ci.yml

name: CI

on:
  push:
    branches: [master, main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  changes:
    name: Detect CI scope
    runs-on: ubuntu-latest
    outputs:
      code: ${{ steps.scope.outputs.code }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Classify changed files
        id: scope
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PUSH_BEFORE_SHA: ${{ github.event.before }}
          CURRENT_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail

          if [ "$EVENT_NAME" = "pull_request" ]; then
              base="$PR_BASE_SHA"
              head="$CURRENT_SHA"
              range="$base...$head"
          else
              base="$PUSH_BEFORE_SHA"
              head="$CURRENT_SHA"
              range="$base..$head"
          fi

          if [ -z "$base" ] || [[ "$base" =~ ^0+$ ]]; then
              echo "code=true" >> "$GITHUB_OUTPUT"
              echo "No usable base SHA; running full CI."
              exit 0
          fi

          if ! changed_paths="$(git diff --name-only "$range")"; then
              echo "code=true" >> "$GITHUB_OUTPUT"
              echo "Could not diff $range; running full CI."
              exit 0
          fi

          echo "Changed paths:"
          printf '%s\n' "$changed_paths"

          code=false
          while IFS= read -r path; do
              [ -n "$path" ] || continue
              case "$path" in
                  README.md|CHANGELOG.md|CONTRIBUTING.md|LICENSE|LICENSE.*|AGENTS.md|docs/*|*.md)
                      ;;
                  *)
                      code=true
                      break
                      ;;
              esac
          done <<< "$changed_paths"

          echo "code=$code" >> "$GITHUB_OUTPUT"
          if [ "$code" = "true" ]; then
              echo "Code or CI-sensitive files changed; running full CI."
          else
              echo "Only documentation files changed; skipping expensive CI jobs."
          fi

  audit:
    name: Supply-chain audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Check dependency file changes
        id: audit_changes
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PUSH_BEFORE_SHA: ${{ github.event.before }}
          CURRENT_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail

          if [ "$EVENT_NAME" = "pull_request" ]; then
              base="$PR_BASE_SHA"
              head="$CURRENT_SHA"
              range="$base...$head"
          else
              base="$PUSH_BEFORE_SHA"
              head="$CURRENT_SHA"
              range="$base..$head"
          fi

          if [ -z "$base" ] || [[ "$base" =~ ^0+$ ]]; then
              echo "run=true" >> "$GITHUB_OUTPUT"
              echo "No usable base SHA; running cargo audit."
              exit 0
          fi

          if ! changed_paths="$(git diff --name-only "$range")"; then
              echo "run=true" >> "$GITHUB_OUTPUT"
              echo "Could not diff $range; running cargo audit."
              exit 0
          fi

          if grep -Eq '^(Cargo\.toml|Cargo\.lock)$' <<<"$changed_paths"; then
              echo "run=true" >> "$GITHUB_OUTPUT"
              echo "Dependency files changed; running cargo audit."
          else
              echo "run=false" >> "$GITHUB_OUTPUT"
              echo "Cargo.toml/Cargo.lock unchanged; skipping cargo audit."
          fi

      - name: Install cargo-audit
        if: steps.audit_changes.outputs.run == 'true'
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit

      - name: Security audit
        if: steps.audit_changes.outputs.run == 'true'
        run: cargo audit

      - name: Report skipped audit
        if: steps.audit_changes.outputs.run != 'true'
        run: echo "cargo audit skipped because dependency manifests did not change"

  build:
    name: Build release cdylib (linux)
    runs-on: ubuntu-latest
    needs: changes
    if: github.event_name != 'pull_request' || needs.changes.outputs.code == 'true'
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install Rust (stable)
        run: |
          rustup toolchain install stable --profile minimal --no-self-update
          rustup default stable

      - name: Cache cargo registry & target
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: build-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.toml', 'Cargo.lock') }}
          restore-keys: |
            build-${{ runner.os }}-${{ runner.arch }}-

      - name: Build cdylib
        run: cargo build --release

      - name: Upload release cdylib
        uses: actions/upload-artifact@v4
        with:
          name: qjson-linux-release
          path: target/release/libqjson.so
          if-no-files-found: error
          retention-days: 1

  rust:
    name: Rust tests (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    needs: changes
    if: github.event_name != 'pull_request' || needs.changes.outputs.code == 'true'
    strategy:
      matrix:
        os: [ubuntu-latest, macos-14]
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install Rust (stable)
        run: |
          rustup toolchain install stable --profile minimal --no-self-update
          rustup default stable

      - name: Cache cargo registry & target
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-test-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.toml', 'Cargo.lock') }}
          restore-keys: |
            cargo-test-${{ runner.os }}-${{ runner.arch }}-

      - name: Test (release)
        run: cargo test --release

      - name: Test scalar-only (no AVX2/NEON feature)
        run: cargo test --release --no-default-features

      - name: Test debug scalar-only
        if: matrix.os == 'ubuntu-latest'
        run: cargo test --no-default-features

      - name: Test with test-panic feature
        if: matrix.os == 'ubuntu-latest'
        run: cargo test --features test-panic --release

      - name: Install LuaJIT for package validation
        if: matrix.os == 'macos-14'
        uses: ./.github/actions/setup-lua
        with:
          lua-version: "luajit-2.1.0-beta3"

      - name: Resolve LuaJIT executable for package validation
        if: matrix.os == 'macos-14'
        id: mac_luajit
        run: .github/scripts/resolve-luajit.sh

      - name: Validate LuaRocks package (macOS)
        if: matrix.os == 'macos-14'
        env:
          LUAJIT_BIN: ${{ steps.mac_luajit.outputs.path }}
        run: |
          rm -rf /tmp/lua-qjson-rock
          ROCKSPEC="$(.github/scripts/latest-rockspec.py)"
          luarocks make "$ROCKSPEC" --tree /tmp/lua-qjson-rock
          eval "$(luarocks path --tree /tmp/lua-qjson-rock)"
          unset LD_LIBRARY_PATH
          unset DYLD_LIBRARY_PATH
          "$LUAJIT_BIN" -e 'local qjson = require("qjson"); local doc = qjson.parse("{\"a\":42}"); assert(doc:get_i64("a") == 42)'

  lua-lint:
    name: Lua lint
    runs-on: ubuntu-latest
    needs: changes
    if: github.event_name != 'pull_request' || needs.changes.outputs.code == 'true'
    steps:
      - uses: actions/checkout@v4

      - name: Install Lua lint toolchain
        uses: ./.github/actions/setup-lua
        with:
          lua-version: "luajit-2.1.0-beta3"
          packages: >-
            https://luarocks.org/argparse-0.7.2-1.src.rock
            https://luarocks.org/luafilesystem-1.9.0-1.src.rock
            https://luarocks.org/luacheck-1.2.0-1.src.rock

      - name: Run Lua lint
        run: make lua-lint

  fuzz:
    name: Fuzz corpus replay
    runs-on: ubuntu-latest
    needs: changes
    if: github.event_name != 'pull_request' || needs.changes.outputs.code == 'true'
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install Rust (nightly)
        run: |
          rustup toolchain install nightly --profile minimal --no-self-update

      - name: Cache cargo registry & fuzz target
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            ~/.cargo/bin/cargo-fuzz
            fuzz/target
          key: fuzz-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.toml', 'Cargo.lock', 'fuzz/Cargo.toml') }}
          restore-keys: |
            fuzz-${{ runner.os }}-${{ runner.arch }}-

      - name: Install cargo-fuzz
        run: |
          if ! command -v cargo-fuzz >/dev/null 2>&1; then
            cargo install --locked cargo-fuzz
          fi

      - name: Replay fuzz corpora
        run: |
          cargo +nightly fuzz run fuzz_parse_eager -- -runs=0
          cargo +nightly fuzz run fuzz_depth -- -runs=0
          cargo +nightly fuzz run fuzz_ffi_ops -- -runs=0
          cargo +nightly fuzz run fuzz_parse_lazy -- -runs=0

  sanitizers:
    name: Sanitizers (Rust nightly)
    runs-on: ubuntu-latest
    needs: changes
    if: github.event_name != 'pull_request' || needs.changes.outputs.code == 'true'
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install Rust (nightly)
        run: |
          rustup toolchain install nightly --profile minimal --no-self-update
          rustup +nightly target add x86_64-unknown-linux-gnu i686-unknown-linux-gnu powerpc64-unknown-linux-gnu
          rustup +nightly component add miri

      - name: Cache cargo registry & target
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: sanitizers-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.toml', 'Cargo.lock') }}
          restore-keys: |
            sanitizers-${{ runner.os }}-${{ runner.arch }}-

      - name: Miri FFI tests x86_64 (scalar scanner)
        run: |
          cargo +nightly miri test --target x86_64-unknown-linux-gnu --no-default-features --test ffi_smoke
          cargo +nightly miri test --target x86_64-unknown-linux-gnu --no-default-features --test ffi_cursor
          cargo +nightly miri test --target x86_64-unknown-linux-gnu --no-default-features --test ffi_strings
          cargo +nightly miri test --target x86_64-unknown-linux-gnu --no-default-features --test ffi_ops_interleave

      - name: Miri FFI tests i686 (32-bit validation)
        run: |
          cargo +nightly miri test --target i686-unknown-linux-gnu --no-default-features --test ffi_smoke
          cargo +nightly miri test --target i686-unknown-linux-gnu --no-default-features --test ffi_cursor
          cargo +nightly miri test --target i686-unknown-linux-gnu --no-default-features --test ffi_strings
          cargo +nightly miri test --target i686-unknown-linux-gnu --no-default-features --test ffi_ops_interleave

      - name: Miri FFI tests powerpc64 (big-endian validation)
        run: |
          cargo +nightly miri test --target powerpc64-unknown-linux-gnu --no-default-features --test ffi_smoke
          cargo +nightly miri test --target powerpc64-unknown-linux-gnu --no-default-features --test ffi_cursor
          cargo +nightly miri test --target powerpc64-unknown-linux-gnu --no-default-features --test ffi_strings
          cargo +nightly miri test --target powerpc64-unknown-linux-gnu --no-default-features --test ffi_ops_interleave

      - name: ASan FFI smoke tests
        continue-on-error: true
        env:
          RUSTFLAGS: -Z sanitizer=address
        run: |
          cargo +nightly test --release --target x86_64-unknown-linux-gnu --test ffi_smoke
          cargo +nightly test --release --target x86_64-unknown-linux-gnu --test ffi_strings
          cargo +nightly test --release --target x86_64-unknown-linux-gnu --test ffi_ops_interleave

  lua:
    name: Lua integration tests (${{ matrix.runtime.name }})
    runs-on: ubuntu-latest
    needs: build
    strategy:
      fail-fast: false
      matrix:
        runtime:
          - name: upstream LuaJIT
            lua_version: "luajit-2.1.0-beta3"
            validate_rockspec: true
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Download release cdylib
        uses: actions/download-artifact@v4
        with:
          name: qjson-linux-release
          path: target/release

      - name: Install LuaJIT (${{ matrix.runtime.name }})
        uses: ./.github/actions/setup-lua
        with:
          lua-version: ${{ matrix.runtime.lua_version }}
          install-luarocks: "false"

      - name: Install Lua dependencies
        run: .github/scripts/install-lua-test-deps.sh

      - name: Install Rust for package validation
        if: matrix.runtime.validate_rockspec
        run: |
          rustup toolchain install stable --profile minimal --no-self-update
          rustup default stable

      - name: Resolve LuaJIT executable
        id: luajit
        run: .github/scripts/resolve-luajit.sh

      - name: Run busted tests (${{ matrix.runtime.name }})
        env:
          LUAJIT_BIN: ${{ steps.luajit.outputs.path }}
        run: |
          # ffi.load("qjson") uses dlopen which respects LD_LIBRARY_PATH,
          # not LuaJIT's package.cpath. Point dlopen at the release build dir.
          LD_LIBRARY_PATH="$PWD/target/release" \
            busted --lua="$LUAJIT_BIN" tests/lua \
              --lpath='./lua/?.lua'

      - name: Validate LuaRocks package
        if: matrix.runtime.validate_rockspec
        env:
          LUAJIT_BIN: ${{ steps.luajit.outputs.path }}
        run: |
          rm -rf /tmp/lua-qjson-rock
          ROCKSPEC="$(.github/scripts/latest-rockspec.py)"
          luarocks make "$ROCKSPEC" --tree /tmp/lua-qjson-rock
          eval "$(luarocks path --tree /tmp/lua-qjson-rock)"
          unset LD_LIBRARY_PATH
          "$LUAJIT_BIN" -e 'local qjson = require("qjson"); local doc = qjson.parse("{\"a\":42}"); assert(doc:get_i64("a") == 42)'
          busted --lua="$LUAJIT_BIN" tests/lua

  lua-valgrind:
    name: Lua valgrind memcheck (upstream LuaJIT)
    runs-on: ubuntu-latest
    needs: build
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Download release cdylib
        uses: actions/download-artifact@v4
        with:
          name: qjson-linux-release
          path: target/release

      - name: Install LuaJIT
        uses: ./.github/actions/setup-lua
        with:
          lua-version: "luajit-2.1.0-beta3"
          install-luarocks: "false"

      - name: Install Lua dependencies
        run: .github/scripts/install-lua-test-deps.sh

      - name: Install valgrind
        run: sudo apt-get install -y valgrind

      - name: Resolve LuaJIT executable
        id: luajit
        run: .github/scripts/resolve-luajit.sh

      - name: Run smoke tests under valgrind (upstream LuaJIT)
        env:
          LUAJIT_BIN: ${{ steps.luajit.outputs.path }}
          LUA_INIT: if jit then jit.off() end
        run: |
          # Valgrind is an end-to-end canary for the real LuaJIT FFI path.
          # Disable JIT compilation so Memcheck observes the interpreter + FFI
          # boundary instead of LuaJIT's generated traces. Trace children so
          # the LuaRocks busted launcher re-execs into the selected LuaJIT
          # binary under Memcheck. Keep PR coverage to focused smoke specs;
          # full Lua Valgrind runs live in lua-valgrind-full.yml.
          LD_LIBRARY_PATH="$PWD/target/release" \
            valgrind \
              --trace-children=yes \
              --error-exitcode=1 \
              --leak-check=full \
              --show-leak-kinds=definite,indirect,possible \
              --errors-for-leak-kinds=definite,indirect,possible \
              --num-callers=24 \
              --suppressions=valgrind.supp \
              busted --lua="$LUAJIT_BIN" \
                tests/lua/basic_spec.lua \
                tests/lua/escape_spec.lua \
                tests/lua/gc_spec.lua \
                tests/lua/lazy_table_spec.lua \
                tests/lua/ordered_encode_spec.lua \
                tests/lua/encode_errors_spec.lua \
                tests/lua/encode_cjson_compat_spec.lua \
                tests/lua/options_spec.lua \
                --lpath='./lua/?.lua'

  openresty:
    name: OpenResty runtime (${{ matrix.openresty.version }})
    runs-on: ubuntu-22.04
    needs: build
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        openresty:
          - version: "1.21.4.4"
            image: "openresty/openresty:1.21.4.4-0-jammy"
            full_busted: false
          - version: "1.27.1.2"
            image: "openresty/openresty:1.27.1.2-0-jammy"
            full_busted: false
          - version: "1.29.2.4"
            image: "openresty/openresty:1.29.2.4-0-jammy"
            full_busted: true
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Download release cdylib
        uses: actions/download-artifact@v4
        with:
          name: qjson-linux-release
          path: target/release

      - name: Run OpenResty runtime checks
        env:
          OPENRESTY_IMAGE: ${{ matrix.openresty.image }}
          OPENRESTY_FULL_BUSTED: ${{ matrix.openresty.full_busted }}
        run: .github/scripts/run-openresty-runtime.sh