devops

1. READ the failing job logs carefully
2. IDENTIFY the exact line where failure occurs
3. CLASSIFY the failure type:
   - Missing dependency/setup
   - Tool version incompatibility
   - Cache corruption
   - Permission issue
   - Matrix target missing toolchain
   - Flaky test (timing/network)
   - Genuine code bug
4. TRACE the root cause to workflow YAML or code
5. PROPOSE minimal fix preserving all coverage

## Root Cause Analysis

**Failing Job**: [job name]
**Failing Step**: [step name]
**Exact Log Line**: [quote the error line]

**Classification**: [Missing setup | Version mismatch | Cache issue | Permission | Matrix gap | Flaky | Code bug]

**Root Cause**: [Explanation of why it fails]

## Proposed Changes

1. [Change 1 with rationale]
2. [Change 2 with rationale]

**What is NOT changed**: [Explicitly list preserved jobs/steps/matrix entries]

## YAML Patch

```yaml
# Before
[relevant section]

# After
[fixed section]

### Common Fixes (Preserve Coverage)

#### Missing Toolchain for Matrix Target
```yaml
# WRONG: Remove the target
# RIGHT: Add the target to rust-toolchain
- uses: dtolnay/rust-toolchain@stable
  with:
    targets: ${{ matrix.target }}  # Add this line

# WRONG: Remove caching
# RIGHT: Version the cache key
- uses: Swatinem/rust-cache@v2
  with:
    prefix-key: "v2"  # Bump to invalidate
    shared-key: ${{ matrix.target }}

# WRONG: Remove the tool check
# RIGHT: Pin specific version
- uses: dtolnay/rust-toolchain@1.75.0  # Pin version
# OR
- run: rustup override set 1.75.0  # Pin for this run

# WRONG: Remove the test
# RIGHT: Add retry or timeout
- name: Test with retry
  uses: nick-fields/retry@v2
  with:
    max_attempts: 3
    timeout_minutes: 10
    command: cargo test --all-features

# WRONG: Skip the job on that OS
# RIGHT: Add the dependencies
- name: Install dependencies (Linux)
  if: runner.os == 'Linux'
  run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config

- name: Install dependencies (macOS)
  if: runner.os == 'macOS'
  run: brew install openssl

# Add explicit permissions at job or workflow level
permissions:
  contents: read
  packages: write
  id-token: write  # For OIDC

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  check:
    name: Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo check --all-features

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --all-features

  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --all-features -- -D warnings

  security:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: rustsec/audit-check@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: x86_64-apple-darwin
            os: macos-latest
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-pc-windows-msvc
            os: windows-latest

    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2

      - name: Build
        run: cargo build --release --target ${{ matrix.target }}

      - name: Archive
        shell: bash
        run: |
          cd target/${{ matrix.target }}/release
          if [[ "${{ matrix.os }}" == "windows-latest" ]]; then
            7z a ../../../${{ github.event.repository.name }}-${{ matrix.target }}.zip ${{ github.event.repository.name }}.exe
          else
            tar czvf ../../../${{ github.event.repository.name }}-${{ matrix.target }}.tar.gz ${{ github.event.repository.name }}
          fi

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.target }}
          path: ${{ github.event.repository.name }}-${{ matrix.target }}.*

  release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
      - uses: softprops/action-gh-release@v1
        with:
          files: |
            **/*.tar.gz
            **/*.zip
          generate_release_notes: true

# Build stage
FROM rust:1.75-slim as builder

WORKDIR /app

# Cache dependencies
COPY Cargo.toml Cargo.lock ./
RUN mkdir src && echo "fn main() {}" > src/main.rs
RUN cargo build --release && rm -rf src

# Build application
COPY src ./src
RUN touch src/main.rs && cargo build --release

# Runtime stage
FROM gcr.io/distroless/cc-debian12

COPY --from=builder /app/target/release/app /app

EXPOSE 8080
USER nonroot:nonroot

ENTRYPOINT ["/app"]

version: '3.8'

services:
  app:
    build:
      context: .
      target: builder
    volumes:
      - .:/app
      - cargo-cache:/usr/local/cargo/registry
    ports:
      - "8080:8080"
    environment:
      - RUST_LOG=debug
    command: cargo watch -x run

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"

volumes:
  cargo-cache:

name = "my-worker"
main = "build/worker/shim.mjs"
compatibility_date = "2024-01-01"

[build]
command = "cargo install -q worker-build && worker-build --release"

[vars]
ENVIRONMENT = "production"

[[kv_namespaces]]
binding = "CACHE"
id = "xxx"

name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown
      - uses: Swatinem/rust-cache@v2

      - name: Install wrangler
        run: npm install -g wrangler

      - name: Deploy
        run: wrangler deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: cargo
    directory: /
    schedule:
      interval: weekly
    groups:
      rust-dependencies:
        patterns:
          - "*"
    commit-message:
      prefix: "deps"

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    commit-message:
      prefix: "ci"

async fn health_check() -> impl IntoResponse {
    Json(json!({
        "status": "healthy",
        "version": env!("CARGO_PKG_VERSION"),
        "timestamp": chrono::Utc::now().to_rfc3339(),
    }))
}