ci.yml

name: ci

on:
  push:
    branches: [master, release/*]
  pull_request:
    branches: [master, release/*]

permissions:
  contents: read
  pull-requests: write
  actions: read
  id-token: write

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-Dwarnings"

defaults:
  run:
    shell: bash -euo pipefail {0}

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1

      - name: Setup taplo
        uses: uncenter/setup-taplo@4f203fdb4f3b1e289c8382cf90d8397d2338df2e # v1.0.8

      - name: Setup tombi
        uses: tombi-toml/setup-tombi@cebfd308ba02edadfcee148b7473536990950c92 # v1.0.8
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Validate TOML configs and themes with taplo
        run: taplo check

      - name: Validate TOML configs and themes with tombi
        run: tombi lint

      - name: Install latest nightly
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: nightly
          components: rustfmt

      - name: Check formatting
        run: cargo +nightly fmt --check --verbose --all

      - name: markdownlint-cli2-action
        uses: DavidAnson/markdownlint-cli2-action@ce4853d43830c74c1753b39f3cf40f71c2031eb9 # v23.0.0

      - name: Run Check
        run: cargo check --locked --workspace

      - name: Run Clippy
        run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings

      - name: Build
        run: cargo build --locked --workspace --verbose --benches

      - name: Check for uncommitted changes after build
        run: |
          # Ensure that build.rs doesn't produce uncommitted changes
          # This catches cases where:
          # - Theme files are out of sync with schema version
          # - Generated files weren't committed
          # - Build scripts modified source files

          # Check for modified files
          if ! git diff --exit-code; then
            echo "::error::Build produced uncommitted changes to tracked files"
            echo "The following files were modified during build:"
            git diff --name-only
            echo ""
            echo "Diff:"
            git diff
            echo ""
            echo "Please run 'cargo build' locally and commit the changes."
            exit 1
          fi

          # Check for untracked files (excluding target/ and other build artifacts)
          UNTRACKED=$(git ls-files --others --exclude-standard | grep -v '^target/' | grep -v '\.build/' || true)
          if [ -n "$UNTRACKED" ]; then
            echo "::error::Build produced untracked files"
            echo "The following untracked files were created during build:"
            echo "$UNTRACKED"
            echo ""
            echo "Please run 'cargo build' locally and commit any generated files."
            exit 1
          fi

          echo "✓ No uncommitted changes produced by build"

      - name: Run tests
        run: cargo test --locked --workspace --verbose

      - name: Run executable
        run: cargo run --locked

  coverage:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install latest toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1

      - name: Generate code coverage
        run: |
          make coverage

      - name: Upload coverage to codecov.io
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
        with:
          use_oidc: true

  test-nix:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Nix
        uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe # v31.10.3

      - name: Cache Nix store
        uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        with:
          name: hl
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1

      - name: Run nix flake check
        run: nix flake check --print-build-logs --all-systems --no-update-lock-file

      - name: Check Nix formatting
        run: |
          nix fmt --no-update-lock-file
          if ! git diff --exit-code; then
            echo "Nix files are not formatted correctly"
            exit 1
          fi

      - name: Run nix build
        run: nix build --print-build-logs --no-update-lock-file