rust.yml

name: Rust

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    # Pin to actions/checkout v4.2.2
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
    - name: Check formatting
      run: cargo fmt --all -- --check
    - name: Clippy
      run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
    - name: Build
      run: cargo build --locked --workspace --verbose
    - name: Run tests
      run: cargo test --locked --workspace --verbose

  coverage:
    runs-on: ubuntu-latest
    steps:
    # Pin to actions/checkout v4.2.2
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
    - name: Install LLVM coverage tools
      run: |
        rustup component add llvm-tools-preview
        cargo install cargo-llvm-cov --version 0.8.7 --locked
    - name: Enforce money-path line coverage
      run: >-
        cargo llvm-cov
        --locked
        --package altius-txguard
        --package altius-signer
        --package altius-payments
        --all-features
        --fail-under-lines 80

  scan:
    # altius scan SARIF gate (plugin-pack / CI surface). Scans a clean
    # fixture so the job stays green; --fail-on-findings trips on High/Critical.
    runs-on: ubuntu-latest
    steps:
    # Pin to actions/checkout v4.2.2
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
    - name: Build altius CLI
      run: cargo build --locked -p altius-cli --release
    - name: Scan fixture (SARIF)
      run: |
        mkdir -p testdata/scan-clean
        ./target/release/altius scan \
          --path testdata/scan-clean \
          --chain auto \
          --format sarif \
          --fail-on-findings \
          > altius-scan.sarif
    - name: Upload SARIF
      if: always()
      # Pin to actions/upload-artifact v4.6.0
      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
      with:
        name: altius-scan-sarif
        path: altius-scan.sarif
        if-no-files-found: warn

  neo4j:
    # Feature-gated Neo4j path: compile the neo4j features and run the
    # altius-memory integration test against a real service container.
    runs-on: ubuntu-latest
    services:
      neo4j:
        image: neo4j:5-community
        ports:
          - 7687:7687
          - 7474:7474
        env:
          NEO4J_AUTH: neo4j/altius-dev
        options: >-
          --health-cmd "wget -qO- http://localhost:7474 || exit 1"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    env:
      ALTIUS_NEO4J_URI: bolt://127.0.0.1:7687
      ALTIUS_NEO4J_USER: neo4j
      ALTIUS_NEO4J_PASSWORD: altius-dev
    steps:
    # Pin to actions/checkout v4.2.2
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
    - name: Run Neo4j integration tests
      run: cargo test --locked -p altius-memory --features neo4j --verbose