ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  # Only cancel a SUPERSEDED PR run (newer commit on the same PR). NEVER cancel a
  # push-to-main run: main is the ONLY branch that writes the shared rust-cache
  # (see save-if below), so a cancelled main run leaves the cache cold/stale and
  # every later PR pays a full rebuild. Matches coverage.yml's reasoning.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  # sqlx compile-time-checked queries (M1+). CI does not have a live DB;
  # checked queries resolve against the committed `.sqlx/` cache instead.
  # Regenerated locally with `cargo sqlx prepare --workspace`.
  SQLX_OFFLINE: "true"
  # CI-only: no debuginfo in the dev profile. PDB generation dominates MSVC
  # link time (each `--all-targets` test binary links separately), and CI never
  # attaches a debugger - panics still name the failing test via RUST_BACKTRACE.
  # Set as an env override (not Cargo.toml) so LOCAL builds keep full debuginfo.
  # chaos.yml sets the SAME value: both workflows share the per-OS "workspace"
  # rust-cache key, and a differing debug level would fork every fingerprint and
  # thrash that shared cache.
  CARGO_PROFILE_DEV_DEBUG: "0"

jobs:
  rust-fmt:
    name: rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with: { components: rustfmt }
      - run: cargo fmt --all -- --check

  rust-test:
    name: cargo test + clippy (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v7
      # NOTE: do not add `Add-MpPreference` build-dir exclusions here. #161 did,
      # on the theory that Defender's real-time scan was taxing the target/ writes
      # and the rust-cache untar. It isn't: `Get-MpComputerStatus` on the
      # windows-latest image reports RealTimeProtectionEnabled=False (measured on
      # PR #175 - AntivirusEnabled=True, but the on-access scanner is off), so the
      # exclusions were a no-op that cost ~8.5s per windows job. The real #161 win
      # came from CARGO_PROFILE_DEV_DEBUG=0 and dropping clippy off windows/macos.
      - uses: dtolnay/rust-toolchain@stable
        with: { components: clippy }
      - name: Install Linux Tauri deps
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libxdo-dev libssl-dev \
            libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev javascriptcoregtk-4.1
      - uses: Swatinem/rust-cache@v2
        with:
          # Share ONE dependency cache (per-OS) across the jobs that compile the
          # workspace in the normal dev profile: this rust-test job plus the two
          # chaos jobs. `--workspace --all-targets` here is the superset build, so
          # whichever runs first on main warms a cache the others reuse, instead of
          # each job hoarding its own ~0.8 GiB copy.
          shared-key: "workspace"
          # Only `main` writes caches; PRs are restore-only. A PR-event cache is
          # scoped to that PR's ref and can't be read by main or other PRs, so
          # saving it just burns the repo cache budget and evicts the reusable
          # main caches. PRs still RESTORE the main cache normally.
          save-if: ${{ github.ref == 'refs/heads/main' }}
      # The S3 backend's integration suite (crates/driven-s3/tests/s3_e2e.rs)
      # spawns a local MinIO and runs a real round trip against it: upload,
      # multipart with the executor's exact chunking, download, listing, the
      # remote-existence audit, delete. Without the binary the test gate-skips,
      # which is honest but leaves the backend's whole I/O surface unexercised in
      # CI. One ~100 MB download on ONE runner buys continuous verification of a
      # backup destination, which is worth more than the seconds it costs.
      # macOS/Windows still gate-skip: the suite is server-behaviour coverage,
      # not platform coverage.
      - name: Install MinIO (S3 backend integration tests)
        if: matrix.os == 'ubuntu-latest'
        run: |
          curl -fsSL https://dl.min.io/server/minio/release/linux-amd64/minio -o /tmp/minio
          sudo install -m 0755 /tmp/minio /usr/local/bin/minio
          minio --version
      - name: cargo build (compile-only)
        run: cargo build --workspace --all-targets
      # Clippy findings are lint-level and platform-independent in practice;
      # running it on all three OSes tripled the cost of an entire extra check
      # pass for zero unique signal, and windows-latest paid the most for it.
      # The job NAME keeps the os suffix on every OS so the required status
      # checks ("cargo test + clippy (<os>)") continue to match.
      - name: cargo clippy
        if: matrix.os == 'ubuntu-latest'
        run: cargo clippy --workspace --all-targets -- -D warnings
      - name: cargo test
        run: cargo test --workspace

  ui-build:
    name: ui build + lint + unit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
        with: { version: 10 }
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: ui/pnpm-lock.yaml
      - name: pnpm install
        working-directory: ui
        run: pnpm install --frozen-lockfile
      - name: lint
        working-directory: ui
        run: pnpm lint
      - name: prettier --check
        working-directory: ui
        run: pnpm format:check
      - name: test:unit
        working-directory: ui
        run: pnpm test:unit
      - name: build
        working-directory: ui
        run: pnpm build

  tauri-compile:
    name: tauri compile (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v7
      # No Defender exclusion step - see the note in rust-test above.
      - uses: dtolnay/rust-toolchain@stable
      - uses: pnpm/action-setup@v6
        with: { version: 10 }
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: ui/pnpm-lock.yaml
      - name: Install Linux Tauri deps
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libxdo-dev libssl-dev \
            libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev javascriptcoregtk-4.1
      # src-tauri is a member of the ROOT cargo workspace, so `cargo tauri build`
      # writes all compile artifacts to the root `target/`, NOT `src-tauri/target`.
      # The old `workspaces: src-tauri` cached the wrong (near-empty, ~128MB) dir, so
      # every run was a cold ~7min rebuild. Default workspace (`.` -> ./target) caches
      # the real artifacts. prefix-key bumped to v1 to force past the stale v0 fossil
      # cache (a full key-match would restore it and skip the corrected save).
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: "v1-rust"
          # Restore-only on PRs; only main warms this cache (see rust-test above).
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: pnpm install
        working-directory: ui
        run: pnpm install --frozen-lockfile
      - name: ui build
        working-directory: ui
        run: pnpm build
      - name: Install tauri-cli
        run: cargo install tauri-cli --version "^2" --locked
      - name: cargo tauri build --debug --no-bundle
        run: cargo tauri build --debug --no-bundle

  cargo-deny:
    name: cargo deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check
          arguments: --all-features