rust.yml

name: CI

on:
  push:
    branches: ['main']
  pull_request:
  schedule:
    - cron: "32 4 * * 5"

# let jobs opt-in to permissions explicitly
permissions: {}

jobs:
####################################################################################################
# STEP 1: FASTEST
# ["Rustfmt", "Docs", "Audit", "Book", "Typos", "Jinja2-Assumptions", "DevSkim", "CargoSort"]
####################################################################################################

  Rustfmt:
    runs-on: ubuntu-latest
    steps:
      # No need to run the checks in parallel. They are fast enough.
      # No need for caching. No code is compiled at all.
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt
      - run: |
          set -eu
          for PKG in \
            bench-build examples/actix-web-app examples/axum-app examples/poem-app examples/rocket-app examples/warp-app examples/custom-escaper fuzzing \
            askama askama_derive askama_escape askama_macros askama_parser \
            testing testing-alloc testing-no-std testing-renamed
          do
            cd "$PKG"
            echo "Testing: $PKG"
            cargo +nightly fmt -- --check
            cd - > /dev/null
          done

  Docs:
    strategy:
      matrix:
        package: [askama, askama_derive, askama_escape, askama_macros, askama_parser]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
      - run: cd ${{ matrix.package }} && cargo doc --all-features --no-deps
        env:
          RUSTDOCFLAGS: -Z unstable-options --generate-link-to-definition --cfg=docsrs -D warnings

  Audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: EmbarkStudios/cargo-deny-action@v2

  Book:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Install mdbook
        run: cargo install mdbook
      - name: Convert the book to HTML
        run: $HOME/.cargo/bin/mdbook build
        working-directory: book

  Typos:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: crate-ci/typos@master

  Jinja2-Assumptions:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: actions/setup-python@v6
        with:
          python-version: '3.13'
      - uses: astral-sh/setup-uv@v7
      - run: testing/jinja2-assumptions/test.sh

  DevSkim:
    name: DevSkim
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Run DevSkim scanner
        uses: microsoft/DevSkim-Action@v1

      - name: Upload DevSkim scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: devskim-results.sarif

  CargoSort:
    name: Check order in Cargo.toml
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-sort
      - run: |
          cargo sort --check --check-format --grouped
          set -eu
          for PKG in \
            bench-build examples/actix-web-app examples/axum-app examples/poem-app examples/rocket-app examples/warp-app examples/custom-escaper fuzzing \
            askama askama_derive askama_escape askama_macros askama_parser \
            testing testing-alloc testing-no-std testing-renamed
          do
            cd "$PKG"
            cargo sort --check --check-format --grouped
            cd - > /dev/null
          done

####################################################################################################
# STEP 2: INTERMEDIATE
# ["Test", "Package", "Nightly", "MSRV"]
####################################################################################################

  Test:
    needs: ["Rustfmt", "Docs", "Audit", "Book", "Typos", "Jinja2-Assumptions", "DevSkim", "CargoSort"]
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        rust: [stable, beta]
        exclude:
          - os: macos-latest
            rust: beta
          - os: windows-latest
            rust: beta
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --features full
      - run: cargo test --all-targets --features full

  Package:
    needs: ["Rustfmt", "Docs", "Audit", "Book", "Typos", "Jinja2-Assumptions", "DevSkim", "CargoSort"]
    strategy:
      matrix:
        package: [
          bench-build, examples/actix-web-app, examples/axum-app, examples/poem-app, examples/rocket-app, examples/warp-app, examples/custom-escaper, fuzzing,
          askama, askama_derive, askama_escape, askama_macros, askama_parser,
          testing, testing-alloc, testing-no-std, testing-renamed,
        ]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cd ${{ matrix.package }} && cargo test
      - run: cd ${{ matrix.package }} && cargo test --all-targets
      - run: cd ${{ matrix.package }} && cargo clippy --all-targets -- -D warnings

  Nightly:
    needs: ["Rustfmt", "Docs", "Audit", "Book", "Typos", "Jinja2-Assumptions", "DevSkim", "CargoSort"]
    strategy:
      matrix:
        package: [
          askama, askama_derive, askama_escape, askama_macros, askama_parser,
          testing, testing-alloc, testing-no-std, testing-renamed,
        ]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
      - run: cd ${{ matrix.package }} && cargo test --all-features

  MSRV:
    needs: ["Rustfmt", "Docs", "Audit", "Book", "Typos", "Jinja2-Assumptions", "DevSkim", "CargoSort"]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.88.0"
      - run: cargo check --lib -p askama --features full

####################################################################################################
# STEP 2: SLOW
# ["Fuzz", "Cluster-Fuzz"]
####################################################################################################

  Fuzz:
    needs: ["Test", "Package", "Nightly", "MSRV"]
    strategy:
      matrix:
        fuzz_target:
          - all
          - derive
          - filters
          - html
          - parser
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
          submodules: recursive
      - run: git submodule update --remote
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly
          components: rust-src
      - run: cargo install cargo-fuzz
      - uses: Swatinem/rust-cache@v2
      - run: cargo fuzz run ${{ matrix.fuzz_target }} --jobs 4 -- -max_total_time=600
        working-directory: fuzzing
        env:
          RUSTFLAGS: '-Ctarget-feature=-crt-static'

  Cluster-Fuzz:
    needs: ["Test", "Package", "Nightly", "MSRV"]
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Build Fuzzers
        id: build
        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
        with:
          oss-fuzz-project-name: askama
          language: rust
      - name: Run Fuzzers
        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
        with:
          oss-fuzz-project-name: askama
          language: rust
          fuzz-seconds: 600
          output-sarif: true
      - name: Upload Crash
        uses: actions/upload-artifact@v7
        if: failure() && steps.build.outcome == 'success'
        with:
          name: artifacts
          path: ./out/artifacts
      - name: Upload Sarif
        if: always() && steps.build.outcome == 'success'
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: cifuzz-sarif/results.sarif
          checkout_path: cifuzz-sarif