lint.yml

name: Lint

on:
  pull_request:
    branches:
      - main
      - zsa1
    paths:
      - "**/*.rs"
      - "**/Cargo.toml"
      - "**/Cargo.lock"
      - clippy.toml
      - .cargo/config.toml
      - .github/workflows/lint.yml

  push:
    branches: [main]
    paths:
      - "**/*.rs"
      - "**/Cargo.toml"
      - "**/Cargo.lock"
      - clippy.toml
      - .cargo/config.toml
      - .github/workflows/lint.yml

# Ensures that only one workflow task will run at a time. Previous builds, if
# already in process, will get cancelled. Only the latest commit will be allowed
# to run, cancelling any workflows in between
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: read

env:
  CLICOLOR: 1

jobs:
  clippy:
    name: clippy ${{ matrix.rust-version }} / ${{ matrix.type }}
    permissions:
      id-token: write
      statuses: write
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        # TODO: QED-it temporary Rust 1.94 pin: stable when testing Zebra v4.2.0 on upstream CI; remove before upstream merge.
        rust-version: [1.94]
        type: [release, tests]
        include:
          - type: release
            args: --workspace --all-targets
            features: default-release-binaries
          - type: tests
            args: --workspace --all-targets
            features: default-release-binaries proptest-impl lightwalletd-grpc-tests zebra-checkpoints

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
        with:
          components: clippy
          toolchain: ${{ matrix.rust-version }}
          cache-on-failure: true
      - uses: ./.github/actions/setup-zebra-build
      - name: Run clippy
        run: cargo clippy ${{ matrix.args }} --features "${{ matrix.features }}"

  crate-checks:
    permissions:
      statuses: write
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
        with:
          cache-on-failure: true
      - uses: taiki-e/install-action@305bebabd4457bed9b82541755f034994382465b #v2.68.10
        with:
          tool: cargo-hack
      - uses: ./.github/actions/setup-zebra-build
      - run: cargo hack check --workspace

  msrv:
    name: MSRV
    permissions:
      id-token: write
      statuses: write
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      matrix:
        include:
          - binary: zebrad
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
        with:
          toolchain: 1.89 # MSRV
          cache-on-failure: true
      - uses: ./.github/actions/setup-zebra-build
      - run: cargo build --bin "${{ matrix.binary }}" --workspace

  docs:
    name: docs
    permissions:
      statuses: write
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
        with:
          toolchain: nightly
          cache-on-failure: true
      - uses: ./.github/actions/setup-zebra-build
      - run: cargo doc --no-deps --workspace --all-features --document-private-items --target-dir "$(pwd)"/target/internal
        env:
          # Keep in sync with ./book.yml:jobs.build
          # The -A and -W settings must be the same as the `rustdocflags` in:
          # https://github.com/ZcashFoundation/zebra/blob/main/.cargo/config.toml#L87
          RUSTDOCFLAGS: --html-in-header katex-header.html -A rustdoc::private_intra_doc_links -D warnings

  fmt:
    name: fmt
    permissions:
      statuses: write
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
        with:
          toolchain: nightly
          components: rustfmt
      - name: Run fmt
        run: cargo fmt --all -- --check

  unused-deps:
    name: unused-deps
    permissions:
      id-token: write
      statuses: write
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
        with:
          # TODO: QED-it temp nightly pin: matches Zebra v4.2.0 CI test period; remove before upstream merge.
          toolchain: nightly-2026-03-06
          cache-on-failure: true
      - uses: taiki-e/install-action@305bebabd4457bed9b82541755f034994382465b #v2.68.10
        with:
          # TODO: QED-it temp cargo-udeps 0.1.60 pin: stable for Zebra v4.2.0 CI; remove before upstream merge.
          tool: cargo-udeps@0.1.60
      - uses: ./.github/actions/setup-zebra-build
      - run: cargo udeps --workspace --all-targets --all-features --locked

  no-test-deps:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
        with:
          toolchain: stable
          cache-on-failure: true
      - name: Ensure no arbitrary or proptest dependency on default build
        run: cargo tree --package zebrad -e=features,no-dev | grep -Eq "arbitrary|proptest" && exit 1 || exit 0

  # Checks that selected rates can compile with power set of features
  features:
    name: features
    permissions:
      id-token: write
      statuses: write
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
        with:
          toolchain: nightly
          cache-on-failure: true
      - name: cargo install cargo-hack
        uses: taiki-e/install-action@305bebabd4457bed9b82541755f034994382465b #v2.68.10
        with:
          tool: cargo-hack
      - uses: ./.github/actions/setup-zebra-build
      - run: cargo hack check --all
        env:
          RUSTFLAGS: -D warnings

  check-cargo-lock:
    name: check-cargo-lock
    permissions:
      id-token: write
      statuses: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
        with:
          toolchain: stable
          cache-on-failure: true
      - uses: ./.github/actions/setup-zebra-build
      - run: cargo check --locked --all-features --all-targets

  deny:
    name: Check deny ${{ matrix.checks }} ${{ matrix.features }}
    permissions:
      statuses: write
    runs-on: ubuntu-latest
    strategy:
      matrix:
        checks:
          - bans
          - sources
        # We don't need to check `--no-default-features` here, because (except in very rare cases):
        # - disabling features isn't going to add duplicate dependencies
        # - disabling features isn't going to add more crate sources
        features: ["", --features default-release-binaries, --all-features]
      # Always run the --all-features job, to get accurate "skip tree root was not found" warnings
      fail-fast: false

    # Prevent sudden announcement of a new advisory from failing ci:
    continue-on-error: ${{ matrix.checks == 'advisories' }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
        with:
          cache-on-failure: true
      - name: Check ${{ matrix.checks }} with features ${{ matrix.features }}
        uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 #v2.0.15
        with:
          # --all-features spuriously activates openssl, but we want to ban that dependency in
          # all of zebrad's production features for security reasons. But the --all-features job is
          # the only job that gives accurate "skip tree root was not found" warnings.
          # In other jobs, we expect some of these warnings, due to disabled features.
          command: check ${{ matrix.checks }} ${{ matrix.features == '--all-features' && '--allow banned' || '--allow unmatched-skip-root' }}
          arguments: --workspace ${{ matrix.features }}

  lint-success:
    name: lint success
    runs-on: ubuntu-latest
    if: always()
    needs:
      - clippy
      - crate-checks
      - docs
      - fmt
      - unused-deps
      - check-cargo-lock
      - no-test-deps
      - features
      - deny
    timeout-minutes: 30
    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe #v1.2.2
        with:
          jobs: ${{ toJSON(needs) }}