name: Rust

on:
  push:
    branches: [ "main" ]
    paths:
      - 'src/**'
      - 'crates/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'build.rs'
      - 'benches/**'
      - 'Dockerfile'
      - 'deny.toml'
      - '.github/workflows/rust.yml'
  pull_request:
    branches: [ "main" ]
    paths:
      - 'src/**'
      - 'crates/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'build.rs'
      - 'benches/**'
      - 'Dockerfile'
      - 'deny.toml'
      - '.github/workflows/rust.yml'
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
    - name: Install dependencies
      run: sudo apt-get update && sudo apt-get install -y libpcap-dev libelf-dev zlib1g-dev clang llvm pkg-config
    - name: Check formatting
      run: cargo fmt --check
    # --workspace --all-targets so the library crates (rustnet-core/-capture/
    # -host) are linted, built, and tested too. The workspace root is a real
    # package (rustnet-monitor), so a bare `cargo {clippy,build,test}` only
    # selects the binary and silently skips the library crates' lints, tests,
    # and doctests.
    - name: Run clippy
      run: cargo clippy --workspace --all-targets -- -D warnings
    - name: Build
      run: cargo build --workspace --all-targets --verbose
    - name: Run tests
      run: cargo test --workspace --verbose
    - name: Run cargo-deny
      # Checks RustSec advisories and yanked crates (yanked = "deny" in
      # deny.toml, so a withdrawn dependency pinned in Cargo.lock is caught),
      # plus license policy, wildcard bans, and registry sources.
      uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2.0.20
      with:
        command: check

  docker:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
    - name: Build Docker image
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
      with:
        context: .
        push: false
        load: true
        tags: rustnet:ci-test
    - name: Verify Docker image
      run: docker run --rm rustnet:ci-test --version