oxipng/.github/workflows/oxipng.yml

name: oxipng

on:
  push:
  pull_request:
  merge_group:
    types:
      - checks_requested
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.merge_group.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  ci:
    name: CI

    runs-on: ${{ matrix.os }}
    timeout-minutes: 60

    # Prevent tags and in-repo PRs from triggering this workflow more than once for a commit.
    # We also exclude 'push' events from the Merge Queue (gh-readonly-queue/) because they
    # trigger alongside the 'merge_group' event. Without this, a race condition in the
    # concurrency group could cause the 'push' event to cancel the 'merge_group' event.
    if: >-
      github.ref_type != 'tag' &&
      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork) &&
      (!(github.event_name == 'push' && startsWith(github.ref, 'refs/heads/gh-readonly-queue/')))      

    strategy:
      fail-fast: false
      matrix:
        target:
          - x86_64-unknown-linux-gnu
          - x86_64-unknown-linux-musl
          - aarch64-unknown-linux-gnu
          - aarch64-unknown-linux-musl
          - x86_64-pc-windows-msvc
          - i686-pc-windows-msvc
          - x86_64-apple-darwin
          - aarch64-apple-darwin

        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-24.04
            target-apt-arch: amd64
          - target: x86_64-unknown-linux-musl
            os: ubuntu-24.04
            target-apt-arch: amd64
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-24.04-arm
            target-apt-arch: arm64
          - target: aarch64-unknown-linux-musl
            os: ubuntu-24.04-arm
            target-apt-arch: arm64
          - target: x86_64-pc-windows-msvc
            os: windows-latest
          - target: i686-pc-windows-msvc
            os: windows-latest
          - target: x86_64-apple-darwin
            os: macos-15
          - target: aarch64-apple-darwin
            os: macos-15

    env:
      CARGO_BUILD_TARGET: ${{ matrix.target }}

    steps:
      - name: Checkout source
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Install musl development files
        if: endsWith(matrix.target, '-musl')
        run: |
          sudo apt-get -yq update
          sudo apt-get -yq install musl-tools musl-dev:${{ matrix.target-apt-arch }}          

      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: nightly
          target: ${{ env.CARGO_BUILD_TARGET }}
          components: clippy, rustfmt, rust-src
          cache-bin: false
          cache-shared-key: cache

      - name: Install nextest
        uses: taiki-e/install-action@nextest

      - name: Install cargo-hack
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        uses: taiki-e/install-action@cargo-hack

      - name: Install clippy-sarif
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        uses: taiki-e/install-action@v2
        with:
          tool: clippy-sarif

      - name: Install sarif-fmt
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        uses: taiki-e/install-action@v2
        with:
          tool: sarif-fmt

      - name: Run rustfmt
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        run: cargo fmt --check

      - name: Run Clippy for all feature combinations
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        run: >
          set -o pipefail;
          cargo hack clippy --no-deps --all-targets --feature-powerset \
            --exclude-features sanity-checks,system-libdeflate \
            --message-format=json -- -D warnings \
          | clippy-sarif
          | tee clippy-results.sarif
          | sarif-fmt          

      - name: Run tests
        run: |
          cargo nextest run --release --features sanity-checks
          cargo test --doc --release --features sanity-checks          

      - name: Build benchmarks
        run: cargo bench --no-run

      - name: Build docs
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        run: cargo doc --release --no-deps

      - name: Build CLI binary
        run: cargo build --release -Zbuild-std
        env:
          RUSTFLAGS: '-Zlocation-detail=none -Zunstable-options -Cpanic=immediate-abort'

      - name: Upload CLI binary as artifact
        uses: actions/upload-artifact@v7
        with:
          name: Oxipng binary (${{ matrix.target }})
          path: |
            target/${{ env.CARGO_BUILD_TARGET }}/release/oxipng
            target/${{ env.CARGO_BUILD_TARGET }}/release/oxipng.exe            

      - name: Upload analysis results to GitHub
        uses: github/codeql-action/upload-sarif@v4
        if: always() && matrix.target == 'x86_64-unknown-linux-gnu'
        continue-on-error: true
        with:
          sarif_file: clippy-results.sarif
          category: clippy

  msrv-check:
    name: MSRV check

    runs-on: ubuntu-latest
    timeout-minutes: 30

    # Prevent tags and in-repo PRs from triggering this workflow more than once for a commit.
    # We also exclude 'push' events from the Merge Queue (gh-readonly-queue/) because they
    # trigger alongside the 'merge_group' event. Without this, a race condition in the
    # concurrency group could cause the 'push' event to cancel the 'merge_group' event.
    if: >-
      github.ref_type != 'tag' &&
      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork) &&
      (!(github.event_name == 'push' && startsWith(github.ref, 'refs/heads/gh-readonly-queue/')))      

    steps:
      - name: Checkout source
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Install MSRV Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: 1.85.1
          cache-bin: false
          cache-shared-key: cache

      - name: Install nextest
        uses: taiki-e/install-action@nextest

      - name: Run tests
        run: |
          cargo nextest run --release --features sanity-checks
          cargo test --doc --release --features sanity-checks