name: wai-key-proxy

# The signing proxy and key server of extensions/key-release.md (wai/wai-key-proxy): its
# tests, which run the proxy, the key server and a fixture licence server on loopback, clippy
# with warnings as errors, and the release binary run end to end by smoke.sh.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
    paths:
      - 'wai/wai-key-proxy/**'
      - 'wai/wai-rs/src/key_release.rs'
      - 'wai/wai-rs/src/key_release/**'
      - 'wai/wai-rs/src/wai_video_keys.rs'
      - 'wai/wai-rs/Cargo.toml'
      - 'wai/live-conformance/keys/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-key-proxy.yml'
  pull_request:
    paths:
      - 'wai/wai-key-proxy/**'
      - 'wai/wai-rs/src/key_release.rs'
      - 'wai/wai-rs/src/key_release/**'
      - 'wai/wai-rs/src/wai_video_keys.rs'
      - 'wai/wai-rs/Cargo.toml'
      - 'wai/live-conformance/keys/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-key-proxy.yml'

jobs:
  relevant:
    name: does this change touch it
    runs-on: linux-arm64
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-key-proxy.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches wai-key-proxy: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  proxy-linux:
    name: proxy · linux
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.98.0
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal --component clippy
          rustup default 1.98.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Tests and clippy
        shell: bash
        working-directory: wai/wai-key-proxy
        run: |
          set -euo pipefail
          cargo test --locked 2>&1 | tee "$RUNNER_TEMP/test.log"
          grep -qE '^test result: ok\. 2 passed; 0 failed' "$RUNNER_TEMP/test.log" || { echo "::error::the end-to-end tests did not run"; exit 1; }
          cargo clippy --locked --all-targets -- -D warnings
      # smoke.sh runs a fixture licence server and picks free ports with Python.
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: The release binary end to end
        shell: bash
        working-directory: wai/wai-key-proxy
        run: |
          set -euo pipefail
          cargo build --locked --release
          bash smoke.sh