ci.yml

name: CI

on:
  push:
    branches:
      - master
  pull_request:
    types: [ opened, synchronize, reopened ]
  workflow_dispatch:

jobs:
  formatting:
    name: Check formatting
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Check formatting
        shell: pwsh
        run: |
          Write-Host "Check formatting"
          cargo fmt --all -- --check
          if ($LastExitCode -eq 1) {   
            throw "Bad formatting, please run 'cargo +stable fmt --all'"
          }

  lints:
    name: Lints [${{ matrix.os }}]
    runs-on: ${{ matrix.runner }}
    needs: formatting
    strategy:
      fail-fast: true
      matrix:
        os: [ win, osx, linux ]
        include:
          - os: win
            runner: windows-2022
            additional-args: --features tsssp
          - os: osx
            runner: macos-14
          - os: linux
            runner: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      # Compiling the ffi module is enough to lint the whole sspi workspace
      - name: Check clippy
        env:
          AWS_LC_SYS_NO_ASM: true
        run: cargo clippy --manifest-path ffi/Cargo.toml ${{ matrix.additional-args }} -- -D warnings -D clippy::print_stdout

  tests:
    name: Tests [${{ matrix.os }}] [${{ matrix.crate-name }}]
    runs-on: ${{ matrix.runner }}
    needs: formatting
    env:
      SSPI_RS_IS_RUNNING_TESTS: true
    strategy:
      fail-fast: true
      matrix:
        os: [ win, osx, linux ]
        manifest:
          - Cargo.toml
          - ffi/Cargo.toml
          - crates/dpapi/Cargo.toml
          - crates/winscard/Cargo.toml
          - crates/dpapi-pdu/Cargo.toml
          - crates/ffi-types/Cargo.toml
          - crates/dpapi-core/Cargo.toml
          - crates/dpapi-transport/Cargo.toml
          - crates/dpapi-native-transport/Cargo.toml

        include:
          # Map runner per OS
          - os: win
            runner: windows-2022
          - os: osx
            runner: macos-14
          - os: linux
            runner: ubuntu-latest

          # Map crate name per manifest
          - manifest: Cargo.toml
            crate-name: sspi
          - manifest: ffi/Cargo.toml
            crate-name: sspi-ffi
          - manifest: crates/dpapi/Cargo.toml
            crate-name: dpapi
          - manifest: crates/winscard/Cargo.toml
            crate-name: winscard
          - manifest: crates/dpapi-pdu/Cargo.toml
            crate-name: dpapi-pdu
          - manifest: crates/ffi-types/Cargo.toml
            crate-name: ffi-types
          - manifest: crates/dpapi-core/Cargo.toml
            crate-name: dpapi-core
          - manifest: crates/dpapi-transport/Cargo.toml
            crate-name: dpapi-transport
          - manifest: crates/dpapi-native-transport/Cargo.toml
            crate-name: dpapi-native-transport

          # Per-OS feature overrides for specific manifests.
          # `__test-data` enables the `tests/sspi/client_server` suite (gated on
          # `all(network_client, __test-data)`), which otherwise never runs in CI.
          - os: win
            manifest: Cargo.toml
            additional-args: --features network_client,dns_resolver,scard,tsssp,__test-data
          - os: osx
            manifest: Cargo.toml
            additional-args: --features network_client,scard,__test-data
          - os: linux
            manifest: Cargo.toml
            additional-args: --features network_client,dns_resolver,scard,__test-data

          - os: win
            manifest: ffi/Cargo.toml
            additional-args: --features tsssp

          - os: win
            manifest: crates/dpapi/Cargo.toml
            additional-args: --features tsssp

    steps:
      - uses: actions/checkout@v6

      - name: Test
        env:
          AWS_LC_SYS_NO_ASM: true
        run: cargo test --manifest-path ${{ matrix.manifest }} ${{ matrix.additional-args }}

  miri:
    name: Miri FFI tests
    runs-on: ubuntu-latest
    needs: formatting
    env:
      SSPI_RS_IS_RUNNING_TESTS: true

    steps:
      - uses: actions/checkout@v6

      # NOTE: Pinned to a specific nightly version for reproducibility.
      # Update this manually on a regular basis.
      - name: Install nightly toolchain and Miri
        run: |
          rustup toolchain install nightly-2026-02-11 --component miri
          rustup override set nightly-2026-02-11

      - name: Test
        run: cargo miri test --manifest-path ffi/Cargo.toml --no-default-features --features ring

  wasm:
    name: WASM target
    runs-on: ubuntu-latest
    needs: formatting

    steps:
      - uses: actions/checkout@v6

      - name: Prepare runner
        run: sudo apt-get install wabt

      - name: Check
        shell: pwsh
        run: ./tools/wasm-testcompile/check.ps1

  build-native:
    name: Build native
    needs: formatting
    uses: ./.github/workflows/build-native.yml

  pack-musl:
    name: Pack musl libraries
    runs-on: ubuntu-latest
    needs: build-native

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: Download glibc x64 library
        uses: actions/download-artifact@v8
        with:
          name: sspi-linux-x64-release
          path: dependencies/runtimes/linux-x64

      - name: Download glibc arm64 library
        uses: actions/download-artifact@v8
        with:
          name: sspi-linux-arm64-release
          path: dependencies/runtimes/linux-arm64

      - name: Download musl x64 library
        uses: actions/download-artifact@v8
        with:
          name: sspi-linux-musl-x64-release
          path: dependencies/runtimes/linux-musl-x64

      - name: Download musl arm64 library
        uses: actions/download-artifact@v8
        with:
          name: sspi-linux-musl-arm64-release
          path: dependencies/runtimes/linux-musl-arm64

      - name: Build and check NuGet package
        shell: pwsh
        run: |
          dotnet build ffi/dotnet/Devolutions.Sspi/Devolutions.Sspi.csproj -c Release -o package
          if ($LASTEXITCODE -ne 0) { throw "NuGet build failed" }

          Add-Type -AssemblyName System.IO.Compression
          $Packages = @(Get-ChildItem package -Filter 'Devolutions.Sspi.*.nupkg')
          if ($Packages.Count -ne 1) { throw "Expected one NuGet package, found $($Packages.Count)" }

          $Archive = [System.IO.Compression.ZipFile]::OpenRead($Packages[0].FullName)
          try {
            $Paths = @($Archive.Entries | ForEach-Object FullName)
            foreach ($Rid in @('linux-x64', 'linux-arm64', 'linux-musl-x64', 'linux-musl-arm64')) {
              $NativePath = "runtimes/$Rid/native/libDevolutionsSspi.so"
              if ($Paths -notcontains $NativePath) { throw "Missing $NativePath in NuGet package" }
            }
          } finally {
            $Archive.Dispose()
          }

      - uses: actions/upload-artifact@v7
        with:
          name: sspi-musl-nupkg
          path: package/*.nupkg
          if-no-files-found: error

  test-musl-package:
    name: Test NuGet on Alpine [${{ matrix.arch }}]
    runs-on: ${{ matrix.runner }}
    needs: pack-musl
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x64
            runner: ubuntu-24.04
          - arch: arm64
            runner: ubuntu-24.04-arm

    steps:
      - uses: actions/download-artifact@v8
        with:
          name: sspi-musl-nupkg
          path: package

      - name: Restore, publish and load the native library on Alpine
        env:
          RID: linux-musl-${{ matrix.arch }}
        run: |
          docker run --rm -v "$PWD:/workspace:ro" -w /tmp -e RID \
            mcr.microsoft.com/dotnet/sdk:10.0-alpine sh -euc '
              dotnet new console --framework net10.0 --no-restore -o smoke
              dotnet add smoke package Devolutions.Sspi --source /workspace/package
              printf "%s\n" \
                "using Devolutions.Sspi;" \
                "unsafe" \
                "{" \
                "    var table = Sspi.InitSecurityInterfaceW();" \
                "    if (table == null || table->dwVersion > 1000)" \
                "        throw new Exception(\"Invalid SSPI table\");" \
                "}" > smoke/Program.cs
              dotnet publish smoke -r "$RID" --self-contained false -p:AllowUnsafeBlocks=true -o published
              test -f published/libDevolutionsSspi.so
              dotnet published/smoke.dll
            '

  success:
    name: Success
    runs-on: ubuntu-latest
    if: ${{ always() }}
    needs:
      - formatting
      - lints
      - tests
      - miri
      - wasm
      - build-native
      - pack-musl
      - test-musl-package

    steps:
      - name: CI succeeded
        id: succeeded
        if: ${{ !contains(needs.*.result, 'failure') }}
        run: exit 0

      - name: CI failed
        if: ${{ steps.succeeded.outcome == 'skipped' }}
        run: exit 1