name: joule-moq-room room service

# The room service (joule-code/joule-code-rs/crates/joule-moq-room), a workspace of its own
# with its own lock file: its keys file, the grants it signs checked against its
# descriptor and read by the relay's reader, the places and the limiter, and
# tests/room_service.rs, the service against a relay on loopback that trusts its authority:
# a grant and its proof open a session and the clock announces the publisher, the grant
# alone opens none, the room verifies (live-rooms §9), a publisher past the room's places
# is refused, clients are bounded, and a new room starts when the last publisher has left;
# an end-to-end encrypted room (WAI confidentiality), members keying through the
# service's log on a relay; and admission by age (WAI age-assurance §5.6), the service a
# Privacy Pass origin whose tokens' thresholds its grants state and the relay serves by.
#
# It builds on wai-rs's room, event and composition records, on the relay and on
# joule-moq-mls, so a change to any of them runs it. Push filters match the push's delta, so every path the job reads is
# listed.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - 'joule-code/joule-code-rs/crates/joule-moq-room/**'
      - 'joule-code/joule-code-rs/crates/joule-moq/**'
      - 'joule-code/joule-code-rs/crates/joule-moq-mls/**'
      - 'joule-code/joule-code-rs/crates/joule-moq-relay/**'
      - 'joule-code/joule-code-rs/crates/jwp/**'
      - 'joule-code/joule-code-rs/vendor/**'
      - 'wai/wai-rs/**'
      - 'wai/wai-ops/**'
      - '.github/workflows/joule-moq-room.yml'

jobs:
  # Forgejo matches `paths:` against the push delta, so a rebase fires this workflow
  # whatever the pull request changes. This job reads the pull request's own diff against
  # the paths above (scripts/pr-touches-paths.py, which fails open).
  relevant:
    name: joule-moq-room · does this change touch it
    runs-on: linux
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/joule-moq-room.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches the room service: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  test:
    name: joule-moq-room, every target
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux-arm64
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust 1.98.0
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal
          rustup default 1.98.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: joule-moq-room, every target
        working-directory: joule-code/joule-code-rs/crates/joule-moq-room
        shell: bash
        run: cargo test --locked --all-targets