ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

# Cancel in-flight runs for the same ref when a new commit lands.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  RUST_BACKTRACE: 1

jobs:
  check:
    name: fmt + clippy + test
    runs-on: ubuntu-latest
    timeout-minutes: 45

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      # `rust-toolchain.toml` at the repo root pins the channel (1.94)
      # and components (rustfmt, clippy). We still specify `stable` here
      # so the action installs the modern launcher; the toolchain file
      # takes precedence when invoking cargo from the workspace root.
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache cargo registry, index, and target
        uses: Swatinem/rust-cache@v2

      - name: Check cross-ecosystem versions
        run: python3 scripts/check_version_sync.py

      - name: Check formatting
        run: cargo fmt --all -- --check

      # We exclude samkhya-py from the workspace lint/test pass:
      #   * samkhya-py — PyO3 extension module; needs the matching Python
      #     dev headers and is built end-to-end by `maturin` in the Python
      #     matrix below.
      # samkhya-duckdb is included with its dependency-free default feature
      # set; its `bundled` integration requires a separate native-toolchain job.
      - name: Clippy (workspace, deny warnings)
        run: cargo clippy --locked --workspace --exclude samkhya-py -- -D warnings

      - name: Test (workspace)
        run: cargo test --locked --workspace --exclude samkhya-py

  # Verify the default-feature compatibility floor declared by
  # workspace.package.rust-version. Heavy opt-in engine features run on the
  # pinned development toolchain in optional-features below.
  msrv:
    name: MSRV (Rust 1.85)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install MSRV toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.85"

      - name: Cache cargo registry, index, and target
        uses: Swatinem/rust-cache@v2
        with:
          key: msrv-1.85

      - name: Check workspace at the declared MSRV
        run: cargo +1.85 check --locked --workspace

  # Compile and test feature-gated code that the default workspace pass skips.
  # Each matrix entry is self-contained so a heavy adapter cannot starve the rest.
  optional-features:
    name: Optional feature (${{ matrix.name }})
    runs-on: ubuntu-latest
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: core-all
            package: samkhya-core
            feature_args: --all-features
          - name: iceberg
            package: samkhya-iceberg
            feature_args: --features iceberg
          - name: polars
            package: samkhya-polars
            feature_args: --features engine
          - name: duckdb
            package: samkhya-duckdb
            feature_args: --features bundled
          - name: puffin-cross-engine
            package: samkhya-it
            feature_args: --features puffin-cross-engine --test puffin_cross_engine
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache cargo registry, index, and target
        uses: Swatinem/rust-cache@v2
        with:
          key: feature-${{ matrix.name }}

      - name: Test feature surface
        run: cargo test --locked -p ${{ matrix.package }} ${{ matrix.feature_args }}

  python:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.12", "3.13"]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
          cache-dependency-path: |
            samkhya-py/pyproject.toml
            samkhya-gpudb/scripts/requirements-llm.txt

      - name: Cache cargo registry, index, and target
        uses: Swatinem/rust-cache@v2
        with:
          key: python-${{ matrix.python-version }}

      - name: Install Python build and test tools
        run: >-
          python -m pip install "maturin>=1.7,<2.0" "pytest>=7"
          -r samkhya-gpudb/scripts/requirements-llm.txt

      - name: Build the distributable wheel
        run: >-
          maturin build --locked --release --interpreter python
          --out target/wheels -m samkhya-py/Cargo.toml

      - name: Install the built wheel
        run: python -m pip install --no-deps target/wheels/samkhya-*.whl

      - name: Test Python bindings
        run: python -m pytest samkhya-py/tests

      - name: Test Python HTTP wire contract
        run: python samkhya-gpudb/scripts/wire_contract_test.py

      - name: Test primary Python HTTP server
        if: matrix.python-version != '3.9'
        run: python samkhya-gpudb/scripts/wire_contract_test.py --primary

  typescript:
    name: TypeScript transport
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: samkhya-gpudb/scripts
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: samkhya-gpudb/scripts/package-lock.json

      - name: Install locked dependencies
        run: npm ci --ignore-scripts

      - name: Audit Node dependency tree
        run: npm audit --audit-level=low

      - name: Type-check transport implementations
        run: npm run lint

      - name: Test stable HTTP wire contract
        run: npm run test:wire

  # ---------------------------------------------------------------------------
  # cargo-deny — supply-chain hygiene. Runs the four checks (bans /
  # licenses / advisories / sources) configured in `deny.toml` at the
  # repository root. Every PR and release candidate must pass it.
  #
  # Fuzzing is NOT enabled in CI: cargo-fuzz requires a nightly toolchain
  # and a long-running budget that's incompatible with per-PR feedback.
  # Fuzz targets live in `samkhya-core/fuzz/` (a standalone workspace) and
  # are run locally before each release tag.
  # ---------------------------------------------------------------------------
  deny:
    name: cargo-deny
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      # Installed as a prebuilt binary from the cargo-deny GitHub release
      # rather than via EmbarkStudios/cargo-deny-action@v2. That action is a
      # Docker action: every run rebuilds an image `FROM rust:1.85.0-alpine`,
      # so a Docker Hub outage or pull-rate limit fails the job for reasons
      # that have nothing to do with this repository. It did exactly that on
      # 2026-07-25 (run 30173310053, i/o timeout to registry-1.docker.io) on
      # a commit that changed one line of README. taiki-e/install-action
      # pulls from GitHub releases, which CI already depends on.
      - name: Install cargo-deny
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-deny

      # `check` runs all four checks: bans, licenses, advisories, sources.
      #
      # Locked, default-feature workspace resolution aligns with the release
      # pre-flight verification (default features). Passing --workspace
      # explicitly matters: cargo-deny-action defaulted to --all-features,
      # which activates samkhya-postgres's pgrx 0.12 path (pulling
      # unmaintained serde_cbor via RUSTSEC-2021-0127) and produces ~60
      # duplicate-version bans from arrow/brotli/hashbrown/rand co-activation
      # across pgrx + polars-all-features + iceberg + duckdb. Retire this
      # scoping when (a) pgrx ≥ 0.13 lands and drops serde_cbor, and (b) we
      # have a strategy for the cross-engine arrow / hashbrown version sprawl
      # under all-features.
      - name: Run cargo-deny
        run: cargo deny --locked --workspace check