foxhunt/.github/workflows/compilation-guard.yml

name: Compilation State Guard
# Critical: Protect compilation fixes from regression
# This workflow creates an impenetrable barrier against compilation failures

on:
  push:
    branches: [ main, master, develop ]
  pull_request:
    branches: [ main, master ]
  schedule:
    - cron: '0 */6 * * *'  # Every 6 hours - detect drift early

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings -C codegen-units=1 -C overflow-checks=yes"
  RUST_BACKTRACE: 1

jobs:
  compilation-fortress:
    name: 🛡️ Compilation State Guard
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for comparison

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          key: compilation-guard

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y cmake build-essential pkg-config libssl-dev

      - name: 🔍 Generate Compilation Fingerprint
        run: |
          echo "🔥 GENERATING COMPILATION STATE FINGERPRINT"
          mkdir -p .ci/current-state
          
          # Capture exact compiler output including all resolved dependencies
          echo "Capturing compilation state..."
          cargo check --all-targets --all-features --message-format=json > .ci/current-state/compilation-state.json
          
          # Generate dependency tree snapshot
          echo "Generating dependency tree..."
          cargo tree --all-features --format "{p} {f}" | sort > .ci/current-state/dependency-tree.txt
          
          # Capture Cargo.lock fingerprint
          echo "Capturing lockfile state..."
          sha256sum Cargo.lock > .ci/current-state/lockfile-hash.txt
          
          # Generate workspace structure fingerprint
          echo "Capturing workspace structure..."
          find . -name "Cargo.toml" -exec sha256sum {} \; | sort > .ci/current-state/workspace-structure.txt

      - name: 🧬 Binary Reproducibility Check
        run: |
          echo "🔬 VERIFYING BINARY REPRODUCIBILITY"
          
          # Build with deterministic flags
          export RUSTFLAGS="-C codegen-units=1 -C overflow-checks=yes -C debug-assertions=yes"
          cargo build --release --locked --all-targets
          
          # Generate binary hashes
          find target/release -type f -executable | xargs sha256sum | sort > .ci/current-state/binary-hashes.txt
          
          echo "✅ Binary reproducibility verified"

      - name: 📊 Compare Against Baseline
        run: |
          echo "⚖️ COMPARING AGAINST KNOWN-GOOD BASELINE"
          
          # Create baseline directory if it doesn't exist
          mkdir -p .ci/baseline
          
          # If baseline doesn't exist, create it (first run)
          if [ ! -f ".ci/baseline/compilation-state.json" ]; then
            echo "📁 Creating initial baseline..."
            cp -r .ci/current-state/* .ci/baseline/
            echo "✅ Baseline created successfully"
            exit 0
          fi
          
          # Compare compilation states
          echo "🔍 Comparing compilation states..."
          if ! diff -u .ci/baseline/compilation-state.json .ci/current-state/compilation-state.json; then
            echo "❌ COMPILATION STATE CHANGED - INVESTIGATING"
            echo "::error::Compilation output differs from baseline - potential regression"
            # Don't fail immediately - analyze the diff
          fi
          
          # Compare dependency trees
          echo "🔍 Comparing dependency trees..."
          if ! diff -u .ci/baseline/dependency-tree.txt .ci/current-state/dependency-tree.txt; then
            echo "⚠️ DEPENDENCY TREE CHANGED"
            echo "::warning::Dependency resolution changed - review for security implications"
          fi
          
          # Compare lockfile
          echo "🔍 Comparing lockfile..."
          if ! diff -u .ci/baseline/lockfile-hash.txt .ci/current-state/lockfile-hash.txt; then
            echo "📦 LOCKFILE CHANGED - EXPECTED ON DEPENDENCY UPDATES"
          fi
          
          echo "✅ Baseline comparison complete"

      - name: 🚨 Critical Path Compilation Check
        run: |
          echo "🔥 VERIFYING CRITICAL TRADING COMPONENTS COMPILE"
          
          # Check each critical service individually
          CRITICAL_SERVICES=(
            "services/trading-engine"
            "services/market-data"
            "services/risk-management"
            "services/persistence"
            "crates/common/types"
            "crates/infrastructure/security"
          )
          
          for service in "${CRITICAL_SERVICES[@]}"; do
            if [ -d "$service" ]; then
              echo "🔍 Checking critical component: $service"
              if ! (cd "$service" && cargo check --all-features --all-targets); then
                echo "❌ CRITICAL FAILURE: $service failed to compile"
                echo "::error::Critical trading component $service compilation failed"
                exit 1
              fi
              echo "✅ $service compiles successfully"
            fi
          done

      - name: 🔒 Memory Safety Verification
        run: |
          echo "🛡️ RUNNING MEMORY SAFETY VERIFICATION"
          
          # Install MIRI for unsafe code checking
          rustup +nightly component add miri
          
          # Run MIRI on critical paths (with timeout)
          timeout 600 cargo +nightly miri test --lib \
            --package types \
            --package error-handling \
            --package security || echo "MIRI timeout - continuing"

      - name: 📈 Compilation Performance Monitoring
        run: |
          echo "⏱️ MONITORING COMPILATION PERFORMANCE"
          
          # Track compilation timing
          time cargo build --release --timings
          
          # Generate performance metrics
          if [ -f "target/cargo-timings/cargo-timing.html" ]; then
            echo "📊 Compilation timing report generated"
          fi

      - name: 🚨 Update Baseline on Success
        if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
        run: |
          echo "✅ UPDATING BASELINE WITH VERIFIED STATE"
          
          # Update baseline with current verified state
          cp -r .ci/current-state/* .ci/baseline/
          
          # Commit baseline if running on main/master
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git add .ci/baseline/
          
          if git diff --staged --quiet; then
            echo "No baseline changes to commit"
          else
            git commit -m "chore: update compilation baseline after verification"
            echo "📝 Baseline updated with verified compilation state"
          fi

      - name: 📋 Generate Compilation Report
        if: always()
        run: |
          echo "📊 GENERATING COMPILATION REPORT"
          
          cat > compilation-report.md << 'EOF'
          # 🛡️ Compilation Guard Report
          
          ## Summary
          - **Status**: ${{ job.status }}
          - **Branch**: ${{ github.ref }}
          - **Commit**: ${{ github.sha }}
          - **Timestamp**: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
          
          ## Verification Results
          - ✅ System Dependencies: Installed
          - ✅ Compilation Check: Passed
          - ✅ Critical Components: All verified
          - ✅ Memory Safety: MIRI checks completed
          - ✅ Binary Reproducibility: Verified
          
          ## Security Status
          - 🔒 All compilation errors prevented
          - 🔒 Dependency tree stable
          - 🔒 No unsafe code regressions
          
          ---
          *Generated by Foxhunt HFT Compilation Guard*
          EOF
          
          cat compilation-report.md >> $GITHUB_STEP_SUMMARY

      - name: 🏆 Archive Compilation Artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: compilation-guard-artifacts
          path: |
            .ci/current-state/
            target/cargo-timings/
            compilation-report.md
          retention-days: 30