bloat.yml

name: Bloat Budget

# Enforce a hard cargo-bloat budget so silent binary
# growth blocks merge. The musl static builds themselves live in
# .github/workflows/reusable-build.yml (build-linux-amd64 / build-linux-arm64
# / build-windows-amd64 / build-windows-arm64); this workflow only adds the
# per-(target, role) regression gate on top of them.
#
# Per-target ceilings exist on purpose: a Linux musl binary and a Windows
# MSVC binary (with static_vcruntime + windows-sys) have very different
# baselines. One shared ceiling would either let Windows regress silently
# or false-flag every Linux PR. See ci/README.md for the override path.

on:
  push:
    branches: ["main", "dev"]
  pull_request:
    branches: ["main", "dev"]

env:
  CARGO_TERM_COLOR: always
  # Strict default: every non-first-party crate must stay under this share of
  # the text section. Per-(target, crate) exceptions live in the matrix below
  # as `crate_share_overrides` so they're auditable and narrowly scoped.
  MAX_CRATE_SHARE: "0.10"        # 10% of text per non-first-party crate

concurrency:
  group: bloat-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

jobs:
  bloat-budget:
    name: bloat (${{ matrix.target }} / ${{ matrix.crate }})
    runs-on: ${{ matrix.runs_on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # -------- Linux x86_64 musl --------
          - target: x86_64-unknown-linux-musl
            runs_on: ubuntu-latest
            crate: azure-proxy-agent
            max_binary_bytes: "20000000"   # ~20 MB
            # Vendored OpenSSL (approved crypto) is structurally ~20% of text
            # for the agent on musl; HMAC-SHA256 in proxy_agent_shared pulls it.
            crate_share_overrides: "openssl_sys=0.25"
            apt_packages: musl-tools
          - target: x86_64-unknown-linux-musl
            runs_on: ubuntu-latest
            crate: ProxyAgentExt
            max_binary_bytes: "10000000"   # ~10 MB
            crate_share_overrides: "clap_builder=0.15 regex_automata=0.15"
            apt_packages: musl-tools
          - target: x86_64-unknown-linux-musl
            runs_on: ubuntu-latest
            crate: proxy_agent_setup
            max_binary_bytes: "6000000"   # ~6 MB
            # proxy_agent_setup is tiny (~1 MiB text after the openssl gate),
            # so a normal-sized clap derive parser is ~30% by share.
            crate_share_overrides: "clap_builder=0.35"
            apt_packages: musl-tools

          # -------- Linux aarch64 musl (native arm64 runner) --------
          - target: aarch64-unknown-linux-musl
            runs_on: ubuntu-24.04-arm
            crate: azure-proxy-agent
            max_binary_bytes: "20000000" 
            crate_share_overrides: "openssl_sys=0.15"
            apt_packages: musl-tools
          - target: aarch64-unknown-linux-musl
            runs_on: ubuntu-24.04-arm
            crate: ProxyAgentExt
            max_binary_bytes: "10000000"
            crate_share_overrides: "clap_builder=0.15 regex_automata=0.15"
            apt_packages: musl-tools
          - target: aarch64-unknown-linux-musl
            runs_on: ubuntu-24.04-arm
            crate: proxy_agent_setup
            max_binary_bytes: "11000000"
            crate_share_overrides: "clap_builder=0.35"
            apt_packages: musl-tools

          # -------- Windows x86_64 MSVC --------
          - target: x86_64-pc-windows-msvc
            runs_on: windows-2022
            crate: azure-proxy-agent
            max_binary_bytes: "10000000"
          - target: x86_64-pc-windows-msvc
            runs_on: windows-2022
            crate: ProxyAgentExt
            max_binary_bytes: "5000000"
            crate_share_overrides: "clap_builder=0.20 regex_automata=0.15 regex_syntax=0.15"
          - target: x86_64-pc-windows-msvc
            runs_on: windows-2022
            crate: proxy_agent_setup
            max_binary_bytes: "4000000"
            crate_share_overrides: "clap_builder=0.35 regex_automata=0.20 regex_syntax=0.15"

          # -------- Windows aarch64 MSVC (cross-compiled on x64 runner) --------
          - target: aarch64-pc-windows-msvc
            runs_on: windows-2022
            crate: azure-proxy-agent
            max_binary_bytes: "8000000"
            # No vendored OpenSSL on Windows (BCrypt), but the binary is much
            # smaller so tokio's fixed cost crosses 10% by share.
            crate_share_overrides: "tokio=0.12"
          - target: aarch64-pc-windows-msvc
            runs_on: windows-2022
            crate: ProxyAgentExt
            max_binary_bytes: "5000000"
            crate_share_overrides: "clap_builder=0.20 regex_automata=0.20 regex_syntax=0.15"
          - target: aarch64-pc-windows-msvc
            runs_on: windows-2022
            crate: proxy_agent_setup
            max_binary_bytes: "4000000"
            crate_share_overrides: "clap_builder=0.25 regex_automata=0.20 regex_syntax=0.15"

    steps:
      - uses: actions/checkout@v4

      - name: Install apt packages (Linux only)
        if: runner.os == 'Linux' && matrix.apt_packages != ''
        run: |
          sudo apt-get update
          sudo apt-get install -y ${{ matrix.apt_packages }}

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          key: bloat-${{ matrix.target }}-${{ matrix.crate }}

      - name: Install cargo-bloat
        run: cargo install cargo-bloat --locked

      - name: Run cargo-bloat
        shell: bash
        run: |
          cargo bloat --release --crates \
            --target ${{ matrix.target }} \
            -p ${{ matrix.crate }} \
            --message-format json > bloat.json

      - name: Enforce budget
        shell: bash
        run: |
          overrides=""
          for kv in ${{ matrix.crate_share_overrides }}; do
            overrides="$overrides --crate-share-override $kv"
          done
          python3 ci/check_bloat.py \
            --bloat-json bloat.json \
            --max-binary-bytes ${{ matrix.max_binary_bytes }} \
            --max-crate-share ${{ env.MAX_CRATE_SHARE }} \
            $overrides \
            | tee bloat-report.txt

      - name: Upload bloat report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: bloat-report-${{ matrix.target }}-${{ matrix.crate }}
          path: |
            bloat.json
            bloat-report.txt
          if-no-files-found: warn