name: Check Rust

on:
  push:
    paths-ignore:
      - "doc/**"
      - "etc/schema.json"
  pull_request:
    paths-ignore:
      - "doc/**"
      - "etc/schema.json"

permissions:
  contents: read #  to fetch code (actions/checkout)

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check-rust:
    name: Check Rust
    runs-on: ubuntu-latest
    container: almalinux:9
    steps:
      - name: Install system packages
        run: |
          dnf -y install dnf-plugins-core epel-release
          dnf config-manager --set-enabled crb
          dnf -y install \
                autoconf \
                automake \
                cbindgen \
                clang-devel \
                diffutils \
                numactl-devel \
                dpdk-devel \
                file-devel \
                gcc \
                gcc-c++ \
                git \
                jansson-devel \
                jq \
                libtool \
                libyaml-devel \
                libnfnetlink-devel \
                libnetfilter_queue-devel \
                libnet-devel \
                libcap-ng-devel \
                libevent-devel \
                libmaxminddb-devel \
                libpcap-devel \
                libtool \
                lz4-devel \
                make \
                pcre2-devel \
                pkgconfig \
                python3-devel \
                python3-sphinx \
                python3-yaml \
                sudo \
                which \
                zlib-devel
      - run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.91.0 -y
      - run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
      - run: cargo install bindgen-cli --version 0.66.0
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - run: ./scripts/bundle.sh
      - run: ./autogen.sh
      - run: ./configure --enable-warnings
      - name: Checking bindgen output
        working-directory: rust
        run: |
          bindgen --version
          make check-bindgen-bindings
          diff=$(git diff sys)
          if [ "${diff}" ]; then
              echo "${diff}"
              echo "::error ::Bindgen bindings appear to be out of date"
              exit 1
          fi
      - run: cargo clippy --all-features --fix --allow-no-vcs
        working-directory: rust
      - run: |
          diff=$(git diff)
          if [ "${diff}" ]; then
              echo "${diff}"
              echo "::error ::Clippy --fix made changes, please fix"
              exit 1
          fi
      - run: cargo clippy --all-features --all-targets
        working-directory: rust
      # especially without debug feature
      - run: cargo clippy
        working-directory: rust
      - run: cargo fmt --check
        working-directory: rust/suricatactl
      - run: cargo fmt --check
        working-directory: rust/suricatasc
      - run: cargo fmt --check
        working-directory: rust/sys
      - name: Check if Cargo.lock.in is up to date
        run: |
          cp rust/Cargo.lock rust/Cargo.lock.in
          diff=$(git diff rust/Cargo.lock.in)
          if [ "${diff}" ]; then
              echo "${diff}"
              echo "::error ::Cargo.lock.in needs to be updated"
              exit 1
          fi
      # does not work in other subdirectories for now
      - run: cargo fmt --check
        working-directory: rust/htp