firezone/.github/workflows/_rust.yml

---
name: Rust
"on":
  workflow_call:

defaults:
  run:
    working-directory: ./rust

permissions:
  contents: "read"
  id-token: "write"

# Never tolerate warnings. Duplicated in `_tauri.yml`
env:
  RUSTFLAGS: "-Dwarnings --cfg tokio_unstable"
  RUSTDOCFLAGS: "-D warnings"

jobs:
  bench:
    name: bench-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        runs-on: [
            windows-2019, # Only platform with a benchmark right now
          ]
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./.github/actions/setup-rust
        id: setup-rust
      - run: cargo bench ${{ steps.setup-rust.outputs.bench-packages }}
        env:
          RUST_LOG: "debug"
        name: "cargo bench"
        shell: bash

  static-analysis:
    name: static-analysis-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        # TODO: https://github.com/rust-lang/cargo/issues/5220
        runs-on: [ubuntu-22.04, macos-14, windows-2022]
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./.github/actions/setup-rust
        id: setup-rust
      - uses: ./.github/actions/setup-tauri-v2
        timeout-minutes: 5
      - uses: taiki-e/install-action@09dc018eee06ae1c9e0409786563f534210ceb83 # v2.49.50
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tool: cargo-udeps,cargo-deny
      - uses: taiki-e/install-action@09dc018eee06ae1c9e0409786563f534210ceb83 # v2.49.50
        if: ${{ runner.os == 'Linux' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tool: bpf-linker
      - run: |
          cargo +${{ steps.setup-rust.outputs.nightly_version }} udeps --all-targets --all-features ${{ steps.setup-rust.outputs.packages }}
        name: Check for unused dependencies
      - run: cargo fmt -- --check
      - run: cargo doc --all-features --no-deps --document-private-items ${{ steps.setup-rust.outputs.packages }}
        name: "cargo doc"
        shell: bash
      - run: cargo clippy --all-targets --all-features ${{ steps.setup-rust.outputs.packages }}
        name: "cargo clippy"
        shell: bash
      - run: cargo deny check --hide-inclusion-graph --deny unnecessary-skip
        shell: bash

  test:
    name: test-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        # TODO: https://github.com/rust-lang/cargo/issues/5220
        runs-on:
          [
            ubuntu-22.04,
            ubuntu-24.04,
            macos-13,
            macos-14,
            macos-15,
            windows-2019,
            windows-2022,
          ]
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./.github/actions/setup-rust
        id: setup-rust
      - uses: ./.github/actions/setup-tauri-v2
      - uses: taiki-e/install-action@09dc018eee06ae1c9e0409786563f534210ceb83 # v2.49.50
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tool: ripgrep
      - uses: taiki-e/install-action@09dc018eee06ae1c9e0409786563f534210ceb83 # v2.49.50
        if: ${{ runner.os == 'Linux' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tool: bpf-linker
      - name: "cargo test"
        shell: bash
        run: |

          set -x

          # First, run all tests.
          cargo test --all-features ${{ steps.setup-rust.outputs.packages }} -- --include-ignored --nocapture

          # Poor man's test coverage testing: Grep the generated logs for specific patterns / lines.
          rg --count --no-ignore SendIcmpPacket $TESTCASES_DIR
          rg --count --no-ignore SendUdpPacket $TESTCASES_DIR
          rg --count --no-ignore SendTcpPayload $TESTCASES_DIR
          rg --count --no-ignore SendDnsQueries $TESTCASES_DIR
          rg --count --no-ignore "Packet for DNS resource" $TESTCASES_DIR
          rg --count --no-ignore "Packet for CIDR resource" $TESTCASES_DIR
          rg --count --no-ignore "Packet for Internet resource" $TESTCASES_DIR
          rg --count --no-ignore "Performed IP-NAT46" $TESTCASES_DIR
          rg --count --no-ignore "Performed IP-NAT64" $TESTCASES_DIR
          rg --count --no-ignore "Truncating DNS response" $TESTCASES_DIR
          rg --count --no-ignore "Destination is unreachable" $TESTCASES_DIR
          rg --count --no-ignore "Forwarding query for DNS resource to corresponding site" $TESTCASES_DIR

        env:
          # <https://github.com/rust-lang/cargo/issues/5999>
          # Needed to create tunnel interfaces in unit tests
          CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER: "sudo --preserve-env"
          PROPTEST_VERBOSE: 0 # Otherwise the output is very long.
          PROPTEST_CASES: ${{ runner.os == 'Windows' && 1000 || 2000 }} # Default is only 256. Windows is very slow in GitHub Actions, so only run a 1000 cases there.
          CARGO_PROFILE_TEST_OPT_LEVEL: 1 # Otherwise the tests take forever.
          TESTCASES_DIR: "connlib/tunnel/testcases"

  # Runs the Tauri client smoke test, built in debug mode. We can't run it in release
  # mode because of a known issue: <https://github.com/firezone/firezone/blob/456e044f882c2bb314e19cc44c0d19c5ad817b7c/rust/windows-client/src-tauri/src/client.rs#L162-L164>
  gui-smoke-test:
    name: gui-smoke-test-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        runs-on: [ubuntu-22.04, ubuntu-24.04, windows-2019, windows-2022]
    runs-on: ${{ matrix.runs-on }}
    defaults:
      run:
        # Must be in this dir for `pnpm` to work
        working-directory: ./rust/gui-client
      # The Windows client ignores RUST_LOG because it uses a settings file instead
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./.github/actions/setup-node
      - uses: ./.github/actions/setup-rust
      - uses: ./.github/actions/setup-tauri-v2
        timeout-minutes: 5
        with:
          runtime: true
        # These steps must be synchronized with build.sh and build.bat in `rust/gui-client`
      - name: pnpm install
        run: |
          pnpm install
          cp "node_modules/flowbite/dist/flowbite.min.js" "src/"
      - name: Compile Tailwind
        run: pnpm tailwindcss -i src/input.css -o src/output.css
      - name: Run Vite bundler
        run: pnpm vite build
      - name: Build client
        run: cargo build -p firezone-gui-client --all-targets
      - uses: taiki-e/install-action@09dc018eee06ae1c9e0409786563f534210ceb83 # v2.49.50
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tool: dump_syms
      - name: Run smoke test
        working-directory: ./rust
        run: cargo run -p gui-smoke-test

  headless-client:
    name: headless-client-${{ matrix.test }}-${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { runs-on: windows-2019, test: token-path-windows.ps1 }
          - { runs-on: windows-2022, test: token-path-windows.ps1 }
          - { runs-on: ubuntu-22.04, test: linux-group.sh }
          - { runs-on: ubuntu-24.04, test: linux-group.sh }
          - { runs-on: ubuntu-22.04, test: token-path-linux.sh }
          - { runs-on: ubuntu-24.04, test: token-path-linux.sh }
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./.github/actions/setup-rust
      - uses: ./.github/actions/setup-tauri-v2
        timeout-minutes: 5
      - run: scripts/tests/${{ matrix.test }}
        name: "test script"
        working-directory: ./