testing.yaml

name: Testing

# skill-link: update-github-workflow-actions
# adr: docs/adrs/20260612000000_adopt_sccache_for_ci_bare_builds.md
# This workflow includes sccache for bare CI builds outside Docker containers, replacing Swatinem/rust-cache.
# See ADR for evidence and rationale.

# Path policy: skip this workflow when every changed file is documentation.
# See .github/workflows/docs-lint.yaml for the lightweight docs-only workflow.
on:
  push:
    paths-ignore:
      - "**/*.md"
      - "project-words.txt"
  pull_request:
    paths-ignore:
      - "**/*.md"
      - "project-words.txt"

# issue: #2402
concurrency:
  group: >-
    ${{ github.workflow }}-${{ github.event_name == 'pull_request' &&
    format('pr-{0}', github.event.pull_request.number) || format('run-{0}', github.run_id) }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always

jobs:
  unit:
    name: Unit (${{ matrix.toolchain }})
    runs-on: ubuntu-latest
    timeout-minutes: ${{ matrix.timeout_minutes }}

    strategy:
      matrix:
        include:
          - toolchain: nightly
            components: rustfmt, clippy, llvm-tools-preview
            timeout_minutes: 45
            run_format: true
            run_library_docs: true
          - toolchain: stable
            components: clippy, llvm-tools-preview
            timeout_minutes: 90
            run_format: false
            run_library_docs: false

    steps:
      - id: checkout
        name: Checkout Repository
        uses: actions/checkout@v7.0.1

      - id: setup
        name: Setup Toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.toolchain }}
          components: ${{ matrix.components }}

      - id: node
        name: Setup Node.js
        uses: actions/setup-node@v7.1.0
        with:
          node-version: "20"

      - id: sccache
        name: Install sccache (GHA backend)
        uses: mozilla-actions/sccache-action@v0.0.11

      - id: enable-sccache
        name: Enable sccache
        run: |
          echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
          echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
          echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"

      - id: fetch
        name: Download Dependencies
        run: cargo fetch --verbose

      - id: linter
        name: Install Internal Linter
        run: cargo install --locked torrust-linting@0.2.0 --bin linter

      - id: tools
        name: Install Tools
        uses: taiki-e/install-action@v2.87.32
        with:
          tool: cargo-llvm-cov, cargo-nextest

      - id: format
        name: Run Formatting-Checks
        if: ${{ matrix.run_format }}
        run: cargo fmt --check

      - id: lint
        name: Run All Linters
        run: linter all

      - id: test-docs
        name: Run Documentation Tests
        run: cargo test --doc --workspace

      # `cargo test --doc` does not resolve intra-doc links; this catches broken library links.
      - id: library-docs
        name: Build Library Documentation
        if: ${{ matrix.run_library_docs }}
        run: cargo doc --no-deps --lib --workspace --all-features

      - id: test
        name: Run Unit Tests
        run: cargo test --tests --benches --examples --workspace --all-targets --all-features

  documented-clippy-allows:
    name: Documented Clippy Allows
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      BASE_REF: ${{ github.base_ref || 'develop' }}

    steps:
      - id: checkout
        name: Checkout Repository
        uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0

      - id: setup
        name: Setup Toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - id: fetch-base
        name: Fetch Base Branch
        run: git fetch origin "$BASE_REF"

      - id: check
        name: Check Documented Clippy Allows
        run: cargo run --quiet --package clippy-allow-reasons -- --base-ref "origin/$BASE_REF"

  layer-bans:
    name: Layer Boundary Bans
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - id: checkout
        name: Checkout Repository
        uses: actions/checkout@v7.0.1

      - id: setup
        name: Setup Toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - id: deny
        name: Install cargo-deny (v0.19.9)
        run: cargo install --locked cargo-deny@0.19.9

      - id: deny-check
        name: Check layer boundary bans
        run: cargo deny check bans

  # issue: #2582
  # Packages every workspace member so a crate that cannot be published (for example a versioned
  # dependency that crates.io cannot resolve) fails here instead of at publish time. `--no-verify`
  # skips building the packaged crates, so the job compiles nothing.
  workspace-packaging:
    name: Workspace Packaging
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - id: checkout
        name: Checkout Repository
        uses: actions/checkout@v7.0.1

      - id: setup
        name: Setup Toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - id: package
        name: Package Workspace Crates
        run: cargo package --workspace --no-verify

  docker-e2e:
    # Skip this job when container.yaml is also running for the same event — it builds
    # the same image and runs the same E2E tests. container.yaml triggers on pushes to
    # develop/main/releases and on PRs targeting develop/main.
    # For feature branch pushes and PRs targeting other branches, container.yaml does not
    # run, so this job provides the only E2E coverage. See issue #1854.
    # The package flag is required because the E2E runner binaries are not in the root package.
    #
    # Runner: the self-hosted Hetzner runner in this repository, except for Dependabot PRs and
    # pushes to Dependabot branches, which live in this repository and run without approval.
    # See ADR 20260926142648_adopt_self_hosted_hetzner_runner_for_container_tests.md.
    name: Docker E2E
    runs-on: >-
      ${{
        github.repository == 'torrust/torrust-tracker' &&
        ((github.event_name == 'pull_request' &&
        github.event.pull_request.user.login != 'dependabot[bot]' &&
        !startsWith(github.head_ref, 'dependabot/')) ||
        (github.event_name == 'push' &&
        !startsWith(github.ref, 'refs/heads/dependabot/'))) &&
        fromJSON('["self-hosted", "torrust-hetzner"]') || 'ubuntu-latest'
      }}
    timeout-minutes: 90
    if: >-
      !(github.event_name == 'pull_request' &&
      (github.base_ref == 'develop' || github.base_ref == 'main')) &&
      !(github.event_name == 'push' &&
      (github.ref == 'refs/heads/develop' ||
      github.ref == 'refs/heads/main' ||
      startsWith(github.ref, 'refs/heads/releases/')))

    steps:
      - id: checkout
        name: Checkout Repository
        uses: actions/checkout@v7.0.1

      - id: setup
        name: Setup Toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - id: sccache
        name: Install sccache (GHA backend)
        if: runner.environment == 'github-hosted'
        uses: mozilla-actions/sccache-action@v0.0.11

      - id: enable-sccache
        name: Enable sccache
        if: runner.environment == 'github-hosted'
        run: |
          echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
          echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
          echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"

      # `actions/checkout` cleans the workspace, so keep host-side Cargo builds outside it.
      - id: persistent-target
        name: Use Persistent Cargo Target Directory
        if: runner.environment == 'self-hosted'
        run: echo "CARGO_TARGET_DIR=$HOME/.cache/torrust-tracker/docker-e2e-target" >> "$GITHUB_ENV"

      - id: fetch
        name: Download Dependencies
        run: cargo fetch --verbose

      - id: setup-buildx
        name: Setup Buildx
        uses: docker/setup-buildx-action@v4.4.1
        with:
          driver: ${{ runner.environment == 'self-hosted' && 'docker' || 'docker-container' }}

      - id: build-tracker-image
        name: Build Tracker Image
        uses: docker/build-push-action@v7.4.0
        with:
          file: ./Containerfile
          push: false
          load: true
          target: release
          tags: torrust-tracker:e2e-local
          cache-from: ${{ runner.environment == 'github-hosted' && 'type=gha,scope=testing-docker-e2e' || '' }}
          cache-to: ${{ runner.environment == 'github-hosted' && 'type=gha,scope=testing-docker-e2e,mode=max' || '' }}

      - id: run-tracker-e2e-tests
        name: Run E2E Tests
        run: >-
          cargo run -p torrust-tracker-e2e-tools --bin e2e_tests_runner
          -- --config-toml-path "./share/default/config/tracker.e2e.container.sqlite3.toml"
          --tracker-image "torrust-tracker:e2e-local" --skip-build

      - id: run-qbittorrent-e2e-test-sqlite3
        name: Run qBittorrent E2E Test (SQLite)
        run: cargo run -p torrust-tracker-e2e-tools --bin qbittorrent_e2e_runner -- --tracker-image "torrust-tracker:e2e-local" --skip-build --db-driver sqlite3 --timeout-seconds 600

      - id: run-qbittorrent-e2e-test-mysql
        name: Run qBittorrent E2E Test (MySQL)
        run: cargo run -p torrust-tracker-e2e-tools --bin qbittorrent_e2e_runner -- --tracker-image "torrust-tracker:e2e-local" --skip-build --db-driver mysql --timeout-seconds 600

      - id: run-qbittorrent-e2e-test-postgresql
        name: Run qBittorrent E2E Test (PostgreSQL)
        run: cargo run -p torrust-tracker-e2e-tools --bin qbittorrent_e2e_runner -- --tracker-image "torrust-tracker:e2e-local" --skip-build --db-driver postgresql --timeout-seconds 600