ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, reopened, synchronize]
    branches: [main]

permissions:
  contents: read
  pull-requests: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  rust:
    name: Rust fmt, clippy, tests
    runs-on: ubuntu-latest
    env:
      CARGO_TERM_COLOR: always
      PYO3_USE_ABI3_FORWARD_COMPATIBILITY: 1
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Fail if junk files are tracked
        run: ./scripts/check_junk_files.sh

      - name: Detect Rust-relevant changes
        id: rust_changes
        run: |
          RUST_FILE_REGEX='(^|/)(Cargo\.toml|Cargo\.lock|rust-toolchain(\.toml)?)$|(^|/)\.cargo/|\.rs$'

          if [ "${{ github.event_name }}" = "pull_request" ]; then
            git fetch --no-tags --depth=1 origin "${{ github.base_ref }}"
            CHANGED_FILES="$(git diff --name-only "origin/${{ github.base_ref }}" HEAD)"
          elif [ "${{ github.event_name }}" = "push" ]; then
            if [ "${{ github.event.before }}" = "0000000000000000000000000000000000000000" ]; then
              echo "changed=true" >> "$GITHUB_OUTPUT"
              exit 0
            fi

            if ! git cat-file -e "${{ github.event.before }}^{commit}" 2>/dev/null; then
              git fetch --no-tags --depth=1 origin "${{ github.event.before }}" || true
            fi

            if ! git cat-file -e "${{ github.event.before }}^{commit}" 2>/dev/null; then
              echo "changed=true" >> "$GITHUB_OUTPUT"
              exit 0
            fi

            CHANGED_FILES="$(git diff --name-only "${{ github.event.before }}" "${{ github.sha }}")"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if printf '%s\n' "$CHANGED_FILES" | grep -Eq "$RUST_FILE_REGEX"; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Skip Rust build/test for non-Rust changes
        if: steps.rust_changes.outputs.changed != 'true'
        run: echo "No Rust-relevant file changes detected; skipping Rust compile/test steps."

      - name: Set up Rust
        if: steps.rust_changes.outputs.changed == 'true'
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        if: steps.rust_changes.outputs.changed == 'true'
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            ~/.cargo/bin
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install cargo-audit
        if: steps.rust_changes.outputs.changed == 'true'
        run: |
          if ! command -v cargo-audit &> /dev/null; then
            cargo install cargo-audit --locked
          fi

      - name: fmt
        if: steps.rust_changes.outputs.changed == 'true'
        run: cargo fmt --all -- --check

      - name: clippy
        if: steps.rust_changes.outputs.changed == 'true'
        run: cargo clippy --workspace --all-targets -- -D warnings

      - name: tests
        if: steps.rust_changes.outputs.changed == 'true'
        run: cargo test --workspace -- --test-threads=1

      - name: Install cargo-llvm-cov
        if: steps.rust_changes.outputs.changed == 'true'
        uses: taiki-e/install-action@cargo-llvm-cov

      - name: Run tests with coverage
        if: steps.rust_changes.outputs.changed == 'true'
        run: cargo llvm-cov --workspace --lcov --output-path lcov.info

      - name: Upload coverage to Codecov
        if: ${{ always() && steps.rust_changes.outputs.changed == 'true' }}
        uses: codecov/codecov-action@v4
        with:
          files: lcov.info
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Build documentation
        if: steps.rust_changes.outputs.changed == 'true'
        run: cargo doc --workspace --no-deps
        env:
          RUSTDOCFLAGS: -D warnings

      - name: Security audit
        if: steps.rust_changes.outputs.changed == 'true'
        run: cargo audit

  benchmarks:
    name: Rust benchmarks
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Fail if junk files are tracked
        run: ./scripts/check_junk_files.sh

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            ~/.cargo/bin
            target
          key: ${{ runner.os }}-cargo-bench-${{ hashFiles('**/Cargo.toml') }}
          restore-keys: ${{ runner.os }}-cargo-bench-

      - name: Run benchmarks on current branch
        run: |
          cd nexum_core
          cargo bench --bench storage_bench | tee current_bench.log
          cargo bench --bench sql_bench | tee -a current_bench.log
          cargo bench --bench executor_bench | tee -a current_bench.log
          cargo bench --bench filter_bench | tee -a current_bench.log

      - name: Check if benchmarks exist on main
        id: check_main
        run: |
          git fetch origin main
          if git show origin/main:nexum_core/Cargo.toml | grep -q "criterion"; then
            echo "benchmarks_exist=true" >> $GITHUB_OUTPUT
          else
            echo "benchmarks_exist=false" >> $GITHUB_OUTPUT
          fi

      - name: Run benchmarks on main branch (if they exist)
        if: steps.check_main.outputs.benchmarks_exist == 'true'
        run: |
          git stash
          git checkout origin/main
          cd nexum_core
          cargo bench --bench storage_bench | tee main_bench.log
          cargo bench --bench sql_bench | tee -a main_bench.log
          cargo bench --bench executor_bench | tee -a main_bench.log
          cargo bench --bench filter_bench | tee -a main_bench.log

      - name: Generate benchmark summary
        run: |
          echo "## 🚀 Benchmark Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Benchmarks completed successfully for nexum_core performance-critical paths." >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 📊 Benchmark Suites Executed" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ **Storage Engine**: Read/write throughput, mixed workloads" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ **SQL Parser**: CREATE, INSERT, SELECT statement parsing" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ **Query Executor**: Table scans, filtered queries, large datasets" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ **Filter Evaluation**: WHERE clause processing, expression evaluation" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          if [ "${{ steps.check_main.outputs.benchmarks_exist }}" = "true" ]; then
            echo "### 📈 Comparison" >> $GITHUB_STEP_SUMMARY
            echo "Performance comparison against main branch completed." >> $GITHUB_STEP_SUMMARY
          else
            echo "### 🆕 New Benchmarks" >> $GITHUB_STEP_SUMMARY
            echo "This is the first time benchmarks are being added to the project." >> $GITHUB_STEP_SUMMARY
          fi
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 📋 Detailed Results" >> $GITHUB_STEP_SUMMARY
          echo "Check the job logs and uploaded artifacts for detailed performance metrics." >> $GITHUB_STEP_SUMMARY

      - name: Upload benchmark results
        uses: actions/upload-artifact@v4
        with:
          name: benchmark-results
          path: |
            nexum_core/current_bench.log
            nexum_core/main_bench.log
            nexum_core/target/criterion/
        if: always()

  python:
    name: Python tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Fail if junk files are tracked
        run: ./scripts/check_junk_files.sh

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'
          cache: 'pip'
          cache-dependency-path: nexum_ai/requirements.txt

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install ruff
          pip install -r nexum_ai/requirements-lock.txt
          pip install -r nexum_ai/tests/requirements.txt

      - name: Lint Python
        run: ruff check nexum_ai/

      - name: Byte-compile nexum_ai
        run: python -m compileall -q nexum_ai

      - name: Run pytest
        run: |
          cd nexum_ai
          pytest --cov=. --cov-report=xml --cov-report=term-missing

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          file: ./nexum_ai/coverage.xml
          flags: python
          name: nexum_ai-coverage
          token: ${{ secrets.CODECOV_TOKEN }}
        if: always()