SHA256 | Select-Object Hash > ${{ env.BINARY_DEST_PATH }}-x64.pdb.sha256sum.txt

          # This might catch regressions in #3384, depending how CI runners
          # handle exit codes
          git diff --exit-code
      - name: Save Windows client
        uses: actions/upload-artifact@v4
        with:
          name: windows-client-x64
          path: |
            ${{ github.workspace }}/rust/windows-client/windows-client-x64.exe
            ${{ github.workspace }}/rust/windows-client/windows-client-x64.exe.sha256sum.txt
      - name: Save Windows installer
        uses: actions/upload-artifact@v4
        with:
          name: windows-client-x64-msi
          path: |
            ${{ github.workspace }}/rust/windows-client/windows-client-x64.msi
            ${{ github.workspace }}/rust/windows-client/windows-client-x64.msi.sha256sum.txt
      - name: Save Windows debug symbols
        uses: actions/upload-artifact@v4
        with:
          name: windows-client-x64-pdb
          path: |
            ${{ github.workspace }}/rust/windows-client/windows-client-x64.pdb
            ${{ github.workspace }}/rust/windows-client/windows-client-x64.pdb.sha256sum.txt

  smoke-test-relay:
    runs-on: ubuntu-22.04
    defaults:
      run:
        working-directory: ./rust/relay
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-rust
      - run: ./run_smoke_test.sh