ci.yml

name: CI

on:
  pull_request:
    paths:
      - "src/**"
      - "crates/**"
      - "operator/**"
      - "Cargo.toml"
      - "Cargo.lock"
      - "Dockerfile*"

env:
  CARGO_TERM_COLOR: always

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      core: ${{ steps.filter.outputs.core }}
      operator: ${{ steps.filter.outputs.operator }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - id: filter
        env:
          BASE: ${{ github.event.pull_request.base.sha }}
          HEAD: ${{ github.event.pull_request.head.sha }}
        run: |
          CHANGED=$(git diff --name-only "$BASE" "$HEAD")
          echo "core=$(echo "$CHANGED" | grep -qE '^(src/|crates/|Cargo\.(toml|lock))' && echo true || echo false)" >> "$GITHUB_OUTPUT"
          echo "operator=$(echo "$CHANGED" | grep -q '^operator/' && echo true || echo false)" >> "$GITHUB_OUTPUT"

  check:
    needs: changes
    if: needs.changes.outputs.core == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-07-13)
        with:
          components: clippy
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 (2026-03-12)
      - name: cargo check
        run: cargo check --workspace
      - name: cargo clippy
        run: cargo clippy --workspace -- -D warnings
      - name: cargo clippy (unified)
        run: cargo clippy --workspace --features unified -- -D warnings
      - name: cargo test
        run: cargo test --workspace
      # `cargo test --workspace` builds with default features, so openab-gateway's `acp`-gated
      # conformance/handler/streaming tests never compile or run. Exercise them explicitly, and
      # build the unified binary so the embedded /acp endpoint is compiled in CI. Scoped to
      # `-p openab-gateway` to avoid the workspace hooks::tests parallel flake.
      - name: cargo test (acp gateway)
        run: cargo test -p openab-gateway --features acp
      # Same default-features gap on the core side: `mcp_proxy` is the only `acp-mcp`-gated module,
      # so its tunnel-trait, tools-cache and bridge-dispatch tests never compile above either.
      # Filtered to `acp_mcp::` for the same reason the gateway step is scoped to one package —
      # it keeps the flaky hooks::tests out of this job.
      - name: cargo test (acp-mcp core)
        # `cargo test` exits 0 when a filter selects NOTHING, so "selected nothing" and "everything
        # passed" are indistinguishable — that is precisely how a compiled-but-never-selected test
        # shipped here before. Count the selection first and fail on zero.
        #
        # The filter lives in a variable inside a block scalar: written inline after `run:`, its
        # trailing `::` reads as a YAML mapping indicator and makes the whole file unparseable.
        run: |
          set -euo pipefail
          FILTER='acp_mcp::'
          n=$(cargo test -p openab-core --features acp-mcp "$FILTER" -- --list | grep -c ': test$' || true)
          echo "filter '$FILTER' selected $n test(s)"
          [ "$n" -gt 0 ] || { echo "::error::filter '$FILTER' selected ZERO tests — stale or mistyped"; exit 1; }
          cargo test -p openab-core --features acp-mcp "$FILTER"
      # The pool's facade-session tests are `acp-mcp`-gated too but live outside `acp_mcp::`, so
      # the filter above compiled them and then selected them away. Naming the module runs them
      # while still leaving the flaky hooks::tests out.
      - name: cargo test (acp-mcp pool)
        # Same zero-match guard as above, and the same reason for the block scalar.
        run: |
          set -euo pipefail
          FILTER='acp::pool::'
          n=$(cargo test -p openab-core --features acp-mcp "$FILTER" -- --list | grep -c ': test$' || true)
          echo "filter '$FILTER' selected $n test(s)"
          [ "$n" -gt 0 ] || { echo "::error::filter '$FILTER' selected ZERO tests — stale or mistyped"; exit 1; }
          cargo test -p openab-core --features acp-mcp "$FILTER"
      # And the root package's own tests — the ACP-tunnel capability source (acp_tunnel_source.rs) and
      # are `acp`-gated, so `--workspace` above skips
      # them too. This is where the source's routing and trust-gate coverage lives.
      - name: cargo test (acp root)
        run: cargo test --features acp
      - name: cargo build (unified)
        run: cargo build --features unified
      # `--workspace` always enables openab-cp's default `server` feature, so nothing above ever
      # builds the proto-only configuration that runtime clients depend on. Build, lint and test
      # it on its own, then fail if a server dependency leaks into its normal dependency graph.
      # `-e normal` leaves out the test-only `tokio-tungstenite` dev-dependency. The denylist is
      # read from the optional dependencies in crates/openab-cp/Cargo.toml (every dep that the
      # `server` feature turns on), so it cannot drift from the manifest. Any failure stops the step.
      - name: openab-cp (proto only, no default features)
        run: |
          set -euo pipefail
          cargo clippy -p openab-cp --no-default-features --all-targets -- -D warnings
          cargo test -p openab-cp --no-default-features
          server_deps=$(python3 -c '
          import tomllib
          with open("crates/openab-cp/Cargo.toml", "rb") as f:
              manifest = tomllib.load(f)
          for name, spec in manifest.get("dependencies", {}).items():
              if isinstance(spec, dict) and spec.get("optional"):
                  print(name)
          ')
          if [ -z "$server_deps" ]; then
            echo "::error::Cargo.toml lists no optional server dependencies; the leak check would be empty"
            exit 1
          fi
          tree=$(cargo tree -p openab-cp --no-default-features -e normal --prefix none)
          if [ -z "$tree" ]; then
            echo "::error::cargo tree printed nothing; the leak check cannot run"
            exit 1
          fi
          if ! grep -q '^openab-cp ' <<< "$tree"; then
            echo "::error::cargo tree did not list openab-cp; the leak check cannot run"
            exit 1
          fi
          leaked=""
          while read -r dep; do
            if grep -q "^${dep} " <<< "$tree"; then
              leaked="$leaked $dep"
            fi
          done <<< "$server_deps"
          if [ -n "$leaked" ]; then
            echo "::error::openab-cp proto-only build pulls in server dependencies:$leaked"
            exit 1
          fi

  operator:
    needs: changes
    if: needs.changes.outputs.operator == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: operator
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-07-13)
        with:
          components: clippy
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 (2026-03-12)
        with:
          workspaces: operator
      - name: cargo check
        run: cargo check
      - name: cargo clippy
        run: cargo clippy -- -D warnings
      - name: cargo test
        run: cargo test
      - name: cargo build
        run: cargo build --release