lint.yml

name: Lint

on:
  pull_request:
  push:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

# Least-privilege: these jobs only read the repo (checkout + build + lint).
permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  # lgj-abi path-deps ndarray and lance-graph-contract (crates/lance-graph-contract
  # in the AdaWorldAPI/lance-graph sibling), and optionally (feature `ogar-classview`,
  # off by default) ogar-class-view in the AdaWorldAPI/OGAR sibling. Cargo resolves
  # the full dependency graph — including inactive optional path deps — so all three
  # siblings must exist on disk even though only two are compiled into the default
  # build. Checked out under the runner's top-level workspace, sibling to this repo's
  # own checkout, exactly as `../../../<repo>` from native/lgj-abi/Cargo.toml expects
  # (matches AdaWorldAPI/lance-graph's own .github/workflows/style.yml pattern).
  format:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: lance-graph-java/native/lgj-abi
    steps:
      # `persist-credentials: false` on EVERY checkout in this file (13 of them).
      # Without it, a `pull_request` checkout leaves the workflow token in the
      # clone's local git config, and every job here then runs `cargo`, which
      # executes any `build.rs` the PR added — a read path to that token before
      # the post-job cleanup. Flagged by zizmor as `artipacked`; raised by
      # CodeRabbit against the `java-suites` checkouts on #86, and the other
      # nine were already exposed identically, so this is the root-cause fix
      # rather than four of thirteen.
      #
      # Provably free: no step in this file pushes, the workflow declares
      # `contents: read`, and nothing reads a secret — so nothing here needs a
      # persisted credential, and the sibling checkouts of ndarray /
      # lance-graph / OGAR are public reads that never used one.
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          path: lance-graph-java
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          # `defaults.run.working-directory` applies to `run:` steps only, NOT
          # to action steps: this action executes from GITHUB_WORKSPACE, where
          # the checkout is a subdirectory and no toolchain file is visible. It
          # would silently fall back to `stable` instead of the pin. `rust-src-dir`
          # is the input that points it at the crate — which is also where
          # `rust-toolchain.toml` lives, beside `.cargo/config.toml`.
          rust-src-dir: lance-graph-java/native/lgj-abi
          # The baseline goes HERE, not in a `CARGO_BUILD_RUSTFLAGS` env var.
          # This action exports `RUSTFLAGS` from its own `rustflags` input
          # (default `-D warnings`), and `RUSTFLAGS` overrides
          # `build.rustflags` — which is what `CARGO_BUILD_RUSTFLAGS` sets, so a
          # baseline put there is silently discarded. The first run proved it:
          # the crate's own SIGILL-guard test was reached with no target-cpu at
          # all. The action's default is kept alongside the baseline, not
          # replaced.
          #
          # v3 rather than the crate's own v4: `.cargo/config.toml` pins AVX-512
          # because the production artifact is built for one known host, and
          # GitHub-hosted runners do not guarantee it. That file names v3 as the
          # remedy for a machine without AVX-512, and AVX2 is what
          # `the_x86_64_build_has_a_vector_baseline` requires — so this
          # retargets the gate rather than weakening it.
          rustflags: -D warnings -Ctarget-cpu=x86-64-v3
          # No `toolchain:` input — the action reads `rust-toolchain.toml`, so the
          # pinned version lives in exactly ONE place.
          components: rustfmt, clippy
      - name: Check formatting (lgj-abi)
        run: cargo fmt -- --check

  clippy:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    defaults:
      run:
        working-directory: lance-graph-java/native/lgj-abi
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          path: lance-graph-java
      - name: Checkout AdaWorldAPI/ndarray (sibling dependency)
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          repository: AdaWorldAPI/ndarray
          path: ndarray
      - name: Checkout AdaWorldAPI/lance-graph (sibling dependency, lance-graph-contract)
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          repository: AdaWorldAPI/lance-graph
          path: lance-graph
      - name: Checkout AdaWorldAPI/OGAR (sibling dependency, optional ogar-classview feature)
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          repository: AdaWorldAPI/OGAR
          path: OGAR
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          # `defaults.run.working-directory` applies to `run:` steps only, NOT
          # to action steps: this action executes from GITHUB_WORKSPACE, where
          # the checkout is a subdirectory and no toolchain file is visible. It
          # would silently fall back to `stable` instead of the pin. `rust-src-dir`
          # is the input that points it at the crate — which is also where
          # `rust-toolchain.toml` lives, beside `.cargo/config.toml`.
          rust-src-dir: lance-graph-java/native/lgj-abi
          # The baseline goes HERE, not in a `CARGO_BUILD_RUSTFLAGS` env var.
          # This action exports `RUSTFLAGS` from its own `rustflags` input
          # (default `-D warnings`), and `RUSTFLAGS` overrides
          # `build.rustflags` — which is what `CARGO_BUILD_RUSTFLAGS` sets, so a
          # baseline put there is silently discarded. The first run proved it:
          # the crate's own SIGILL-guard test was reached with no target-cpu at
          # all. The action's default is kept alongside the baseline, not
          # replaced.
          #
          # v3 rather than the crate's own v4: `.cargo/config.toml` pins AVX-512
          # because the production artifact is built for one known host, and
          # GitHub-hosted runners do not guarantee it. That file names v3 as the
          # remedy for a machine without AVX-512, and AVX2 is what
          # `the_x86_64_build_has_a_vector_baseline` requires — so this
          # retargets the gate rather than weakening it.
          rustflags: -D warnings -Ctarget-cpu=x86-64-v3
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: lance-graph-java/native/lgj-abi
      - name: Clippy lgj-abi
        run: cargo clippy --all-targets -- -D warnings

  rust-test:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    defaults:
      run:
        working-directory: lance-graph-java/native/lgj-abi
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          path: lance-graph-java
      - name: Checkout AdaWorldAPI/ndarray (sibling dependency)
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          repository: AdaWorldAPI/ndarray
          path: ndarray
      - name: Checkout AdaWorldAPI/lance-graph (sibling dependency, lance-graph-contract)
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          repository: AdaWorldAPI/lance-graph
          path: lance-graph
      - name: Checkout AdaWorldAPI/OGAR (sibling dependency, optional ogar-classview feature)
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          repository: AdaWorldAPI/OGAR
          path: OGAR
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          # `defaults.run.working-directory` applies to `run:` steps only, NOT
          # to action steps: this action executes from GITHUB_WORKSPACE, where
          # the checkout is a subdirectory and no toolchain file is visible. It
          # would silently fall back to `stable` instead of the pin. `rust-src-dir`
          # is the input that points it at the crate — which is also where
          # `rust-toolchain.toml` lives, beside `.cargo/config.toml`.
          rust-src-dir: lance-graph-java/native/lgj-abi
          # The baseline goes HERE, not in a `CARGO_BUILD_RUSTFLAGS` env var.
          # This action exports `RUSTFLAGS` from its own `rustflags` input
          # (default `-D warnings`), and `RUSTFLAGS` overrides
          # `build.rustflags` — which is what `CARGO_BUILD_RUSTFLAGS` sets, so a
          # baseline put there is silently discarded. The first run proved it:
          # the crate's own SIGILL-guard test was reached with no target-cpu at
          # all. The action's default is kept alongside the baseline, not
          # replaced.
          #
          # v3 rather than the crate's own v4: `.cargo/config.toml` pins AVX-512
          # because the production artifact is built for one known host, and
          # GitHub-hosted runners do not guarantee it. That file names v3 as the
          # remedy for a machine without AVX-512, and AVX2 is what
          # `the_x86_64_build_has_a_vector_baseline` requires — so this
          # retargets the gate rather than weakening it.
          rustflags: -D warnings -Ctarget-cpu=x86-64-v3
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: lance-graph-java/native/lgj-abi
      # Runs every #[test] in lgj-abi, including tests/g11_contract_import_fence.rs
      # — the fence CLAUDE.md's "Enforcement" section names as structural: it walks
      # src/ and rejects any `lance_graph_contract::` module outside the four-name
      # allowlist. Per this repo's own history, "G11 was prose until 2026-09-03"
      # because nothing ran the test that enforces it; this job is what runs it.
      - name: Test lgj-abi
        run: cargo test --all-targets

  # THE JAVA GATE. Until this job existed, `main` could be RED and nothing said
  # so: `GraphHopTest` reported 1 FAILED / 65 passed at bb81d80 and survived a
  # merge, because the three jobs above compile Rust only and nothing in
  # `.github/` compiled a single line of Java. The 612-check core suite and the
  # four consumer mains were LOCAL gates — run by whoever remembered. A gate that
  # exists and is never dispatched is indistinguishable from no gate.
  # Tracked as ISS-LGJ-CONSUMERS-HAVE-NO-CI-LINE.
  #
  # There is no build tool in this repo — no Maven, no Gradle, no wrapper — by
  # design (`java/README.md`: "`javac` and `java` are the entire Java
  # toolchain"). So this job shells out to raw javac/java with exactly the
  # commands that README documents, which is what keeps the two from drifting:
  # a contributor's local command and CI's command are the same string.
  java-suites:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          path: lance-graph-java
      # Same three siblings as `rust-test`, for the same reason: cargo resolves
      # the whole graph including the inactive optional path dep, so all three
      # must exist on disk before the artifact this job needs can be built.
      - name: Checkout AdaWorldAPI/ndarray (sibling dependency)
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          repository: AdaWorldAPI/ndarray
          path: ndarray
      - name: Checkout AdaWorldAPI/lance-graph (sibling dependency, lance-graph-contract)
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          repository: AdaWorldAPI/lance-graph
          path: lance-graph
      - name: Checkout AdaWorldAPI/OGAR (sibling dependency, optional ogar-classview feature)
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          repository: AdaWorldAPI/OGAR
          path: OGAR
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          rust-src-dir: lance-graph-java/native/lgj-abi
          # x86-64-v3, matching the jobs above: `.cargo/config.toml` pins AVX-512
          # for the one known production host and GitHub-hosted runners do not
          # guarantee it. No Java test pins a backend name — `AbiContractTest`
          # asserts only that one was reported, `FusionParityTest` merely notes
          # it, and `DoctrineFenceTest` counts source lines — so the suite is
          # backend-agnostic by construction and an AVX2 artifact gates the same
          # behaviour. That is the `simdBackend()` "diagnostic only" rule holding.
          rustflags: -D warnings -Ctarget-cpu=x86-64-v3
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: lance-graph-java/native/lgj-abi
      # The suite needs the real artifact. `AllTests` exits 2 when it is absent
      # rather than reporting a failure — deliberately, so a missing library does
      # not read as a broken test. In CI that distinction is moot: any non-zero
      # exit fails the step, and here an absent artifact IS a defect.
      - name: Build liblgj_abi.so (release)
        working-directory: lance-graph-java/native/lgj-abi
        run: cargo build --release
      # `28-ea`, not `28`. JDK 28 is not GA: Adoptium's own
      # /v3/info/available_releases lists it as most_recent_feature_version and
      # NOT in available_releases. The `-ea` suffix is what makes setup-java ask
      # for it — `normalizeVersion` sets `stable = false` on that suffix, and the
      # temurin installer then queries `release_type=ea`, which serves
      # jdk-28+16-ea-beta: the same build the development container runs.
      #
      # The version is deliberately NOT pinned to +16. This repo forbids internal
      # head pins, and an upstream EA build is an external dependency whose whole
      # purpose is to move; pinning it would mean a checksum bump per EA drop with
      # nothing verified in exchange. What the suite actually requires is JEP 401
      # value classes under preview, and every 28 EA build carries those.
      - name: Set up JDK 28 (early access)
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '28-ea'
      # --enable-preview is for JEP 401 (value classes), NOT for Panama, which is
      # final since 22. The flag is repo-wide and deliberate: mixing previewed and
      # non-previewed classfiles is what poisons a build.
      - name: Compile the core suite (main + test)
        working-directory: lance-graph-java/java
        run: |
          javac --release 28 --enable-preview -d out \
            $(find src/main/java src/test/java -name '*.java')
      # -Dlgj.library is an EXPLICIT request, and `Abi.locateLibrary` refuses to
      # fall back to a search path when it cannot be honoured. That is what stops
      # this job from silently measuring some other artifact than the one the step
      # above just built.
      - name: Run the core suite (AllTests)
        working-directory: lance-graph-java/java
        run: |
          java --enable-preview --enable-native-access=ALL-UNNAMED \
            -Dlgj.library="$GITHUB_WORKSPACE/lance-graph-java/native/lgj-abi/target/release/liblgj_abi.so" \
            -cp out com.adaworldapi.lancegraph.AllTests
      - name: Compile the consumer suites
        working-directory: lance-graph-java
        run: |
          javac --release 28 --enable-preview -cp java/out -d consumers/out \
            $(find consumers -name '*.java')
      # FOUR mains, not three. `trades` carries two — an allocation floor and a
      # parity suite — and running only one of them would be the
      # no-gate-with-extra-steps outcome: compiling a consumer proves it builds,
      # never that its assertions hold.
      #
      # NOT fail-fast, deliberately. A `run:` step is `bash -e`, and a bare
      # `java` in this loop would abort the whole step at the first red main —
      # verified, the loop does not reach its remaining members — so one broken
      # consumer would mask the other three and each CI round would reveal
      # exactly one of them. `|| failed=...` collects instead, and the step still
      # exits non-zero. This mirrors `AllTests`, which runs every suite before
      # exiting 1 rather than stopping at the first failure.
      - name: Run the consumer suites
        working-directory: lance-graph-java
        run: |
          failed=""
          for main in com.adaworldapi.bricks.BricksAuthTest \
                      com.adaworldapi.graph.GraphHopTest \
                      com.adaworldapi.trades.TradesAllocationTest \
                      com.adaworldapi.trades.TradesParityTest ; do
            echo "::group::$main"
            java --enable-preview --enable-native-access=ALL-UNNAMED \
              -Dlgj.library="$GITHUB_WORKSPACE/lance-graph-java/native/lgj-abi/target/release/liblgj_abi.so" \
              -cp "java/out:consumers/out" "$main" || failed="$failed $main"
            echo "::endgroup::"
          done
          if [ -n "$failed" ]; then
            echo "::error::consumer suites FAILED:$failed"
            exit 1
          fi
          echo "all four consumer suites passed"
      # Quick win A1: TinkerGraph 3.7.7 vs mask hop chain parity. Kept out of
      # `consumers/` because that tree is compiled above without TinkerPop on the
      # classpath. `fetch-deps.sh` downloads 19 jars from Maven Central and
      # refuses any whose sha256 differs from `deps.lock`; `run.sh` reads
      # LGJ_JDK, not JAVA_HOME, so point it at the JDK 28 EA that setup-java
      # installed in this job.
      - name: Fetch TinkerPop jars (sha256-pinned)
        working-directory: lance-graph-java/interop/tinkerpop
        run: ./fetch-deps.sh
      - name: Run the TinkerPop parity harness (A1)
        working-directory: lance-graph-java/interop/tinkerpop
        env:
          LGJ_JDK: ${{ env.JAVA_HOME }}
        run: ./run.sh