# CI for pull requests and main: format, clippy, tests, dependency layering, the tool list and
# the wasm32 check (the same gates as `cargo xtask ci`). Linux only: macOS is built and tested only
# by release.yml (the org's macOS runners are kept for releases; craftrules release/playbook.md),
# and Windows/FreeBSD packaging have their own workflows.
name: CI

# Every pull request and every push to main, once the repository is public (GitHub-hosted runners
# are free for public repositories; while it's private, the jobs below are skipped unless started by
# hand, so they cost nothing).
on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  RUST_BACKTRACE: 1
  # Debug and test builds keep line tables (file:line in panic backtraces) but drop the rest of the
  # debug info: faster codegen and links, and a smaller target dir.
  CARGO_PROFILE_DEV_DEBUG: line-tables-only

# A newer push to a PR branch cancels its older run. Runs on main are never cancelled, so every
# main state that gets a run is checked to the end.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    name: test (ubuntu-latest)
    if: github.event_name == 'workflow_dispatch' || !github.event.repository.private
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Linux system dependencies (egui/winit/rfd)
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
            libgl1-mesa-dev libgtk-3-dev

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt

      # Only main saves caches; PRs restore main's, so PR caches don't evict main's.
      - uses: Swatinem/rust-cache@v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-on-failure: true

      - name: Format
        run: cargo fmt --all -- --check

      - name: Clippy
        run: cargo clippy --workspace --all-targets --locked -- -D warnings

      # Every crate's tests run even when one fails, so one failure can't hide another.
      - name: Test
        run: cargo test --workspace --locked --no-fail-fast

      - name: Dependency layering
        run: cargo run --locked -q -p xtask -- layers

      - name: Tool list
        run: cargo run --locked -q -p xtask -- tools --check

      - name: Generated schemas
        run: cargo run --locked -q -p xtask -- schemas --check

      # No keys, tokens, private keys or local paths in what would be committed.
      - name: Secret scan
        run: cargo run --locked -q -p xtask -- secrets

  wasm:
    name: wasm32 check
    if: github.event_name == 'workflow_dispatch' || !github.event.repository.private
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown
      - uses: Swatinem/rust-cache@v2
        with:
          key: wasm32
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-on-failure: true
      # The L0-L2 analysis crates and apps/craft-anything-web must keep compiling for the browser.
      - name: Check wasm-safe crates
        run: cargo run --locked -q -p xtask -- wasm
      - name: Check the web app
        run: cargo check --locked --target wasm32-unknown-unknown -p craft-anything-web