ci.yml

name: CI

on:
  push:
    branches:
      - main
      - master

  pull_request:

permissions: {}

concurrency:
  group: ci-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  filter-jobs:
    name: Filter Jobs
    runs-on: ubuntu-26.04

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          # This is needed to get the commit history for the changed-files action
          # (see https://github.com/tj-actions/changed-files/blob/v46.0.5/README.md#usage-)
          fetch-depth: 0

      - uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        id: changed-files
        with:
          files_yaml_from_source_file: .github/changed-files.yml

    outputs:
      backend-lint: ${{ steps.changed-files.outputs.backend_lint_any_modified }}
      backend-deps: ${{ steps.changed-files.outputs.backend_deps_any_modified || github.event_name == 'push' }}
      backend-migrations: ${{ steps.changed-files.outputs.backend_migrations_any_modified }}
      backend-test: ${{ steps.changed-files.outputs.backend_test_any_modified }}
      frontend-lint: ${{ steps.changed-files.outputs.frontend_lint_any_modified }}
      js-packages-test: ${{ steps.changed-files.outputs.js_packages_test_any_modified }}
      e2e-test: ${{ steps.changed-files.outputs.e2e_test_any_modified }}
      svelte: ${{ steps.changed-files.outputs.svelte_any_modified }}
      zizmor: ${{ steps.changed-files.outputs.zizmor_any_modified }}

  backend-lint:
    name: Backend / Lint
    runs-on: ubuntu-26.04
    needs: filter-jobs
    if: needs.filter-jobs.outputs.backend-lint == 'true'

    env:
      RUSTFLAGS: '-D warnings'
      RUSTDOCFLAGS: '-D warnings'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - run: rustup component add rustfmt
      - run: rustup component add clippy

      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - run: cargo fmt --check --all
      - run: cargo clippy --all-targets --all-features --workspace
      - run: cargo doc --no-deps --document-private-items --workspace

  backend-deps:
    name: Backend / dependencies
    runs-on: ubuntu-26.04
    needs: filter-jobs
    if: needs.filter-jobs.outputs.backend-deps == 'true'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.9.15
          install_args: --jobs=1 cargo:cargo-deny cargo:cargo-machete

      - run: cargo deny check
      - run: cargo machete

  backend-migrations:
    name: Backend / migrations
    runs-on: ubuntu-26.04
    needs: filter-jobs
    if: needs.filter-jobs.outputs.backend-migrations == 'true'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.9.15
          install_args: cargo:diesel-guard

      - run: diesel-guard check migrations/

  backend-test:
    name: Backend / Test
    runs-on: ubuntu-26.04
    needs: filter-jobs
    if: needs.filter-jobs.outputs.backend-test == 'true'

    env:
      CARGO_PROFILE_DEV_DEBUG: line-tables-only
      RUST_BACKTRACE: 1
      TEST_DATABASE_URL: postgres://postgres:postgres@localhost/cargo_registry_test
      RUSTFLAGS: '-D warnings'
      MALLOC_CONF: 'background_thread:true,abort_conf:true,abort:true,junk:true'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Remove the Android SDK in the background to free up space
      - run: sudo rm -rf /usr/local/lib/android &

      - name: Download Fira Sans font
        run: |
          wget -q "https://github.com/mozilla/Fira/archive/4.202.zip"
          unzip -q "4.202.zip"

      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.9.15
          install_args: cargo-insta

      - run: sudo systemctl start postgresql.service
      - run: sudo -u postgres psql -c "ALTER USER postgres WITH PASSWORD 'postgres'"
      - run: sudo -u postgres createdb --lc-collate=C --lc-ctype=C -T template0 cargo_registry_test

      - run: cargo fetch --locked
      - run: cargo build --tests --workspace
      - run: cargo insta test --require-full-match --unreferenced=reject --workspace
        env:
          # Set the path to the Fira Sans font for Typst.
          TYPST_FONT_PATH: ${{ github.workspace }}/Fira-4.202/otf

  frontend-lint:
    name: Frontend / Lint
    runs-on: ubuntu-26.04
    needs: filter-jobs
    if: needs.filter-jobs.outputs.frontend-lint == 'true'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 12.6.0

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: pnpm
          node-version-file: package.json

      - run: pnpm install

      - run: pnpm lint:js
      - run: pnpm prettier:check
      - run: pnpm --recursive --if-present run typecheck

  js-packages-test:
    name: Frontend / Test (JS packages)
    runs-on: ubuntu-26.04
    needs: filter-jobs
    if: needs.filter-jobs.outputs.js-packages-test == 'true'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 12.6.0

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: pnpm
          node-version-file: package.json

      - run: pnpm install

      - run: pnpm -r --filter './packages/*' test

  e2e-test:
    name: Frontend / Test (playwright)
    runs-on: ubuntu-26.04
    needs: filter-jobs
    timeout-minutes: 60
    if: needs.filter-jobs.outputs.e2e-test == 'true'

    env:
      JOBS: 1 # See https://git.io/vdao3 for details.

      # Percy secrets are included here to enable Percy's GitHub integration
      # on community-submitted PRs
      PERCY_TOKEN: web_0a783d8086b6f996809f3e751d032dd6d156782082bcd1423b9b860113c75054
      PERCY_CLIENT_ERROR_LOGS: 'false'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 12.6.0

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: pnpm
          node-version-file: package.json

      - run: pnpm install

      - run: pnpm playwright install chromium

      # Reuse the Chromium that Playwright just installed instead of letting
      # @percy/core download its own.
      - run: echo "PERCY_BROWSER_EXECUTABLE=$(node -e "console.log(require('@playwright/test').chromium.executablePath())")" >> "$GITHUB_ENV"

      - if: github.repository == 'rust-lang/crates.io'
        run: pnpm percy exec -- pnpm e2e:svelte

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 14

  zizmor:
    name: CI / Lint
    runs-on: ubuntu-26.04
    needs: filter-jobs
    if: needs.filter-jobs.outputs.zizmor == 'true'
    permissions:
      security-events: write # needed by `codeql-action/upload-sarif` to upload zizmor results to GitHub code scanning
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.9.15
          install_args: zizmor

      - run: zizmor --format=sarif . > results.sarif
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          sarif_file: results.sarif
          category: zizmor

  svelte:
    name: Frontend / Test
    runs-on: ubuntu-26.04
    needs: filter-jobs
    if: needs.filter-jobs.outputs.svelte == 'true'

    defaults:
      run:
        working-directory: svelte

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 12.6.0

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: pnpm
          node-version-file: package.json

      - run: pnpm install

      - run: pnpm check
      - run: pnpm build
      - run: pnpm playwright install chromium-headless-shell
      - run: pnpm test

  svelte-chromatic:
    name: Svelte / Chromatic
    runs-on: ubuntu-26.04
    needs: filter-jobs
    if: needs.filter-jobs.outputs.svelte == 'true'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0

      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 12.6.0

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: pnpm
          node-version-file: package.json

      - run: pnpm install

      # Chromatic token is included here to enable visual regression testing
      # on community-submitted PRs
      - uses: chromaui/action@6b3c2820222d23bad770d57a4ad5e2d1c91f92e9 # v18.9.5
        with:
          workingDir: svelte
          projectToken: chpt_015c1709eb9b9fa
          autoAcceptChanges: main
          exitZeroOnChanges: false