ci.yaml

name: CI

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  baseline:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v7
      - name: Validate initial Cargo publication guards
        run: node --test scripts/initial-publish-context.test.mjs scripts/cargo-publish-context.test.mjs
      - name: Validate continuous distribution smoke guards
        run: |
          node --test scripts/distribution-smoke-context.test.mjs scripts/distribution-smoke-workflow.test.mjs scripts/publication-completion.test.mjs
          python3 -m unittest scripts/test_smoke_installed_cli.py

      - name: Read supported specification revision
        id: specification
        shell: bash
        run: |
          grep -Eq '^[0-9a-f]{40}$' tests/specification-revision
          revision=$(tr -d '\n' < tests/specification-revision)
          printf 'revision=%s\n' "$revision" >> "$GITHUB_OUTPUT"
      - name: Check out canonical specification
        uses: actions/checkout@v7
        with:
          repository: stack-sh/specification
          ref: ${{ steps.specification.outputs.revision }}
          path: .stack-specification
      - name: Check whitespace
        run: git diff --check "$(git hash-object -t tree /dev/null)" HEAD
      - name: Validate provider catalogs
        run: node scripts/validate-provider-catalogs.mjs
      - name: Verify generated agent skill against its canonical source
        run: |
          node --test scripts/sync-agent-skill.test.mjs
          npm run skills:check
      - name: Install JSON Schema validation dependencies
        run: npm ci --ignore-scripts --no-audit
      - name: Validate machine-readable output schema
        run: |
          node --check examples/consume-cli-json.mjs
          node --check scripts/cli-output-schema.test.mjs
          node --check scripts/validate-cli-output-schema.mjs
          npm run test:cli-output-schema
      - name: Validate distribution contract
        run: |
          node scripts/validate-distribution-contract.mjs
          node --test scripts/distribution-contract.test.mjs scripts/aqua-registry.test.mjs
      - name: Install Aqua for registry validation
        uses: aquaproj/aqua-installer@96a9bc20066c5bf5e275b41019cfc165b25f4e2e # v4.0.5
        with:
          aqua_version: v2.62.3
          enable_aqua_install: false
      - name: Validate Aqua release mappings
        env:
          AQUA_CONFIG: ${{ github.workspace }}/tests/aqua/aqua.yaml
          AQUA_POLICY_CONFIG: ${{ github.workspace }}/tests/aqua/aqua-policy.yaml
        run: |
          aqua update
          aqua update-checksum
          git diff --exit-code -- tests/aqua/aqua-checksums.json tests/aqua/aqua.yaml
          for environment in darwin/amd64 darwin/arm64 linux/amd64 linux/arm64; do
            root="$RUNNER_TEMP/aqua-${environment//\//-}"
            AQUA_ROOT_DIR="$root" AQUA_GOOS="${environment%/*}" AQUA_GOARCH="${environment#*/}" aqua install --test
          done
          native_root="$RUNNER_TEMP/aqua-native"
          smoke_directory="$RUNNER_TEMP/aqua-smoke"
          mkdir -p "$smoke_directory"
          AQUA_ROOT_DIR="$native_root" aqua install
          expected_version=$(node -e 'process.stdout.write(JSON.parse(require("fs").readFileSync("distribution/distribution-contract.json", "utf8")).product.currentReleaseVersion)')
          test "$("$native_root/bin/stack" --version)" = "stack $expected_version"
          "$native_root/bin/stack" init -o "$smoke_directory/diagram.stack"
          "$native_root/bin/stack" check "$smoke_directory/diagram.stack"
          "$native_root/bin/stack" render "$smoke_directory/diagram.stack" -o "$smoke_directory/diagram.svg"
          test -s "$smoke_directory/diagram.svg"
          release_target=x86_64-unknown-linux-gnu
          archive_name="stack-v${expected_version}-${release_target}.tar.gz"
          archive_id="github_release/github.com/stack-sh/cli/v${expected_version}/${archive_name}"
          release_archive="$RUNNER_TEMP/$archive_name"
          release_root="$RUNNER_TEMP/aqua-release"
          expected_archive_checksum=$(ARCHIVE_ID="$archive_id" node -e 'const lock = JSON.parse(require("fs").readFileSync("tests/aqua/aqua-checksums.json", "utf8")); const entry = lock.checksums.find(({ id }) => id === process.env.ARCHIVE_ID); if (!entry || entry.algorithm !== "sha256") process.exit(1); process.stdout.write(entry.checksum)')
          curl --proto '=https' --tlsv1.2 --fail --location --silent --show-error --output "$release_archive" "https://github.com/stack-sh/cli/releases/download/v${expected_version}/${archive_name}"
          test "$(sha256sum "$release_archive" | cut -d ' ' -f 1 | tr '[:lower:]' '[:upper:]')" = "$expected_archive_checksum"
          mkdir -p "$release_root"
          tar -xzf "$release_archive" -C "$release_root"
          released_share="$release_root/stack-v${expected_version}-${release_target}/share"
          "$native_root/bin/stack" completions bash | cmp "$released_share/bash-completion/completions/stack" -
          "$native_root/bin/stack" completions zsh | cmp "$released_share/zsh/site-functions/_stack" -
          "$native_root/bin/stack" completions fish | cmp "$released_share/fish/vendor_completions.d/stack.fish" -
          "$native_root/bin/stack" manpage | cmp "$released_share/man/man1/stack.1" -
      - name: Validate release supply chain
        run: |
          node --check scripts/create-supply-chain-smoke-fixture.mjs
          node --check scripts/release-security.mjs
          node --check scripts/resolve-release-context.mjs
          node --check scripts/validate-release-workflow.mjs
          node scripts/validate-supply-chain-workflow.mjs
          node scripts/validate-release-workflow.mjs
          node --test scripts/release-security.test.mjs scripts/supply-chain-workflow.test.mjs scripts/resolve-release-context.test.mjs scripts/release-workflow.test.mjs
          python3 -m unittest scripts/test_generate_cli_assets.py scripts/test_normalize_macos_binary.py scripts/test_package_release.py
      - name: Validate pinned example templates
        env:
          STACK_SPECIFICATION_DIR: ${{ github.workspace }}/.stack-specification
        run: node scripts/sync-example-templates.mjs --check
      - name: Install latest stable Rust toolchain
        run: rustup toolchain install stable --profile minimal --component clippy,rustfmt,llvm-tools-preview
      - name: Check formatting
        run: cargo +stable fmt --check
      - name: Run tests
        run: cargo +stable test --locked
      - name: Run machine-readable consumer prototype
        env:
          STACK_BINARY: target/debug/stack
        run: npm run test:consumer-prototype
      - name: Validate generated completion and manual assets
        shell: bash
        run: |
          python3 scripts/generate_cli_assets.py --binary target/debug/stack --check
          bash -n distribution/generated/share/bash-completion/completions/stack
          source distribution/generated/share/bash-completion/completions/stack
          COMP_WORDS=(stack r)
          COMP_CWORD=1
          _stack_completion
          test "${COMPREPLY[*]}" = render
          COMP_WORDS=(stack icons li)
          COMP_CWORD=2
          _stack_completion
          test "${COMPREPLY[*]}" = list
          COMP_WORDS=(stack icons list a)
          COMP_CWORD=3
          _stack_completion
          test "${COMPREPLY[*]}" = "aws azure"
          COMP_WORDS=(stack config g)
          COMP_CWORD=2
          _stack_completion
          test "${COMPREPLY[*]}" = get
          COMP_WORDS=(stack config get d)
          COMP_CWORD=3
          _stack_completion
          test "${COMPREPLY[*]}" = default_icons_path
      - name: Verify crates.io source package
        run: cargo +stable publish --dry-run -p stack-diagram-cli --locked

      - name: Run canonical formatter suite
        env:
          STACK_SPECIFICATION_DIR: ${{ github.workspace }}/.stack-specification
        run: cargo +stable test --features conformance --test formatter-conformance --locked
      - name: Run template conformance suite
        env:
          STACK_SPECIFICATION_DIR: ${{ github.workspace }}/.stack-specification
        run: cargo +stable test --features conformance --test template-conformance --locked
      - name: Run Clippy
        run: cargo +stable clippy --all-targets --all-features --locked -- -D warnings
      - name: Build documentation
        env:
          RUSTDOCFLAGS: -D warnings
        run: cargo +stable doc --no-deps --locked
      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@e67fa11c4b9316fa714ddf0abed07a0c3143b95b # v2.87.4
        with:
          tool: cargo-llvm-cov@0.9.0
          fallback: none
      - name: Enforce test coverage
        env:
          STACK_SPECIFICATION_DIR: ${{ github.workspace }}/.stack-specification
        run: cargo +stable llvm-cov --all-features --locked --fail-under-lines 90 --fail-under-functions 95 --fail-under-regions 90
      - name: Build release binary
        run: cargo +stable build --release --locked
      - name: Validate rendered SVG
        run: python3 scripts/validate-render.py
      - name: Smoke test command metadata
        run: |
          ./target/release/stack help
          ./target/release/stack help render
          ./target/release/stack help icons list
          ./target/release/stack version
          ./target/release/stack -h
          ./target/release/stack -v
          ./target/release/stack -V
          ./target/release/stack --help
          ./target/release/stack --version
          ./target/release/stack init --help
          ./target/release/stack check --help
          ./target/release/stack fmt --help
          ./target/release/stack render --help
          ./target/release/stack lsp --help
          ./target/release/stack doctor --help
          ./target/release/stack config --help
          ./target/release/stack config path --help
          ./target/release/stack config get --help
          ./target/release/stack icons --help
          ./target/release/stack completions --help
          ./target/release/stack completions bash | cmp distribution/generated/share/bash-completion/completions/stack -
          ./target/release/stack completions zsh | cmp distribution/generated/share/zsh/site-functions/_stack -
          ./target/release/stack completions fish | cmp distribution/generated/share/fish/vendor_completions.d/stack.fish -
          ./target/release/stack manpage | cmp distribution/generated/share/man/man1/stack.1 -
          ./target/release/stack icons list
          ./target/release/stack icons list aws s3
          ./target/release/stack icons import --help
          config_smoke_root="$RUNNER_TEMP/stack-config-smoke"
          test "$(XDG_CONFIG_HOME="$config_smoke_root" ./target/release/stack config path)" = "$config_smoke_root/stack/config.yaml"
          test "$(XDG_CONFIG_HOME="$config_smoke_root" ./target/release/stack config get default_icons_path)" = "$config_smoke_root/stack/icons"
          XDG_CONFIG_HOME="$config_smoke_root" ./target/release/stack doctor
          test ! -e "$config_smoke_root"
      - name: Verify repository files
        run: |
          test -s README.md
          test -s AGENTS.md
          test -s LICENSE
          test -s NOTICE
          test -s THIRD_PARTY_LICENSES.md
          test -s CONTRIBUTING.md
          test -s SECURITY.md
          test -s docs/language-server.md
          test -s docs/machine-readable-output.md
          test -s docs/configuration.md
          test -s docs/completions.md
          test -s docs/self-update.md
          test -s docs/publication-audit.md
          test -s docs/provider-icon-import.md
          test -s docs/distribution.md
          test -s docs/supply-chain.md
          test -s aqua/README.md
          test -s aqua/registry.yaml
          test -s distribution/distribution-contract.json
          test -s distribution/distribution-contract.schema.json
          test -s distribution/distribution-contract-v2.schema.json
          test -s distribution/install-receipt.schema.json
          test -s distribution/release-manifest.schema.json
          test -s schemas/cli-output-v1.schema.json
          test -s distribution/generated/share/bash-completion/completions/stack
          test -s distribution/generated/share/zsh/site-functions/_stack
          test -s distribution/generated/share/fish/vendor_completions.d/stack.fish
          test -s distribution/generated/share/man/man1/stack.1
          test -s Cargo.toml
          test -s Cargo.lock
          test -s package.json
          test -s package-lock.json
          test -s src/config.rs
          test -s src/command_docs.rs
          test -s src/lsp.rs
          test -s src/machine_output.rs
          test -s src/main.rs
          test -s src/templates.rs
          test -s src/provider.rs
          test -s src/provider_catalog.rs
          test -s catalogs/aws.json
          test -s catalogs/gcp.json
          test -s catalogs/azure.json
          test -s catalogs/simple-icons.json
          test -s scripts/generate-provider-catalogs.mjs
          test -s scripts/cli-output-schema.test.mjs
          test -s scripts/validate-cli-output-schema.mjs
          test -s scripts/aqua-registry.test.mjs
          test -s scripts/sync-example-templates.mjs
          test -s scripts/validate-provider-catalogs.mjs
          test -s scripts/validate-distribution-contract.mjs
          test -s scripts/distribution-contract.test.mjs
          test -s scripts/create-supply-chain-smoke-fixture.mjs
          test -s scripts/release-security.mjs
          test -s scripts/release-security.test.mjs
          test -s scripts/package_release.py
          test -s scripts/generate_cli_assets.py
          test -s scripts/test_generate_cli_assets.py
          test -s scripts/normalize_macos_binary.py
          test -s scripts/test_normalize_macos_binary.py
          test -s scripts/test_package_release.py
          test -s scripts/verify_release_binary.py
          test -s scripts/resolve-release-context.mjs
          test -s scripts/resolve-release-context.test.mjs
          test -s scripts/validate-release-workflow.mjs
          test -s scripts/release-workflow.test.mjs
          test -s scripts/validate-supply-chain-workflow.mjs
          test -s scripts/supply-chain-workflow.test.mjs
          test -s tests/aqua/aqua.yaml
          test -s tests/aqua/aqua-checksums.json
          test -s tests/aqua/aqua-policy.yaml
          test -s .github/workflows/release.yaml
          test -s .github/workflows/supply-chain.yaml
          test -s templates/catalog.json
          test -s templates/sources/01-minimal.stack
          test -s tests/specification-revision
          test -s tests/fixtures/render.stack
          test -s tests/fixtures/invalid.stack
          test -s tests/fixtures/warning.stack
          test -s tests/fixtures/cli-output/check-success.json
          test -s tests/fixtures/cli-output/check-warning.json
          test -s tests/fixtures/cli-output/check-stack-error.json
          test -s tests/fixtures/cli-output/fmt-changes-required.json
          test -s tests/fixtures/cli-output/fmt-stdin-success.json
          test -s tests/fixtures/cli-output/render-file-success.json
          test -s tests/fixtures/cli-output/operational-error.json
          test -s examples/consume-cli-json.mjs
          test -s tests/snapshots/lsp-help.txt
          test -s tests/snapshots/doctor-help.txt
          test -s tests/snapshots/doctor-report.txt
          test -s tests/snapshots/config-help.txt
          test -s tests/snapshots/config-path-help.txt
          test -s tests/snapshots/config-get-help.txt

  msrv:
    name: Minimum supported Rust
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v7
      - name: Install Rust 1.85
        run: rustup toolchain install 1.85.0 --profile minimal --component clippy
      - name: Run tests
        run: cargo +1.85.0 test --locked
      - name: Run Clippy
        run: cargo +1.85.0 clippy --all-targets --all-features --locked -- -D warnings