full-validation.yml

name: Full validation

on:
  push:
    branches: [main]
  schedule:
    - cron: "17 8 * * 0"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: full-validation-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' }}

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"
  RUSTDOCFLAGS: "-D warnings"

jobs:
  github-actions-verifier:
    name: GitHub Actions verifier tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - run: python3 -m unittest discover -s scripts/tests -p 'test_*.py' -v

  fmt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: "1.96"
          components: rustfmt
      - run: cargo xtask fmt

  diff-check:
    runs-on: ubuntu-latest
    env:
      BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
      - name: Reject whitespace errors in the submitted delta
        run: |
          if [ -n "${BASE_SHA}" ] \
            && [ "${BASE_SHA}" != "0000000000000000000000000000000000000000" ] \
            && git cat-file -e "${BASE_SHA}^{commit}"; then
            git diff --check "${BASE_SHA}...${GITHUB_SHA}"
          else
            git show --check --format=fuller "${GITHUB_SHA}" >/dev/null
          fi

  secret-scan:
    name: Secret scan
    uses: ./.github/workflows/secret-scan.yml

  clippy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
          components: clippy
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: full-host-${{ runner.os }}-${{ runner.arch }}-stable-clippy
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch' }}
      - run: cargo xtask clippy

  clippy-strict:
    name: Strict Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
          components: clippy
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: full-host-${{ runner.os }}-${{ runner.arch }}-stable-clippy-strict
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch' }}
      - run: cargo xtask clippy-strict

  panic-surface:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
          components: clippy
      - run: cargo xtask panic-surface

  clone-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - run: cargo xtask clone-audit
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        if: always()
        with:
          name: j2k-clone-audits
          path: |
            target/clone-audit/report/jscpd-report.json
            target/clone-audit/test-report/jscpd-report.json
          if-no-files-found: error

  comparator-parity:
    runs-on: ubuntu-latest
    env:
      J2K_OPENJPEG_BIN: /usr/bin/opj_decompress
      J2K_OPENJPEG_DECOMPRESS_BIN: /usr/bin/opj_decompress
      J2K_OPENJPEG_COMPRESS_BIN: /usr/bin/opj_compress
      J2K_GROK_BIN: /usr/bin/grk_decompress
      J2K_GROK_COMPRESS_BIN: /usr/bin/grk_compress
      J2K_REQUIRE_OPENJPEG: "1"
      J2K_REQUIRE_GROK: "1"
      J2K_REQUIRE_LIBJPEG_TURBO: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - name: Install comparator tools
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            grokj2k-tools \
            libgrokj2k1-dev \
            libopenjp2-tools \
            libturbojpeg0-dev \
            pkg-config
      - name: Verify comparator tools
        run: |
          command -v opj_compress
          command -v opj_decompress
          command -v grk_compress
          command -v grk_decompress
          pkg-config --modversion libgrokj2k
          pkg-config --modversion libturbojpeg
      - run: cargo xtask j2k-bench-signoff

  semver:
    # Published Metal baselines include macOS-gated public API and must be
    # rustdoc-built on macOS for cargo-semver-checks.
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: "1.96"
      - run: cargo install cargo-semver-checks --version 0.48.0 --locked
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: nightly-2026-06-28
          targets: aarch64-apple-darwin
      - uses: taiki-e/install-action@7572810d7dd469b651bb7793945692cf78da5dd7
        with:
          tool: cargo-public-api@0.52.0
      - run: cargo xtask semver

  docs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - run: cargo xtask doc

  stable-api:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: nightly-2026-06-28
          targets: aarch64-apple-darwin
      - uses: taiki-e/install-action@7572810d7dd469b651bb7793945692cf78da5dd7
        with:
          tool: cargo-public-api@0.52.0
      - run: cargo public-api --version || cargo install cargo-public-api --version 0.52.0 --locked
      - run: cargo xtask repo-lint
      - run: cargo xtask stable-api

  codec-math-codegen:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - run: cargo xtask codec-math-codegen

  public-support-final:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - run: cargo xtask public-support --final

  machete:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: taiki-e/install-action@7572810d7dd469b651bb7793945692cf78da5dd7
        with:
          tool: cargo-machete@0.9.2
      - run: cargo xtask machete

  release-integrity:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - run: cargo xtask release-integrity

  unsafe-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - run: cargo xtask unsafe-audit

  typos:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14

  test:
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-latest,      rust: stable, arch: x86_64 }
          - { os: ubuntu-latest,      rust: beta,   arch: x86_64 }
          - { os: ubuntu-latest,      rust: "1.96", arch: x86_64 }
          - { os: ubuntu-24.04-arm,   rust: stable, arch: aarch64 }
          - { os: ubuntu-24.04-arm,   rust: "1.96", arch: aarch64 }
          - { os: macos-latest,       rust: stable, arch: aarch64 }
          - { os: macos-latest,       rust: "1.96", arch: aarch64 }
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: ${{ matrix.rust }}
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: full-host-${{ runner.os }}-${{ runner.arch }}-${{ matrix.rust }}-test
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch' }}
      - run: cargo xtask test

  release-cpu:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: full-host-${{ runner.os }}-${{ runner.arch }}-stable-release-cpu
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch' }}
      - run: cargo xtask release-cpu

  t803-cpu:
    name: T.803 CPU (${{ matrix.lane }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-latest, lane: linux-x86_64 }
          - { os: macos-latest, lane: macos-aarch64 }
          - { os: windows-latest, lane: windows-x86_64 }
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - name: Prepare pinned OpenHTJ2K interoperability decoder
        shell: bash
        run: scripts/prepare-openhtj2k-reference.sh
      - name: Generate exact-reference CPU evidence
        shell: bash
        run: |
          status=0
          cargo xtask t803 fetch || status=$?
          if [ "${status}" -eq 0 ]; then
            cargo xtask t803 run --iut cpu --out-dir target/t803/reports || status=$?
          fi
          echo "T803_STATUS=${status}" >> "${GITHUB_ENV}"
      - name: Upload CPU T.803 reports only
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: j2k-t803-cpu-${{ matrix.lane }}-${{ github.sha }}
          path: |
            target/t803/reports/cpu.json
            target/t803/reports/cpu.md
          if-no-files-found: error
      - name: Enforce CPU T.803 result after evidence upload
        if: ${{ always() }}
        shell: bash
        run: exit "${T803_STATUS:-1}"

  metal-compile:
    name: Metal compile and pure tests
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
          components: clippy
      - run: cargo xtask j2k-ml-package-smoke
      - run: cargo xtask metal-compile

  no-std:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - run: cargo xtask no-std

  miri:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: nightly
          components: miri
      - run: cargo xtask miri

  bench-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: full-host-${{ runner.os }}-${{ runner.arch }}-stable-bench-build
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch' }}
      - run: cargo xtask bench-build --lane host

  fuzz-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - run: cargo xtask fuzz-build

  fuzz-run:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: nightly
      - uses: taiki-e/install-action@7572810d7dd469b651bb7793945692cf78da5dd7
        with:
          tool: cargo-fuzz
      - run: cargo xtask fuzz-run
        env:
          J2K_FUZZ_RUNS: "512"
          J2K_FUZZ_MAX_TOTAL_TIME_SECONDS: "60"

  fuzz-run-long:
    if: ${{ github.event_name == 'schedule' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: nightly
      - uses: taiki-e/install-action@7572810d7dd469b651bb7793945692cf78da5dd7
        with:
          tool: cargo-fuzz
      - run: cargo xtask fuzz-run
        env:
          J2K_FUZZ_RUNS: "20000"
          J2K_FUZZ_MAX_TOTAL_TIME_SECONDS: "900"

  package:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: full-host-${{ runner.os }}-${{ runner.arch }}-stable-package
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch' }}
      - run: cargo xtask package

  coverage:
    runs-on: ubuntu-latest
    env:
      J2K_COVERAGE_BASE: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'push' && github.event.before || 'HEAD^' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: full-host-${{ runner.os }}-${{ runner.arch }}-stable-coverage
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch' }}
      - uses: taiki-e/install-action@7572810d7dd469b651bb7793945692cf78da5dd7
        with:
          tool: cargo-llvm-cov@0.8.7
      - run: cargo xtask coverage host
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        if: always()
        with:
          name: j2k-host-coverage
          path: |
            lcov-host.info
            coverage-host-summary.json
            coverage-host-regions.json
          if-no-files-found: error

  deny:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: stable
      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25
        with: { command: check licenses advisories bans sources }

  release-candidate:
    name: Release candidate aggregate
    if: ${{ always() }}
    needs:
      - github-actions-verifier
      - fmt
      - diff-check
      - secret-scan
      - clippy
      - clippy-strict
      - panic-surface
      - clone-audit
      - comparator-parity
      - semver
      - docs
      - stable-api
      - codec-math-codegen
      - public-support-final
      - machete
      - release-integrity
      - unsafe-audit
      - typos
      - test
      - release-cpu
      - t803-cpu
      - metal-compile
      - no-std
      - miri
      - bench-build
      - fuzz-build
      - fuzz-run
      - package
      - coverage
      - deny
    runs-on: ubuntu-latest
    env:
      REQUIRED_RESULTS: ${{ toJSON(needs) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - name: Require every core and API gate
        run: python3 scripts/ci_plan.py success-only --needs-json "${REQUIRED_RESULTS}"