mail/.github/workflows/quality.yml

name: Quality and security

on:
  push:
    branches:
      - main
  pull_request:
  schedule:
    - cron: "17 4 * * *"
  workflow_dispatch:
  workflow_call:

permissions:
  contents: read

concurrency:
  group: quality-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  # Slint's generated application is large; simultaneous lib/test rustc jobs
  # can exhaust runner memory before any tests start.
  CARGO_BUILD_JOBS: "1"

jobs:
  quality:
    if: github.event_name != 'schedule'
    name: Format, lint, and test
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
      - name: Install native build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            build-essential \
            gettext \
            gnupg \
            libdbus-1-dev \
            libfontconfig1-dev \
            libx11-dev \
            libx11-xcb-dev \
            libxcb-shape0-dev \
            libxcb-xfixes0-dev \
            libxcursor-dev \
            libxkbcommon-dev \
            libxkbcommon-x11-dev \
            pkg-config \
            ripgrep
      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: stable
          components: clippy,rustfmt
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          key: quality-default
      - name: Check formatting
        run: cargo fmt --all -- --check
      - name: Validate repository support files
        shell: bash
        run: |
          set -euo pipefail
          find scripts -type f -name '*.sh' -print0 | xargs -0 -n1 bash -n
          python3 - <<'PY'
          import ast
          import json
          import xml.etree.ElementTree as ET
          from pathlib import Path

          for path in Path("scripts").glob("*.py"):
              ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
          for path in Path(".").glob("**/*.json"):
              if "target" not in path.parts:
                  json.loads(path.read_text(encoding="utf-8"))
          for path in Path(".").glob("**/*.xml"):
              if "target" not in path.parts:
                  ET.parse(path)
          PY
      - name: Verify the Blitz patch queue
        run: bash scripts/blitz-patches.sh verify
      - name: Test release validation and publication
        run: |
          python3 scripts/test-release.py
          python3 scripts/test-pdf-packaging.py
      - name: Reject unused direct dependencies
        run: |
          cargo install cargo-machete --locked --version 0.9.2
          cargo machete --with-metadata
      - name: Check every default target
        run: cargo check --workspace --all-targets --locked
      - name: Check the capability-minimal application
        run: cargo check -p flectar-mail --no-default-features --locked
      - name: Check the Flatpak application profile
        run: cargo check -p flectar-mail --no-default-features --features remote-content,gpu-renderer,flatpak --locked
      - name: Check the CPU-only renderer build
        run: cargo check -p flectar-mail --no-default-features --features remote-content --locked
      - name: Lint without warnings
        run: cargo clippy --workspace --all-targets --locked -- -D warnings
      - name: Validate the Spanish catalog
        shell: bash
        run: |
          cargo install slint-tr-extractor --version 1.17.1 --locked
          bash scripts/check-translations.sh
          msgfmt --check --check-header --check-format \
            -o /tmp/flectar-mail-es.mo \
            lang/es/LC_MESSAGES/flectar-mail.po
          test -z "$(msgattrib --untranslated --no-obsolete lang/es/LC_MESSAGES/flectar-mail.po)"
          test -z "$(msgattrib --only-fuzzy --no-obsolete lang/es/LC_MESSAGES/flectar-mail.po)"
          test -z "$(msgattrib --only-obsolete lang/es/LC_MESSAGES/flectar-mail.po)"
      - name: Run the default test suite
        run: cargo test --workspace --all-targets --locked
      - name: Exercise the mobile PDF renderer with bundled PDFium on the host
        run: |
          python3 scripts/stage-pdfium.py linux-x64 target/pdfium-mobile-test
          python3 scripts/test-pdf-preview.py --fixture "$RUNNER_TEMP/mobile-preview.pdf"
          FLECTAR_TEST_PDFIUM="$PWD/target/pdfium-mobile-test/libpdfium.so" \
          FLECTAR_TEST_PDF="$RUNNER_TEMP/mobile-preview.pdf" \
            cargo test -p flectar-mail --lib --locked mobile_native_pages_and_rejection -- --ignored

  optional-embeddings:
    if: github.event_name != 'schedule'
    name: Optional embedding runtime
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
      - name: Install native core dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential libdbus-1-dev pkg-config gnupg
      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: stable
          components: clippy
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          key: quality-embeddings
      - name: Lint the opt-in model runtime
        run: cargo clippy -p flectar-mail-core --all-targets --locked --features local-embeddings -- -D warnings
      - name: Test the opt-in model runtime
        run: cargo test -p flectar-mail-core --lib --locked --features local-embeddings

  rustsec:
    name: RustSec advisory scan
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          cache-targets: false
          key: quality-rustsec
      - name: Install pinned cargo-audit
        run: cargo install cargo-audit --locked --version 0.22.2
      - name: Audit the locked dependency graph
        # These four advisories are unmaintained notices in optional/build or
        # Slint/Blitz typography dependencies. Deny every new warning while the
        # upstream replacements are tracked explicitly here.
        run: |
          for lockfile in Cargo.lock platform/android/Cargo.lock; do
            cargo audit --file "$lockfile" --deny warnings \
              --ignore RUSTSEC-2025-0141 \
              --ignore RUSTSEC-2024-0436 \
              --ignore RUSTSEC-2026-0206 \
              --ignore RUSTSEC-2026-0192
          done