ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  schedule:
    - cron: '0 0 * * 0'  # Weekly dependency check

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  RUST_BACKTRACE: short
  RUSTFLAGS: "-D warnings"
  RUSTUP_MAX_RETRIES: 10

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      rust: ${{ steps.filter.outputs.rust }}
      workflows: ${{ steps.filter.outputs.workflows }}
    steps:
      - uses: actions/checkout@v6

      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            rust:
              - '**/*.rs'
              - '**/Cargo.toml'
              - '**/Cargo.lock'
              - 'rust-toolchain.toml'
              - 'deny.toml'
            workflows:
              - '.github/workflows/**'

  fmt:
    name: Format
    needs: changes
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v6

      - uses: moonrepo/setup-rust@v1
        with:
          channel: nightly
          components: rustfmt
          cache: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check formatting
        run: cargo +nightly fmt --all -- --check

  check:
    name: Check
    needs: changes
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6

      - uses: moonrepo/setup-rust@v1
        with:
          components: clippy
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Clippy
        run: cargo clippy --workspace --all-targets --all-features -- -D warnings

      - name: Check documentation
        run: cargo doc --workspace --no-deps --all-features
        env:
          RUSTDOCFLAGS: "-D warnings"

  security:
    name: Security Audit
    needs: changes
    if: needs.changes.outputs.rust == 'true' || github.event_name == 'schedule'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@v6

      - name: Install cargo-deny
        uses: taiki-e/install-action@cargo-deny

      - name: Run cargo-deny
        run: cargo deny check

  test:
    name: Test (${{ matrix.os }}${{ matrix.target && format(' / {0}', matrix.target) || '' }})
    needs: [changes, fmt, check]
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        rust: [stable]
        include:
          - os: ubuntu-latest
            rust: beta
          - os: windows-latest
            rust: stable
            target: aarch64-pc-windows-msvc
            cross: true

    steps:
      - uses: actions/checkout@v6

      - uses: moonrepo/setup-rust@v1
        with:
          channel: ${{ matrix.rust }}
          targets: ${{ matrix.target }}
          bins: cargo-nextest
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Install dependencies (Ubuntu)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y libssl-dev pkg-config

      - name: Run tests
        if: ${{ !matrix.cross }}
        run: cargo nextest run --workspace --all-features --no-fail-fast

      - name: Run doctests
        if: ${{ !matrix.cross }}
        run: cargo test --workspace --doc --all-features

      - name: Build for cross-compile target
        if: ${{ matrix.cross }}
        run: cargo build --workspace --target ${{ matrix.target }}

  coverage:
    name: Code Coverage
    needs: [changes, fmt, check]
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6

      - uses: moonrepo/setup-rust@v1
        with:
          bins: cargo-llvm-cov,cargo-nextest
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate coverage
        run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info nextest

      - name: Upload coverage
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          fail_ci_if_error: false
          verbose: true

      - name: Archive coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: lcov.info
          retention-days: 30

  msrv:
    name: Check MSRV
    needs: [changes, fmt, check]
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6

      - name: Read MSRV from Cargo.toml
        id: msrv
        run: |
          MSRV=$(grep '^rust-version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
          echo "version=$MSRV" >> $GITHUB_OUTPUT

      - uses: moonrepo/setup-rust@v1
        with:
          channel: ${{ steps.msrv.outputs.version }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check with MSRV
        run: cargo check --workspace --all-features

  wasm:
    name: WASM Build (Zed Extension)
    needs: [changes, fmt, check]
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true

      - uses: moonrepo/setup-rust@v1
        with:
          targets: wasm32-wasip1
          cache-target: release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Zed extension
        working-directory: crates/deps-zed
        run: cargo build --target wasm32-wasip1 --release

      - name: Check WASM size
        run: |
          ls -lh crates/deps-zed/target/wasm32-wasip1/release/*.wasm
          du -sh crates/deps-zed/target/wasm32-wasip1/release/*.wasm

  benchmark:
    name: Check Benchmarks
    needs: [changes, fmt, check]
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6

      - uses: moonrepo/setup-rust@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Build benchmarks
        run: cargo build --workspace --benches

  release-check:
    name: Release Build Check
    needs: [test]
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6

      - uses: moonrepo/setup-rust@v1
        with:
          cache-target: release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Build release
        run: cargo build --workspace --release --all-features

      - name: Check binary size
        run: |
          ls -lh target/release/
          du -sh target/release/

  ci-success:
    name: CI Success
    needs: [changes, fmt, check, security, test, coverage, msrv, wasm, benchmark]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Check all jobs
        run: |
          if [[ "${{ needs.changes.outputs.rust }}" != "true" && "${{ needs.changes.outputs.workflows }}" != "true" ]]; then
            echo "No relevant changes - skipped jobs are OK"
            exit 0
          fi

          check_job() {
            local result="$1"
            local name="$2"
            if [[ "$result" == "failure" || "$result" == "cancelled" ]]; then
              echo "Job $name failed: $result"
              return 1
            fi
            return 0
          }

          failed=0
          check_job "${{ needs.fmt.result }}" "fmt" || failed=1
          check_job "${{ needs.check.result }}" "check" || failed=1
          check_job "${{ needs.security.result }}" "security" || failed=1
          check_job "${{ needs.test.result }}" "test" || failed=1
          check_job "${{ needs.coverage.result }}" "coverage" || failed=1
          check_job "${{ needs.msrv.result }}" "msrv" || failed=1
          check_job "${{ needs.wasm.result }}" "wasm" || failed=1
          check_job "${{ needs.benchmark.result }}" "benchmark" || failed=1

          if [[ $failed -eq 1 ]]; then
            echo "One or more jobs failed"
            exit 1
          fi
          echo "All jobs passed successfully!"