CI.yml

name: CI

env:
  CARGO_TERM_COLOR: always
  RUST_TOOLCHAIN: stable
  RUST_TOOLCHAIN_MSRV: 1.93.0
  CARGO_INCREMENTAL: 0
  CARGO_PROFILE_TEST_DEBUG: 0
  SEGMENT_DOWNLOAD_TIMEOUT_MINS: 5

on:
  push:
    branches:
      - main
  pull_request: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  precheck-rust:
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: -D warnings --cfg tokio_unstable
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - uses: ./.github/actions/rust-cache
        with:
          env-vars: "RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }}"
          key: ubuntu-latest-${{ env.RUST_TOOLCHAIN }}
      - name: check
        run: |
          cargo check --workspace --all-targets --all-features

  precheck-docs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: extra-checks
        run: |
          ./scripts/extra-checks.sh

  check-rust:
    strategy:
      matrix:
        toolchain:
          - 1.93.0 # MSRV
          - stable
        os:
          - ubuntu-latest
          - macos-latest
          - windows-latest
    runs-on: ${{ matrix.os }}
    needs:
      - precheck-rust
      - precheck-docs
    env:
      RUSTFLAGS: -D warnings --cfg tokio_unstable
    steps:
      - uses: actions/checkout@v6
      - uses: ilammy/setup-nasm@v1
        if: startsWith(matrix.os, 'windows')
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{ matrix.toolchain }}
          components: clippy, rustfmt
      - uses: ./.github/actions/rust-cache
        with:
          env-vars: "RUST_TOOLCHAIN=${{ matrix.toolchain }}"
          key: ${{ matrix.os }}-${{ matrix.toolchain }}
      - name: clippy
        run: |
          cargo clippy --workspace --all-targets --all-features
      - name: rustfmt
        run: |
          cargo fmt --all --check

  doc-rust:
    strategy:
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
          - windows-latest
    runs-on: ${{ matrix.os }}
    needs:
      - precheck-rust
      - precheck-docs
    env:
      RUSTFLAGS: -D warnings --cfg tokio_unstable
      RUSTDOCFLAGS: -D warnings
    steps:
      - uses: actions/checkout@v6
      - uses: ilammy/setup-nasm@v1
        if: startsWith(matrix.os, 'windows')
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - uses: ./.github/actions/rust-cache
        with:
          env-vars: "RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }}"
          key: ${{ matrix.os }}-${{ env.RUST_TOOLCHAIN }}-doc
      - name: doc
        run: |
          cargo doc --all-features --no-deps --workspace --exclude rama-cli --exclude rama-net-apple-xpc
          cargo doc --all-features --no-deps -p rama-cli

  test-rust-base:
    strategy:
      matrix:
        toolchain:
          - stable
        os:
          - ubuntu-latest
          - ubuntu-24.04-arm
          - macos-15-intel
          - macos-15
          - windows-2025
          - windows-11-arm
    name: test-rust-base-${{ matrix.toolchain }}-${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    needs:
      - precheck-rust
      - precheck-docs
    env:
      RUSTFLAGS: -D warnings --cfg tokio_unstable
    steps:
      - uses: actions/checkout@v6
      - uses: ilammy/setup-nasm@v1
        if: startsWith(matrix.os, 'windows')
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{ matrix.toolchain }}
          targets: ${{ matrix.target }}
          components: clippy, rustfmt
      - uses: taiki-e/install-action@fa0dd4cd0a40696e6f9766370614a5ce482e6aa8
        with:
          tool: nextest
      - uses: ./.github/actions/rust-cache
        with:
          key: ${{ matrix.os }}-${{ matrix.toolchain }}-${{ matrix.target }}
          env-vars: "RUST_TOOLCHAIN=${{ matrix.toolchain }}"
      - name: Run tests (cargo test)
        run: cargo nextest run --all-features --workspace
      - name: Run tests (rama-net, no default features)
        # Catches `#[cfg(not(feature = "X"))]`-gated tests that the
        # `--all-features` run can't reach (e.g. behaviour expected when
        # the `idna` feature is disabled).
        #
        # TODO: expand to `--workspace` once the pre-existing http-core
        # tests that fail under `--no-default-features` (currently
        # `ready_on_poll_stream::body_test` and
        # `unbuffered_stream::body_test`) are gated to require their
        # features.
        run: cargo nextest run --no-default-features -p rama-net
      - name: Run doc tests (cargo test)
        run: cargo test --doc --all-features --workspace
      - name: Run example tests (cargo test)
        run: cargo nextest run --all-features --examples --workspace --no-tests=pass
      - name: Run ignored tests
        if: matrix.os == 'ubuntu-latest' || matrix.os == 'macos-15'
        run: cargo nextest run --all-features --workspace --run-ignored=only
      # MITM OCSP-stapling gate. Linux: hermetic curl --cert-status matrix
      # (incl. the no-staple negative) + a real-crates.io curl/cargo leg.
      # Windows: cargo through the CONNECT proxy to real crates.io, where
      # schannel enforces revocation (the customer scenario).
      - name: MITM OCSP stapling gate (curl + cargo)
        if: matrix.os == 'ubuntu-latest'
        env:
          OCSP_GATE_REQUIRE: "1"
        run: bash scripts/ocsp-relay-gate.sh
      - name: MITM OCSP stapling gate (cargo / schannel)
        if: matrix.os == 'windows-2025'
        shell: pwsh
        run: ./scripts/ocsp-relay-gate.ps1

  test-ffi-apple-example-transparent-proxy-e2e:
    runs-on: macos-latest
    timeout-minutes: 90
    needs:
      - precheck-rust
      - precheck-docs
    env:
      RUSTFLAGS: -D warnings --cfg tokio_unstable
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{env.RUST_TOOLCHAIN}}
      - uses: ./.github/actions/rust-cache
        with:
          key: macos-latest-${{ env.RUST_TOOLCHAIN }}-apple-transparent-proxy-e2e
          env-vars: "RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }}"
      - name: Install Apple Rust targets
        run: rustup target add aarch64-apple-darwin x86_64-apple-darwin
      - name: Install just
        run: brew install just
      - name: Install xcodegen
        run: brew install xcodegen
      - name: Run transparent proxy Apple QA
        run: just qa-ffi-apple
      - name: Run transparent proxy Apple FFI e2e tests
        run: just test-e2e-ffi-apple

  test-rama-apple-ne-swift-ffi:
    runs-on: macos-latest
    needs:
      - precheck-rust
      - precheck-docs
    env:
      RUSTFLAGS: -D warnings --cfg tokio_unstable
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{env.RUST_TOOLCHAIN}}
      - uses: ./.github/actions/rust-cache
        with:
          key: macos-latest-${{ env.RUST_TOOLCHAIN }}-apple-ne-swift-ffi
          env-vars: "RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }}"
      - name: Install just
        run: brew install just
      - name: Run RamaAppleNetworkExtension Swift FFI tests
        run: just test-e2e-ffi-swift

  test-rama-apple-xpc:
    runs-on: macos-latest
    needs:
      - precheck-rust
      - precheck-docs
    env:
      RUSTFLAGS: -D warnings --cfg tokio_unstable
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{env.RUST_TOOLCHAIN}}
      - uses: ./.github/actions/rust-cache
        with:
          key: macos-latest-${{ env.RUST_TOOLCHAIN }}-apple-xpc
          env-vars: "RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }}"
      - name: Install just
        run: brew install just
      - name: Run Apple XPC QA checks
        run: just qa-xpc-apple

  test-rama-dial9:
    runs-on: ubuntu-latest
    needs:
      - precheck-rust
      - precheck-docs
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{env.RUST_TOOLCHAIN}}
          components: clippy
      - uses: taiki-e/install-action@fa0dd4cd0a40696e6f9766370614a5ce482e6aa8
        with:
          tool: just
      - uses: ./.github/actions/rust-cache
        with:
          key: ubuntu-latest-${{ env.RUST_TOOLCHAIN }}-dial9
          env-vars: "RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }}"
      - name: Run dial9 QA checks
        run: just qa-dial9

  test-fastcgi-php:
    runs-on: ubuntu-latest
    needs:
      - precheck-rust
      - precheck-docs
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{env.RUST_TOOLCHAIN}}
      - uses: taiki-e/install-action@fa0dd4cd0a40696e6f9766370614a5ce482e6aa8
        with:
          tool: just
      - uses: ./.github/actions/rust-cache
        with:
          key: ubuntu-latest-${{ env.RUST_TOOLCHAIN }}-fastcgi-php
          env-vars: "RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }}"
      - name: Install php-fpm and jq
        run: |
          sudo apt-get update
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            php-fpm php-cli jq curl
      - name: Run rama-fastcgi-php end-to-end examples
        run: just test-fastcgi-php

  test-rust-linux-musl:
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            toolchain: stable
            target: x86_64-unknown-linux-musl
          - os: ubuntu-24.04-arm
            toolchain: stable
            target: aarch64-unknown-linux-musl
    name: test-rust-linux-musl-${{ matrix.toolchain }}-${{ matrix.os }}-${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    needs:
      - precheck-rust
      - precheck-docs
    env:
      RUSTFLAGS: -D warnings --cfg tokio_unstable
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{ matrix.toolchain }}
          targets: ${{ matrix.target }}
      - uses: ./.github/actions/rust-cache
        with:
          key: ${{ matrix.os }}-${{ matrix.toolchain }}-${{ matrix.target }}
          env-vars: "RUST_TOOLCHAIN=${{ matrix.toolchain }}"
      - name: Install Zig
        if: contains(matrix.target, 'unknown-linux-musl')
        uses: mlugg/setup-zig@v2
        with:
          version: 0.13.0
      - uses: taiki-e/install-action@fa0dd4cd0a40696e6f9766370614a5ce482e6aa8
        with:
          tool: cargo-zigbuild
      - name: Build Workspace
        run: |
          cargo zigbuild -p rama -p rama-cli --target ${{ matrix.target }} --all-features
      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@v3

      - name: Scratch run test (rama-cli, with diagnostics)
        shell: bash
        run: |
          set -euo pipefail

          bin="target/${{ matrix.target }}/debug/rama"
          echo "Binary path: $bin"
          ls -lah "$bin"

          echo "file:"
          file "$bin" || true

          echo "readelf program headers (interpreter should be absent for static):"
          readelf -l "$bin" || true

          echo "readelf dynamic section (NEEDED should be absent for static):"
          readelf -d "$bin" || true

          dir="$(mktemp -d)"
          cp "$bin" "$dir/rama"
          chmod +x "$dir/rama"

          cat > "$dir/Dockerfile" <<'EOF'
          FROM scratch
          COPY rama /rama
          ENTRYPOINT ["/rama"]
          EOF

          echo "Building scratch image"
          docker buildx build --progress=plain --load -t rama-cli-scratch-test "$dir"

          echo "Smoke test in scratch: --help"
          docker run --rm rama-cli-scratch-test --help || true

          echo "HTTPS test in scratch"
          set +e
          docker run --rm --name rama-cli-scratch-test-run \
            rama-cli-scratch-test -k https://example.com
          rc="$?"
          set -e

          if [ "$rc" -ne 0 ]; then
            echo "rama-cli exited with code $rc"

            echo "docker inspect:"
            docker inspect rama-cli-scratch-test-run || true

            echo "docker logs:"
            docker logs rama-cli-scratch-test-run || true

            echo "docker rm:"
            docker rm -f rama-cli-scratch-test-run >/dev/null 2>&1 || true

            exit "$rc"
          fi

  precheck-rust-tier2:
    strategy:
      matrix:
        thing:
          - arm-android
          - arm64-android
          - i686-android
          - x86_64-android
          - aarch64-ios
          - x86_64-ios
        include:
          - custom_env: {}
          - thing: arm-android
            target: armv7-linux-androideabi
            rust: stable
            os: ubuntu-latest
          - thing: arm64-android
            target: aarch64-linux-android
            rust: stable
            os: ubuntu-latest
          - thing: i686-android
            target: i686-linux-android
            rust: stable
            os: ubuntu-latest
          - thing: x86_64-android
            target: x86_64-linux-android
            rust: stable
            os: ubuntu-latest
          - thing: aarch64-ios
            target: aarch64-apple-ios
            rust: stable
            os: macos-latest
            custom_env:
              IPHONEOS_DEPLOYMENT_TARGET: 17.5
          - thing: x86_64-ios
            target: x86_64-apple-ios
            os: macos-15-intel
            rust: stable
            custom_env:
              IPHONEOS_DEPLOYMENT_TARGET: 17.5
    needs:
      - precheck-rust
      - precheck-docs
    runs-on: ${{ matrix.os }}
    env:
      RUSTFLAGS: -D warnings --cfg tokio_unstable
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{ matrix.rust }}
      - uses: ./.github/actions/rust-cache
        with:
          env-vars: "RUST_TOOLCHAIN=${{ matrix.rust }}"
          key: ${{ matrix.os }}-${{ matrix.rust }}-${{ matrix.target }}
      - run: rustup target add ${{ matrix.target }}
      - name: Configure Android toolchain env
        if: endsWith(matrix.thing, '-android')
        shell: bash
        run: |
          ANDROID_API=21

          # Normalize NDK env vars
          echo "ANDROID_NDK_HOME=${ANDROID_NDK_HOME:-$ANDROID_NDK}" >> "$GITHUB_ENV"
          echo "ANDROID_NDK=${ANDROID_NDK:-$ANDROID_NDK_HOME}" >> "$GITHUB_ENV"

          TOOLCHAIN="${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64/bin"
          echo "${TOOLCHAIN}" >> "$GITHUB_PATH"

          TRIPLE="${{ matrix.target }}"
          TARGET_UPPER="$(echo "${TRIPLE}" | tr '[:lower:]-' '[:upper:]_')"
          TARGET_LOWER_UNDERSCORES="$(echo "${TRIPLE}" | tr '-' '_' | tr '[:upper:]' '[:lower:]')"
          NDK_TRIPLE="$(echo "${TRIPLE}" | sed 's/^armv7/armv7a/')"

          CC_PATH="${TOOLCHAIN}/${NDK_TRIPLE}${ANDROID_API}-clang"
          CXX_PATH="${TOOLCHAIN}/${NDK_TRIPLE}${ANDROID_API}-clang++"
          AR_PATH="${TOOLCHAIN}/llvm-ar"

          echo "CARGO_TARGET_${TARGET_UPPER}_LINKER=${CXX_PATH}" >> "$GITHUB_ENV"

          # Target specific for cc-rs style
          echo "CC_${TARGET_LOWER_UNDERSCORES}=${CC_PATH}" >> "$GITHUB_ENV"
          echo "CXX_${TARGET_LOWER_UNDERSCORES}=${CXX_PATH}" >> "$GITHUB_ENV"
          echo "AR_${TARGET_LOWER_UNDERSCORES}=${AR_PATH}" >> "$GITHUB_ENV"

          # Also set generic vars in case your Config only reads CC/CXX/AR
          echo "CC=${CC_PATH}" >> "$GITHUB_ENV"
          echo "CXX=${CXX_PATH}" >> "$GITHUB_ENV"
          echo "AR=${AR_PATH}" >> "$GITHUB_ENV"
      - name: check
        env: ${{ matrix.custom_env }}
        run: |
          cargo check --workspace --target ${{ matrix.target }} --all-features
      - name: Build tests
        env: ${{ matrix.custom_env }}
        # We `build` because we want the linker to verify we are cross-compiling correctly for check-only targets.
        run: |
          cargo build --target ${{ matrix.target }} --tests --all-features

  test-baseline-no-tokio-unstable:
    runs-on: ubuntu-latest
    needs:
      - precheck-rust
      - precheck-docs
    env:
      RUSTFLAGS: -D warnings
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{env.RUST_TOOLCHAIN}}
      - uses: taiki-e/install-action@fa0dd4cd0a40696e6f9766370614a5ce482e6aa8
        with:
          tool: nextest
      - uses: ./.github/actions/rust-cache
        with:
          env-vars: "RUST_TOOLCHAIN=${{env.RUST_TOOLCHAIN}}"
          key: ubuntu-latest-${{env.RUST_TOOLCHAIN}}-baseline-no-tokio-unstable
      - name: Baseline tests without tokio_unstable
        run: |
          cargo nextest run --workspace
          cargo test --doc --workspace

  test-loom:
    runs-on: ubuntu-latest
    needs:
      - precheck-rust
      - precheck-docs
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{env.RUST_TOOLCHAIN}}
      - uses: taiki-e/install-action@fa0dd4cd0a40696e6f9766370614a5ce482e6aa8
        with:
          tool: nextest
      - uses: ./.github/actions/rust-cache
        with:
          env-vars: "RUST_TOOLCHAIN=${{env.RUST_TOOLCHAIN}}"
          key: ubuntu-latest-${{env.RUST_TOOLCHAIN}}-loom
      - name: Run Loom tests (rama-utils)
        run: |
          RUSTFLAGS="--cfg loom -Dwarnings" \
            cargo nextest run --all-features -p rama-utils

  cargo-hack-base:
    runs-on: ubuntu-latest
    needs:
      - precheck-rust
      - precheck-docs
    env:
      RUSTFLAGS: -D warnings
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{env.RUST_TOOLCHAIN}}
      - uses: taiki-e/install-action@fa0dd4cd0a40696e6f9766370614a5ce482e6aa8
        with:
          tool: cargo-hack
      - uses: ./.github/actions/rust-cache
        with:
          env-vars: "RUST_TOOLCHAIN=${{env.RUST_TOOLCHAIN}}"
          key: ubuntu-latest-${{env.RUST_TOOLCHAIN}}-cargo-hack-base
      - name: install protoc
        run: |
          sudo apt-get update
          sudo apt-get install --yes protobuf-compiler
          protoc --version
      - name: cargo hack check without dial9
        run: cargo hack check --each-feature --exclude-features dial9 --exclude-all-features --no-dev-deps --workspace

  cargo-hack-dial9:
    runs-on: ubuntu-latest
    needs:
      - precheck-rust
      - precheck-docs
    env:
      RUSTFLAGS: -D warnings --cfg tokio_unstable
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{env.RUST_TOOLCHAIN}}
      - uses: taiki-e/install-action@fa0dd4cd0a40696e6f9766370614a5ce482e6aa8
        with:
          tool: cargo-hack
      - uses: ./.github/actions/rust-cache
        with:
          env-vars: "RUST_TOOLCHAIN=${{env.RUST_TOOLCHAIN}}"
          key: ubuntu-latest-${{env.RUST_TOOLCHAIN}}-cargo-hack-dial9
      - name: install protoc
        run: |
          sudo apt-get update
          sudo apt-get install --yes protobuf-compiler
          protoc --version
      - name: cargo hack check with dial9
        run: cargo hack check --each-feature --no-dev-deps --workspace

  meta-lints:
    runs-on: ubuntu-latest
    needs:
      - precheck-rust
      - precheck-docs
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{env.RUST_TOOLCHAIN}}
      - name: cargo deny
        uses: EmbarkStudios/cargo-deny-action@v2
        with:
          rust-version: ${{env.RUST_TOOLCHAIN}}
      - uses: taiki-e/install-action@fa0dd4cd0a40696e6f9766370614a5ce482e6aa8
        with:
          tool: cargo-sort
      - name: cargo sort (dependencies)
        run: cargo sort --workspace --grouped --check

  test-rust-e2e-release:
    strategy:
      matrix:
        toolchain:
          - stable
        os:
          - ubuntu-latest
    runs-on: ${{ matrix.os }}
    needs:
      - precheck-rust
      - precheck-docs
    env:
      RUSTFLAGS: -D warnings --cfg tokio_unstable
    steps:
      - uses: actions/checkout@v6
      - uses: ilammy/setup-nasm@v1
        if: startsWith(matrix.os, 'windows')
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{ matrix.toolchain }}
          components: clippy, rustfmt
      - uses: taiki-e/install-action@fa0dd4cd0a40696e6f9766370614a5ce482e6aa8
        with:
          tool: nextest
      - uses: ./.github/actions/rust-cache
        with:
          key: ${{ matrix.os }}-${{ matrix.toolchain }}-release
          env-vars: "RUST_TOOLCHAIN=${{ matrix.toolchain }}"
      - name: Run tests in release mode (--ignored)
        run: |
          cargo nextest run --all-features --release --workspace --run-ignored=only

  test-ws-autobahn:
    runs-on: ubuntu-latest
    needs:
      - precheck-rust
      - precheck-docs
    timeout-minutes: 90
    env:
      RUSTFLAGS: -D warnings --cfg tokio_unstable
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
      - uses: ./.github/actions/rust-cache
        with:
          key: ubuntu-latest-${{ env.RUST_TOOLCHAIN }}-autobahn
          env-vars: "RUST_TOOLCHAIN=${{env.RUST_TOOLCHAIN}}"
      - name: Install jq
        run: sudo apt-get update && sudo apt-get install -y jq
      - name: Run autobahn ws server test-suite
        shell: bash
        working-directory: "./rama-ws"
        run: ./autobahn/server.sh
      - name: Run autobahn ws client test-suite
        shell: bash
        working-directory: "./rama-ws"
        run: ./autobahn/client.sh

  test-spec-h2:
    runs-on: ubuntu-latest
    needs:
      - precheck-rust
      - precheck-docs
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2
        with:
          toolchain: ${{env.RUST_TOOLCHAIN}}
      - name: h2spec
        run: |
          bash rama-http-core/ci/h2spec.sh -F

  semver-checks:
    runs-on: ubuntu-latest
    needs:
      - precheck-rust
      - precheck-docs
    steps:
      - uses: actions/checkout@v6
      - name: Check semver
        uses: obi1kenobi/cargo-semver-checks-action@v2
        with:
          rust-toolchain: ${{env.RUST_TOOLCHAIN}}

  deploy-rama-cli-docker:
    runs-on: ubuntu-latest
    needs:
      - precheck-rust-tier2
      - check-rust
      - doc-rust
      - test-rust-base
      - test-ffi-apple-example-transparent-proxy-e2e
      - test-rama-apple-ne-swift-ffi
      - test-fastcgi-php
      - test-rust-linux-musl
      - test-rama-apple-xpc
      - test-baseline-no-tokio-unstable
      - test-loom
      - cargo-hack-base
      - cargo-hack-dial9
      - meta-lints
      - test-rust-e2e-release
      - test-ws-autobahn
      - test-spec-h2
      - semver-checks
    if: github.ref == 'refs/heads/main'
    steps:
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: glendc/rama:edge
          file: rama-cli/infra/Dockerfile

  deploy-rama-fp-fly:
    runs-on: ubuntu-latest
    needs: deploy-rama-cli-docker
    steps:
      - uses: actions/checkout@v6
      - uses: superfly/flyctl-actions/setup-flyctl@master
      - run: |
          cd rama-fp/infra/deployments/fp
          flyctl deploy --verbose --remote-only
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

  deploy-rama-fp-h1-fly:
    runs-on: ubuntu-latest
    needs: deploy-rama-cli-docker
    steps:
      - uses: actions/checkout@v6
      - uses: superfly/flyctl-actions/setup-flyctl@master
      - run: |
          cd rama-fp/infra/deployments/fp-h1
          flyctl deploy --verbose --remote-only
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

  deploy-rama-ip-ipv4-fly:
    runs-on: ubuntu-latest
    needs: deploy-rama-cli-docker
    steps:
      - uses: actions/checkout@v6
      - uses: superfly/flyctl-actions/setup-flyctl@master
      - run: |
          cd rama-fp/infra/deployments/ipv4
          flyctl deploy --verbose --remote-only
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

  deploy-rama-ip-ipv6-fly:
    runs-on: ubuntu-latest
    needs: deploy-rama-cli-docker
    steps:
      - uses: actions/checkout@v6
      - uses: superfly/flyctl-actions/setup-flyctl@master
      - run: |
          cd rama-fp/infra/deployments/ipv6
          flyctl deploy --verbose --remote-only
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

  deploy-rama-echo-fly:
    runs-on: ubuntu-latest
    needs: deploy-rama-cli-docker
    steps:
      - uses: actions/checkout@v6
      - uses: superfly/flyctl-actions/setup-flyctl@master
      - run: |
          cd rama-fp/infra/deployments/echo
          flyctl deploy --verbose --remote-only
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

  deploy-rama-http-test-fly:
    runs-on: ubuntu-latest
    needs: deploy-rama-cli-docker
    steps:
      - uses: actions/checkout@v6
      - uses: superfly/flyctl-actions/setup-flyctl@master
      - run: |
          cd rama-fp/infra/deployments/http-test
          flyctl deploy --verbose --remote-only
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}