ci.yml

name: CI

# The release-gate set (CLAUDE.md §2.4a) that every PR to main must pass GREEN before
# merge. Job names here are the required status checks in branch protection: Rustfmt,
# Clippy, Test + coverage, Build. (Commit-message + version-increment gates live in their
# own workflows.)

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}-${{ github.event_name }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  fmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust (rustfmt)
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust (clippy)
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --all-targets --all-features -- -D warnings

  test:
    name: Test + coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview
      - uses: Swatinem/rust-cache@v2
      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-llvm-cov
      # cargo-nextest natively retries a failing test and reports it as "flaky" (failed
      # then passed) instead of a hard CI failure, surfacing flake without hiding it
      # (CLAUDE.md #489). Retries run inside the llvm-cov-instrumented nextest run so
      # coverage gating (>=80%, CLAUDE.md §2.3) still applies to the whole suite.
      - name: Install cargo-nextest
        uses: taiki-e/install-action@nextest
      - name: cargo llvm-cov nextest (test + coverage, gated >=80%, retries=2)
        run: cargo llvm-cov nextest --all-features --fail-under-lines 80 --summary-only --retries 2 | tee coverage-summary.txt
      - name: Coverage summary to job summary
        if: always()
        run: |
          {
            echo '### dig-dns coverage'
            echo '```'
            cat coverage-summary.txt 2>/dev/null || echo 'no coverage output'
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --all-targets --locked

  # ---------------------------------------------------------------------------------------
  # Service smoke — proves `dig-dns install` end-to-end against the REAL OS service manager
  # (Windows SCM / macOS launchd / Linux systemd --user) on every platform dig-dns ships for.
  # This is the cross-OS acceptance evidence for dig_ecosystem #240 + #502: the clean-reinstall
  # contract (src/service.rs) is unit-tested against a mock everywhere, but only a real install
  # proves the actual `sc.exe`/`launchctl`/`systemctl` calls succeed.
  #
  # Deliberately NO port env overrides: `service-manager`'s Windows SCM backend (`sc create`)
  # does not pass a service's `environment` through at all (`sc.exe` has no such flag), so a
  # config override baked at install time is silently dropped on Windows -- an override here
  # would make the smoke assert against a port the real service never binds. Instead this
  # relies on the ALREADY-SHIPPED, already-unit-tested primary/fallback dance (src/server.rs
  # `bind_listener`: try :80, fall back to the deterministic :8053 on ANY bind error, including
  # unprivileged/permission-denied) -- the same graceful degradation release.yml's native-package
  # smoke tests already exercise successfully. So the assertion here is "the service reaches
  # RUNNING", never a literal :53/:80 bind.
  # ---------------------------------------------------------------------------------------
  service-smoke:
    name: Service smoke (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, macos-14, ubuntu-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 12
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: service-smoke-${{ matrix.os }}

      # Linux install is SYSTEM-level and requires root (dig_ecosystem #523/#528): the unit is
      # written to /etc/systemd/system under the canonical name net.dignetwork.dig-dns.service and
      # binds the privileged :53/:80 loopback ports as root (bounded to CAP_NET_BIND_SERVICE). So
      # the privileged verbs (install/stop/uninstall) run under sudo on Linux; status stays
      # unprivileged (it only probes loopback + reads the machine-wide state dir, #501). $SUDO is
      # empty on Windows/macOS (Windows SCM elevation is already present; macOS is a user agent).
      - name: Elevate the privileged service verbs (Linux)
        if: runner.os == 'Linux'
        run: echo "SUDO=sudo" >> "$GITHUB_ENV"

      # macOS does NOT accept the whole 127.0.0.0/8 range on lo0 by default (unlike Linux/
      # Windows) -- only 127.0.0.1 is there out of the box. dig-dns's default bind IP (127.0.0.5,
      # SPEC S5) needs the SAME loopback alias the real installer applies (README.md/doctor.rs's
      # documented fix); without it the gateway can never bind, so `dig-dns status` would find
      # nothing listening on EITHER the primary or fallback port (same unassigned IP, only the
      # port differs).
      - name: Alias the dig-dns loopback IP on lo0 (macOS)
        if: runner.os == 'macOS'
        run: sudo ifconfig lo0 alias 127.0.0.5 up

      - name: Build the release binary
        run: cargo build --release --locked --bin dig-dns

      - name: Resolve the binary path
        run: |
          if [ "${{ runner.os }}" = "Windows" ]; then
            echo "BIN=target/release/dig-dns.exe" >> "$GITHUB_ENV"
          else
            echo "BIN=target/release/dig-dns" >> "$GITHUB_ENV"
          fi

      - name: Install (fresh)
        run: "$SUDO \"$BIN\" install --json | tee install-1.json"
      - name: Fresh install was NOT a reinstall
        run: grep -q '"reinstalled":false' install-1.json

      - name: Poll until the service reports RUNNING
        run: |
          for i in $(seq 1 30); do
            if "$BIN" status --json | tee status-1.json | grep -q '"serving":true'; then
              echo "service is serving after ${i}s"
              exit 0
            fi
            sleep 1
          done
          echo "::error::service never reached RUNNING within 30s"
          cat status-1.json || true
          exit 1

      - name: Windows — assert the SCM display name
        if: runner.os == 'Windows'
        run: |
          OUT="$(sc.exe qc net.dignetwork.dig-dns)"
          echo "$OUT"
          echo "$OUT" | grep -q "DIG NETWORK: DNS"

      - name: Second install is a clean reinstall (no 1073)
        run: |
          $SUDO "$BIN" install --json | tee install-2.json
          grep -q '"reinstalled":true' install-2.json

      - name: Poll until RUNNING again (post-reinstall)
        run: |
          for i in $(seq 1 30); do
            if "$BIN" status --json | tee status-2.json | grep -q '"serving":true'; then
              echo "service is serving after the reinstall (${i}s)"
              exit 0
            fi
            sleep 1
          done
          echo "::error::service never reached RUNNING after the reinstall"
          cat status-2.json || true
          exit 1

      - name: Stop
        run: "$SUDO \"$BIN\" stop --json"

      - name: Uninstall
        run: "$SUDO \"$BIN\" uninstall --json | tee uninstall.json"
      - name: Assert the service is gone
        run: |
          grep -q '"installed":false' uninstall.json
          "$BIN" status --json | tee status-final.json || true
          grep -q '"registered":false' status-final.json

  # ---------------------------------------------------------------------------------------
  # configure-os end-to-end (dig_ecosystem #530) — the ONE leg where a real OS resolver is
  # live: GitHub's ubuntu-latest uses systemd-resolved, so we can prove that `configure-os`
  # actually flips Path A to live (the OS resolves a *.dig name to the responder) and that
  # `unconfigure-os` leaves ZERO residue. The per-OS APPLY layer is otherwise only reachable
  # via the pure builder unit tests + macOS/Windows package smokes in release.yml; this is the
  # Linux end-to-end acceptance evidence the pure tests can't give.
  # ---------------------------------------------------------------------------------------
  configure-os-smoke:
    name: configure-os end-to-end (systemd-resolved)
    runs-on: ubuntu-latest
    timeout-minutes: 12
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: configure-os-smoke
      - name: Build the release binary
        run: cargo build --release --locked --bin dig-dns

      # The whole sequence runs in ONE step so the backgrounded `serve` (root, to bind
      # 127.0.0.5:53 for the DNS responder — the Path A leg) persists across it.
      - name: configure-os flips Path A live, unconfigure-os leaves zero residue
        run: |
          set -eo pipefail
          BIN="$PWD/target/release/dig-dns"
          DROPIN=/etc/systemd/resolved.conf.d/dig.conf

          # Responder as root: binds 127.0.0.5:53 (DNS) + :80→:8053 (gateway). Linux has 127/8 up.
          sudo -b "$BIN" serve
          sleep 2

          # Wire systemd-resolved to route ~dig at the responder.
          sudo "$BIN" configure-os --json | tee configure.json
          grep -q '"resolver":"systemd-resolved"' configure.json
          test -f "$DROPIN"
          grep -qF 'managed by dig-dns configure-os' "$DROPIN"

          # Path A must now be live end-to-end (the OS resolves *.dig -> 127.0.0.5).
          ok=0
          for i in $(seq 1 25); do
            "$BIN" doctor --json > doctor.json || true
            if grep -q '"path_a":true' doctor.json; then ok=1; echo "Path A live after ${i}s"; break; fi
            sleep 1
          done
          [ "$ok" = 1 ] || { echo "::error::configure-os did not make Path A live"; cat doctor.json; exit 1; }

          # unconfigure-os removes the drop-in (marker-scoped) — ZERO residue.
          sudo "$BIN" unconfigure-os --json | tee unconfigure.json
          grep -q 'resolved.conf.d/dig.conf' unconfigure.json
          test ! -e "$DROPIN"

          sudo pkill -f "$BIN serve" 2>/dev/null || true
          echo "configure-os end-to-end PASSED: Path A flipped live, then removed with zero residue."

  # ---------------------------------------------------------------------------------------
  # .deb package-hook smoke (dig_ecosystem #530 + #525) — build the real .deb and prove that
  # (a) its postinst STILL enables+starts the unit despite the now-custom maintainer scripts
  # (the #525 guarantee — the custom postinst keeps `#DEBHELPER#`), and (b) the postinst's
  # `configure-os` wires the resolver + `apt remove`'s prerm `unconfigure-os` leaves ZERO
  # residue. Runs on the ubuntu-latest runner VM (has systemd, unlike a container). Mirrors
  # release.yml's .deb leg so a hook regression is caught at PR time, not at release.
  # ---------------------------------------------------------------------------------------
  deb-hooks-smoke:
    name: .deb install/configure-os/remove smoke
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: deb-hooks-smoke
      - name: Build the release binaries + .deb
        # Build BOTH bins: `digd` is the first-class alias (dig_ecosystem #548) and cargo-deb's
        # default assets include every `[[bin]]`, so `cargo deb --no-build` needs both present.
        run: |
          cargo build --release --locked --bin dig-dns --bin digd
          cargo install cargo-deb --locked
          cargo deb --no-build
      - name: Install the .deb, assert enable/start + configure-os, then remove with zero residue
        run: |
          set -eo pipefail
          DEB=$(ls target/debian/*.deb)
          DROPIN=/etc/systemd/resolved.conf.d/dig.conf
          echo "Installing $DEB"
          sudo apt-get update -qq || true
          sudo apt-get install -y "./$DEB"

          # #525: the custom postinst (which keeps #DEBHELPER#) MUST still enable the unit.
          systemctl is-enabled net.dignetwork.dig-dns || { echo "::error::unit not enabled (#525 regression)"; exit 1; }

          # #530: the postinst's configure-os wires systemd-resolved on this runner.
          if [ -f "$DROPIN" ]; then
            grep -qF 'managed by dig-dns configure-os' "$DROPIN" || { echo "::error::drop-in not marker-tagged"; exit 1; }
            echo "postinst configure-os wired $DROPIN"; WIRED=1
          else
            echo "(no drop-in — resolver owner may differ on this runner; informational)"; WIRED=0
          fi
          # INFORMATIVE: whether *.dig actually resolves (service :53 bind timing can vary).
          for i in $(seq 1 10); do
            if resolvectl query test.dig 2>/dev/null | grep -q 127.0.0.5; then echo "*.dig resolves to 127.0.0.5"; break; fi
            sleep 1
          done

          # #530: apt remove → prerm unconfigure-os removes the drop-in BEFORE the binary is gone.
          sudo apt-get remove -y dig-dns
          if [ "$WIRED" = 1 ] && [ -e "$DROPIN" ]; then
            echo "::error::drop-in left behind after remove (prerm unconfigure-os failed) (#530)"; exit 1
          fi
          echo ".deb hook smoke PASSED: enabled+started (#525), configure-os wired + reversed (#530)."