ci.yml

name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

# Restrict permissions for security (principle of least privilege)
permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  test:
    name: Test Suite
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
        with:
          toolchain: stable
          components: rustfmt, clippy

      - name: Cache cargo registry
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cargo/registry
          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}

      - name: Cache cargo index
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cargo/git
          key: ${{ runner.os }}-cargo-git-${{ hashFiles('**/Cargo.lock') }}

      - name: Cache target directory
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: target
          key: ${{ runner.os }}-target-${{ hashFiles('**/Cargo.lock') }}

      - name: Run tests
        run: cargo test --verbose

      - name: Run tests (lib only)
        run: cargo test --lib --verbose

  build:
    name: Build - ${{ matrix.name }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          # Native Ubuntu build
          - name: Ubuntu Latest
            rust: stable
            container: ''
            install_deps: ''
          # Debian based distributions
          - name: Debian Bookworm
            rust: stable
            container: debian:bookworm
            install_deps: 'apt'
          - name: Debian Bullseye
            rust: stable
            container: debian:bullseye
            install_deps: 'apt'
          # RPM based distributions
          - name: Fedora Latest
            rust: stable
            container: fedora:latest
            install_deps: 'dnf'
          - name: Rocky Linux 9
            rust: stable
            container: rockylinux:9
            install_deps: 'dnf'
          # Alpine (musl-based, lightweight)
          - name: Alpine Latest
            rust: stable
            container: alpine:latest
            install_deps: 'apk'
          # Arch based
          - name: Arch Linux
            rust: stable
            container: archlinux:latest
            install_deps: 'pacman'
    container: ${{ matrix.container }}
    steps:
      - name: Install dependencies (Debian/Ubuntu)
        if: matrix.install_deps == 'apt'
        run: |
          apt-get update
          apt-get install -y curl build-essential pkg-config libssl-dev git ca-certificates bash

      - name: Install dependencies (Fedora/Rocky)
        if: matrix.install_deps == 'dnf'
        run: |
          dnf install -y gcc gcc-c++ make pkgconfig openssl-devel git bash
          # curl-minimal is already installed and sufficient for rustup

      - name: Install dependencies (Alpine)
        if: matrix.install_deps == 'apk'
        run: |
          apk add --no-cache curl gcc g++ make pkgconfig openssl-dev git ca-certificates musl-dev bash

      - name: Install dependencies (Arch)
        if: matrix.install_deps == 'pacman'
        run: |
          pacman -Syu --noconfirm curl base-devel openssl git ca-certificates bash

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Rust (GitHub Action)
        if: matrix.container == ''
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
        with:
          toolchain: stable

      - name: Install Rust (rustup in container)
        if: matrix.container != ''
        shell: bash
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH

      - name: Build debug
        shell: bash
        run: |
          if [ -f "$HOME/.cargo/env" ]; then source "$HOME/.cargo/env"; fi
          cargo build --verbose

      - name: Build release
        shell: bash
        run: |
          if [ -f "$HOME/.cargo/env" ]; then source "$HOME/.cargo/env"; fi
          cargo build --release --verbose

      - name: Test binary
        shell: bash
        run: |
          ./target/release/linux-guardian --help
          ./target/release/linux-guardian --version

      - name: Upload artifact
        if: matrix.name == 'Ubuntu Latest'
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: linux-guardian-x86_64-linux
          path: target/release/linux-guardian

  lint:
    name: Linting
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
        with:
          toolchain: stable
          components: rustfmt, clippy

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Run clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

  security:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
        with:
          toolchain: stable

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Run security audit
        run: cargo audit

  coverage:
    name: Code Coverage
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
        with:
          toolchain: stable

      - name: Install tarpaulin
        run: cargo install cargo-tarpaulin --locked

      - name: Generate coverage
        run: cargo tarpaulin --verbose --all-features --workspace --timeout 120 --out xml

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          fail_ci_if_error: false

  supply-chain:
    name: Supply Chain Security
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
        with:
          toolchain: stable

      - name: Install cargo-deny
        run: cargo install cargo-deny --locked

      - name: Run cargo-deny (advisories)
        run: cargo deny check advisories

      - name: Run cargo-deny (licenses)
        run: cargo deny check licenses

      - name: Run cargo-deny (bans)
        run: cargo deny check bans

      - name: Run cargo-deny (sources)
        run: cargo deny check sources