[workspace]
members = [
	"cedar-policy",
	"cedar-policy-core",
	"cedar-policy-formatter",
	"cedar-policy-cli",
	"cedar-policy-symcc",
	"cedar-testing",
	"cedar-wasm",
	"cedar-language-server",
]

resolver = "2"

# cargo-dist config. Workspace default `dist = false`; `cedar-policy-cli`
# opts in via its own `[package.metadata.dist]`.
[workspace.metadata.dist]
cargo-dist-version = "0.32.0"
ci = "github"
dist = false
installers = ["shell", "powershell"]
tag-namespace = "cedar-policy-cli"
targets = [
    "x86_64-unknown-linux-gnu",
    "aarch64-unknown-linux-gnu",
    "x86_64-apple-darwin",
    "aarch64-apple-darwin",
    "x86_64-pc-windows-msvc",
]
include = ["NOTICE", "THIRD_PARTY_LICENSES.txt"]
pr-run-mode = "plan"
install-updater = false
post-announce-jobs = ["./build_experimental", "./set_release_title"]

# SHA-pin the actions cargo-dist injects into the generated workflow.
[workspace.metadata.dist.github-action-commits]
"actions/checkout" = "df4cb1c069e1874edd31b4311f1884172cec0e10"            # v6.0.3
"actions/upload-artifact" = "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"     # v7.0.1
"actions/download-artifact" = "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"   # v8

# Enable global integer overflow detection for the release profile
[profile.release]
overflow-checks = true

# The profile that 'dist' will build with
[profile.dist]
inherits = "release"
lto = "thin"

[profile.bench]
overflow-checks = true
debug = "line-tables-only"  # this adds more debug symbols/info to the binary than the default for `release` (which is `none`)

# https://insta.rs/docs/quickstart/ recommends compiling `insta` and `similar` in release mode, even for dev dependency
[profile.dev.package]
insta.opt-level = 3
similar.opt-level = 3

# Keys that packages can inherit
[workspace.package]
# Check the minimum supported Rust version with `cargo install cargo-msrv && cargo msrv --min 1.X.0` where `X` is something lower than the version noted here (to confirm that versions lower than the one noted here _don't_ work)
rust-version = "1.89"
version = "4.13.0"
homepage = "https://cedarpolicy.com"
keywords = ["cedar", "authorization", "policy", "security"]
categories = ["compilers", "config"]
license = "Apache-2.0"
edition = "2021"
repository = "https://github.com/cedar-policy/cedar"

# We actually deny all rustc warnings in CI, but it's clearer if we explicitly
# "deny" here even if setting to "warn" has the same effect.
[workspace.lints.rust]
unsafe_code = "forbid"
unexpected_cfgs = { level = 'deny', check-cfg = ['cfg(kani)', 'cfg(fuzzing)'] }
missing_debug_implementations = "deny"
rust-2018-idioms = "deny"
unused_assignments = "allow" # In Rust 1.92 this one erroneously identifies some fields in error structs as unused, when they are actually used in the `#[error]` attribute

# For clippy lints CI will only block on errors, so setting one to "warn" just
# means we'll see it in local runs.
[workspace.lints.clippy]
nursery = { level = "warn", priority = -1 }
# Enabling some pedantic lints incrementally
cast_lossless = "warn"
cast_possible_truncation = "warn"
cloned_instead_of_copied = "warn"
format_collect = "warn"
format_push_string = "warn"
implicit_clone = "warn"
inconsistent_struct_constructor = "warn"
inefficient_to_string = "warn"
large_types_passed_by_value = "warn"
needless_pass_by_value = "warn"
option_as_ref_cloned = "warn"
option_option = "warn"
redundant_clone = "deny"
ref_option = "warn"
ref_option_ref = "warn"
trivially_copy_pass_by_ref = "warn"

# When overriding lints, require `expect` instead of `allow`, and require a reason
allow_attributes = "deny"
allow_attributes_without_reason = "deny"
should_panic_without_expect = "deny"

# These lints may be worth enforcing, but cause a lot of noise at the moment.
use_self = "allow"
option_if_let_else = "allow"
redundant_pub_crate = "allow"
too_long_first_doc_paragraph = "allow"
# We don't want to enforce these lints.
missing_const_for_fn = "allow"
needless_doctest_main = "allow"
# see #878
result_large_err = "allow"
large_enum_variant = "allow"

# Error on potential panics
unwrap_used = "deny"
expect_used = "deny"
fallible_impl_from = "deny"
unreachable = "deny"
indexing_slicing = "deny"
string_slice = "deny"
panic = "deny"
todo = "deny"
unimplemented = "deny"