ci.yml

name: CI

# Manual runs only until v1; restore the push and pull_request triggers then.
on:
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -D warnings

jobs:
  fmt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: cargo fmt --all --check

  clippy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --workspace --all-targets -- -D warnings
      - run: cargo clippy -p vault-core --all-targets --features insecure-test-kdf -- -D warnings
      - run: cargo clippy -p vault-client --all-targets --features insecure-test-kdf -- -D warnings
      - run: cargo clippy -p vault-cli --all-targets --features insecure-test-kdf -- -D warnings
      - name: Server-only build
        run: cargo clippy -p vault-cli --all-targets --no-default-features --features serve -- -D warnings

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --workspace
        env:
          PROPTEST_CASES: 2000
      - name: Tests with the test-only KDF parameters
        run: |
          cargo test -p vault-core --features insecure-test-kdf
          cargo test -p vault-client --features insecure-test-kdf
          cargo test -p vault-cli --features insecure-test-kdf
        env:
          VAULT_EXPECT_TEST_KDF: "1"
      - name: Release builds refuse the test KDF parameters
        run: |
          cargo test -p vault-core --release --test release_gate
          if out=$(cargo build -p vault-core --release --features insecure-test-kdf 2>&1); then
            echo "a release build with insecure-test-kdf compiled"; exit 1
          fi
          echo "$out" | grep -q "the insecure-test-kdf feature accepts the test KDF parameters" || {
            echo "the release build failed for another reason:"; echo "$out"; exit 1
          }

  wasm:
    runs-on: ubuntu-latest
    env:
      # RUSTFLAGS replaces the flags in .cargo/config.toml, so the SIMD128 feature is repeated.
      RUSTFLAGS: -D warnings -C target-feature=+simd128
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2
      - run: cargo build -p vault-core -p vault-client -p vault-interop --target wasm32-unknown-unknown --release
      - name: The Firefox extension's module
        run: cargo build -p vault-wasm --target wasm32-unknown-unknown --profile wasm
      - name: wasm-bindgen-cli at the version Cargo.lock pins
        run: cargo install --locked wasm-bindgen-cli --version "$(cargo pkgid wasm-bindgen | sed 's/.*@//')"
      - name: The spec vectors through the WASM bindings, under Node
        run: cargo test -p vault-wasm --target wasm32-unknown-unknown
      - name: The release gate against the module built with the wasm profile
        run: cargo test -p vault-wasm --target wasm32-unknown-unknown --profile wasm --test release_gate

  extension:
    runs-on: ubuntu-latest
    env:
      # RUSTFLAGS replaces the flags in .cargo/config.toml, so the SIMD128 feature is repeated.
      RUSTFLAGS: -D warnings -C target-feature=+simd128
    defaults:
      run:
        working-directory: extension
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: extension/package-lock.json
      - name: wasm-bindgen-cli at the version Cargo.lock pins
        run: cargo install --locked wasm-bindgen-cli --version "$(cargo pkgid wasm-bindgen | sed 's/.*@//')"
      - run: npm ci
      - run: npm run typecheck
      - name: The licence check, npm audit of the shipped dependencies, and the unit tests
        run: npm test
      - name: Build vault-wasm and the extension, and pack the .xpi
        run: npm run pack
      - uses: actions/upload-artifact@v4
        with:
          name: vault-firefox-unsigned
          path: extension/artifacts/*.xpi

  android:
    runs-on: ubuntu-latest
    env:
      ANDROID_NDK_VERSION: 28.2.13676358
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"
      - name: The pinned NDK
        run: |
          yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "ndk;$ANDROID_NDK_VERSION" >/dev/null
          echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/$ANDROID_NDK_VERSION" >> "$GITHUB_ENV"
      - run: cargo install --locked cargo-ndk --version 4.1.2
      - name: The library built with the android profile refuses test_kdf headers
        run: cargo test -p vault-android --profile android --test release_gate
      - name: The unsigned APK, lint, the JVM tests, and the licence check, with dependency verification
        working-directory: android
        run: ./gradlew assembleRelease lint test checkLicences
      - uses: actions/upload-artifact@v4
        with:
          name: vault-android-unsigned
          path: android/app/build/outputs/apk/release/*.apk

  vectors:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: python -m pip install --no-deps -r tools/vectors-check/requirements.txt
      - run: python3 -I tools/vectors-check/check.py
      - uses: Swatinem/rust-cache@v2
      - name: The generator reproduces the committed vectors
        run: |
          cargo run -p vault-core --example gen-vectors --features insecure-test-kdf
          git diff --exit-code spec/vectors

  deny:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check

  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit
      - run: cargo audit