sdk-rust.yml

# Invoked by sdk.yml to run Rust SDK formatting, linting, documentation,
# full subprocess coverage, and focused in-process smoke coverage across
# standard platforms and x64 musl.
name: "SDK Rust"

env:
  HUSKY: 0
  POWERSHELL_UPDATECHECK: Off
  SDK_HOME: ${{ inputs.sdk-home }}
  SETUP_NODE_TIMEOUT_MINUTES: 10

on:
  workflow_call:
    inputs:
      platform:
        required: false
        type: string
        default: all
      sdk-home:
        required: true
        type: string

permissions:
  contents: read

jobs:
  rust:
    name: "Rust (${{ matrix.os }})"
    if: contains(fromJSON('["all","linux-x64","darwin-arm64","win32-x64"]'), inputs.platform)
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        os: ${{ fromJSON(inputs.platform == 'linux-x64' && '["ubuntu-latest"]' || inputs.platform == 'darwin-arm64' && '["macos-latest"]' || inputs.platform == 'win32-x64' && '["windows-latest"]' || '["ubuntu-latest","macos-latest","windows-latest"]') }}
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash
        working-directory: ${{ inputs.sdk-home }}/rust
    env:
      CARGO_TERM_COLOR: always
      RUST_BACKTRACE: 1
    steps:
      - uses: actions/checkout@v7
        timeout-minutes: 4
        with:
          persist-credentials: false
      - uses: ./.github/actions/download-sdk-runtime
        with:
          artifact-name: ${{ runner.os == 'Linux' && format('executable-sdk-{0}-{1}-gnu', runner.os, runner.arch) || format('executable-sdk-{0}-{1}', runner.os, runner.arch) }}
          path: ${{ github.workspace }}
      - run: node "$SDK_HOME/scripts/ci/runtime-artifact.mjs" restore && node "$SDK_HOME/scripts/ci/runtime-artifact.mjs" prepare
        working-directory: .
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.94.0"
          components: rustfmt, clippy
      # TEMPORARY MERGE QUEUE REDUCTION: pull requests and main pushes retain
      # static checks; merge groups rerun only SDK compatibility coverage.
      - if: github.event_name != 'merge_group' && runner.os == 'Linux'
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly-2026-04-14
          components: rustfmt
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: ${{ inputs.sdk-home }}/rust
          prefix-key: v2-sdk-rust-no-bin
          cache-bin: false
      - if: github.event_name != 'merge_group' && runner.os == 'Linux'
        run: cargo +nightly-2026-04-14 fmt --all -- --config-path .rustfmt.nightly.toml --check
      - name: Verify release snapshot generation
        run: node --test scripts/snapshot-version.test.mjs
      - if: github.event_name != 'merge_group' && runner.os == 'Linux'
        run: cargo clippy --all-targets --no-default-features --features test-support,local-runtime,derive -- --no-deps -D warnings -D clippy::unwrap_used -D clippy::disallowed_macros -D clippy::await_holding_invalid_type
      # Path-dependency consumers must not rerun build.rs on unchanged rebuilds.
      - if: github.event_name != 'merge_group' && runner.os == 'Linux'
        run: bash scripts/check-fresh-rebuild.sh --no-default-features --features test-support,derive
      - if: github.event_name != 'merge_group' && runner.os == 'Linux'
        env:
          RUSTDOCFLAGS: "-D warnings"
        run: cargo doc --no-deps --no-default-features --features local-runtime,derive
      - name: External-stream-only SDK
        run: cargo test --no-default-features --features test-support --test protocol_version_test
      - run: npm ci --ignore-scripts
        working-directory: ${{ inputs.sdk-home }}/test/harness
      - if: runner.os == 'Windows'
        run: pwsh.exe -Command "Write-Host 'PowerShell ready'"
      - name: Test out-of-process
        id: subprocess
        env:
          COPILOT_HMAC_KEY: ${{ secrets.COPILOT_DEVELOPER_CLI_INTEGRATION_HMAC_KEY }}
          RUST_E2E_CONCURRENCY: 4
        run: cargo test --no-default-features --features runtime,test-support,derive -- --test-threads=4 --nocapture
      - name: Report Linux Rust build resources
        if: failure() && runner.os == 'Linux'
        run: |
          echo "::group::Rust SDK build resources"
          df -h . "$RUNNER_TEMP"
          df -i . "$RUNNER_TEMP"
          free -h
          if [ -d target ]; then
            du -sh target
          fi
          echo "::endgroup::"

      - name: Test in-process smoke
        id: inprocess
        if: ${{ !cancelled() && runner.os != 'Windows' && (steps.subprocess.outcome == 'success' || steps.subprocess.outcome == 'failure') }}
        env:
          COPILOT_HMAC_KEY: ${{ secrets.COPILOT_DEVELOPER_CLI_INTEGRATION_HMAC_KEY }}
          COPILOT_SDK_DEFAULT_CONNECTION: inprocess
        run: >-
          cargo test --no-default-features --features test-support,local-runtime,derive
          --test e2e inprocess::should_start_ping_and_stop_inprocess_client
          -- --exact --test-threads=1 --nocapture
      - name: Test in-process authentication host
        if: ${{ !cancelled() && (steps.inprocess.outcome == 'success' || steps.inprocess.outcome == 'failure') }}
        env:
          COPILOT_HMAC_KEY: ${{ secrets.COPILOT_DEVELOPER_CLI_INTEGRATION_HMAC_KEY }}
          COPILOT_SDK_DEFAULT_CONNECTION: inprocess
        run: >-
          cargo test --no-default-features --features test-support,local-runtime,derive
          --test e2e client::should_use_configured_github_host_for_authentication
          -- --exact --test-threads=1 --nocapture

  rust-musl-x64:
    name: "Rust (Alpine x64)"
    if: inputs.platform == 'all' || inputs.platform == 'linuxmusl-x64'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v7
        timeout-minutes: 4
        with:
          persist-credentials: false
      - uses: ./.github/actions/download-sdk-runtime
        with:
          artifact-name: executable-sdk-Linux-X64-musl
          path: ${{ github.workspace }}
      - run: node "$SDK_HOME/scripts/ci/runtime-artifact.mjs" restore
        working-directory: .
      - uses: ./.github/actions/run-alpine-tests
        env:
          COPILOT_HMAC_KEY: ${{ secrets.COPILOT_DEVELOPER_CLI_INTEGRATION_HMAC_KEY }}
          CARGO_TERM_COLOR: always
          RUST_BACKTRACE: 1
          RUSTFLAGS: "-C target-feature=-crt-static"
          RUSTDOCFLAGS: "-C target-feature=-crt-static"
        with:
          image: rust:1.94.0-alpine
          sdk-root: /workspace/${{ inputs.sdk-home }}
          workdir: /workspace/${{ inputs.sdk-home }}/rust
          command: |
            rustc --print cfg | grep -Fqx "target_arch=\"x86_64\""
            rustc --print cfg | grep -Fqx "target_env=\"musl\""
            apk add --no-cache build-base pkgconf openssl-dev nodejs npm
            npm --prefix "$COPILOT_SDK_ROOT/nodejs" ci --ignore-scripts
            npm --prefix "$COPILOT_SDK_ROOT/test/harness" ci --ignore-scripts

            export GITHUB_ENV=/tmp/copilot-sdk-runtime.env
            export COPILOT_RUNTIME_TARGET=linuxmusl-x64
            export COPILOT_RUNTIME_OUTPUT_DIRECTORY=/workspace/.sdk-runtime/linuxmusl-x64
            node "$COPILOT_SDK_ROOT/scripts/ci/runtime-artifact.mjs" prepare
            set -a
            . "$GITHUB_ENV"
            set +a
            case "$COPILOT_CLI_PATH" in
              */prebuilds/linuxmusl-x64/copilot-runtime) ;;
              *) echo "Expected the linuxmusl-x64 runtime, got: $COPILOT_CLI_PATH" >&2; exit 1 ;;
            esac

            export CARGO_TARGET_DIR=/tmp/copilot-sdk-rust-target
            # Keep every integration test without filling the runner with build artifacts.
            export CARGO_INCREMENTAL=0
            export CARGO_PROFILE_TEST_DEBUG=0
            cd "$COPILOT_SDK_ROOT/rust"
            status=0
            RUST_E2E_CONCURRENCY=4 cargo test --no-default-features --features runtime,test-support,derive -- --test-threads=4 --nocapture || status=$?
            export COPILOT_SDK_DEFAULT_CONNECTION=inprocess
            cargo test --no-default-features --features test-support,local-runtime,derive \
              --test e2e inprocess::should_start_ping_and_stop_inprocess_client \
              -- --exact --test-threads=1 --nocapture || status=$?
            cargo test --no-default-features --features test-support,local-runtime,derive \
              --test e2e client::should_use_configured_github_host_for_authentication \
              -- --exact --test-threads=1 --nocapture || status=$?
            exit "$status"