test.yml

name: "Run Tests"

permissions:
  contents: read

on:
  push:
    branches: [main]
  pull_request:
    branches: [main, "feature/**"]

jobs:
  test-rust:
    name: cargo test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Retrieve Rust version
        id: rust-version
        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
        shell: bash

      - name: Retrieve Viceroy version
        id: viceroy-version
        # `.tool-versions` is the single source of truth so this workflow and
        # `.github/actions/setup-integration-test-env/action.yml` can't drift.
        run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
        shell: bash

      - name: Set up Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: ${{ steps.rust-version.outputs.rust-version }}
          target: wasm32-wasip1
          cache-shared-key: cargo-${{ runner.os }}

      - name: Cache Viceroy binary
        id: cache-viceroy
        uses: actions/cache@v4
        with:
          path: ~/.cargo/bin/viceroy
          key: viceroy-${{ runner.os }}-v${{ steps.viceroy-version.outputs.viceroy-version }}

      - name: Install Viceroy
        if: steps.cache-viceroy.outputs.cache-hit != 'true'
        run: cargo install viceroy --version "${{ steps.viceroy-version.outputs.viceroy-version }}" --locked --force

      - name: Run tests
        run: cargo test-fastly

  test-axum:
    name: cargo test (axum native)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Retrieve Rust version
        id: rust-version
        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
        shell: bash

      - name: Set up Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: ${{ steps.rust-version.outputs.rust-version }}
          # wasm32-wasip1 is required by the "Verify Fastly WASM release
          # build" step below; the axum build and tests are native.
          target: wasm32-wasip1
          cache-shared-key: cargo-${{ runner.os }}

      - name: Build Axum adapter
        run: cargo build -p trusted-server-adapter-axum

      - name: Run Axum adapter tests
        run: cargo test-axum

      - name: Run HTML processor benchmarks (smoke)
        # -- --test runs each benchmark as a regular test (no timing harness) so CI stays fast
        run: cargo bench -p trusted-server-core --bench html_processor_bench -- --test

      - name: Run host-target CLI tests
        run: ./scripts/test-cli.sh

      - name: Verify Fastly WASM release build
        run: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1

  test-cloudflare:
    name: cargo check (cloudflare native + wasm32-unknown-unknown)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Retrieve Rust version
        id: rust-version
        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
        shell: bash

      - name: Set up Rust toolchain (native + wasm32-unknown-unknown)
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: ${{ steps.rust-version.outputs.rust-version }}
          target: wasm32-unknown-unknown
          cache-shared-key: cargo-${{ runner.os }}

      - name: Check Cloudflare adapter (native host)
        run: cargo check -p trusted-server-adapter-cloudflare

      - name: Check Cloudflare adapter (wasm32-unknown-unknown)
        run: cargo check -p trusted-server-adapter-cloudflare --target wasm32-unknown-unknown --features cloudflare

      - name: Run Cloudflare adapter tests (native host)
        run: cargo test-cloudflare

  test-spin:
    name: cargo check/build/test (spin native + wasm32-wasip1)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Retrieve Rust version
        id: rust-version
        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
        shell: bash

      - name: Set up Rust toolchain (native + wasm32-wasip1)
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: ${{ steps.rust-version.outputs.rust-version }}
          target: wasm32-wasip1
          cache-shared-key: cargo-${{ runner.os }}

      - name: Check Spin adapter (native host)
        run: cargo check -p trusted-server-adapter-spin

      - name: Check Spin adapter (wasm32-wasip1)
        run: cargo check-spin

      - name: Build Spin adapter release WASM
        # Mirror the Fastly release-build overrides so the artifact embeds usable
        # settings instead of the trusted-server.toml placeholders, which startup
        # rejects (falling back to the generic 503 router). This proves the
        # documented Spin artifact can boot, not just compile.
        env:
          TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:8080
          TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
          TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
        run: cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release

      - name: Run Spin adapter tests (native host)
        run: cargo test-spin

  test-parity:
    name: cargo test (cross-adapter parity)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Retrieve Rust version
        id: rust-version
        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
        shell: bash

      - name: Set up Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: ${{ steps.rust-version.outputs.rust-version }}
          components: clippy, rustfmt
          cache-shared-key: cargo-${{ runner.os }}

      - name: Format check (parity test crate)
        run: cargo fmt --manifest-path crates/trusted-server-integration-tests/Cargo.toml -- --check

      - name: Run cross-adapter parity tests
        run: cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity

      - name: Clippy (parity test crate)
        run: cargo clippy --manifest-path crates/trusted-server-integration-tests/Cargo.toml --all-targets -- -D warnings

  test-cli:
    # `trusted-server-cli` is a workspace member, but the workspace default target
    # is wasm32-wasip1 (see .cargo/config.toml), where the crate is an empty shell
    # — so the wasm workspace jobs do not exercise its real code. `ts dev proxy` is
    # a macOS tool (Safari/keychain/networksetup), so validate the crate on macOS
    # with an explicit native --target that overrides the wasm default.
    name: cargo test (ts CLI, native)
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4

      - name: Retrieve Rust version
        id: rust-version
        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
        shell: bash

      - name: Set up Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: ${{ steps.rust-version.outputs.rust-version }}
          components: "clippy, rustfmt"
          cache-shared-key: cargo-cli-${{ runner.os }}

      # No separate `cargo fmt` here: `trusted-server-cli` is a workspace member,
      # so the main `cargo fmt --all` job already formats it. Clippy still needs a
      # native run — the workspace clippy jobs are wasm/adapter-scoped and never
      # lint the CLI's host-only code (macOS dev proxy vs Linux audit differ by cfg).
      - name: cargo clippy
        run: |
          cargo clippy --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')" --all-targets -- -D warnings

      - name: cargo test
        run: |
          cargo test --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')"

  test-typescript:
    name: vitest
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: crates/trusted-server-js/lib
    steps:
      - uses: actions/checkout@v4

      - name: Retrieve Node.js version
        id: node-version
        working-directory: .
        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
        shell: bash

      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ steps.node-version.outputs.node-version }}
          cache: "npm"
          cache-dependency-path: crates/trusted-server-js/lib/package.json

      - name: Install dependencies
        run: npm ci

      - name: Build bundle
        run: npm run build

      - name: Run unit tests
        run: npm test -- --run