ci.yml

name: CI

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

env:
  CARGO_HTTP_MULTIPLEXING: "false"
  CARGO_NET_RETRY: "10"

jobs:
  fmt:
    name: cargo fmt
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Check formatting
        run: cargo fmt --check

  clippy:
    name: cargo clippy
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Run clippy
        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings

  supply-chain:
    name: cargo audit
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      CARGO_AUDIT_VERSION: "0.22.2"
    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Restore cargo-audit
        id: cargo-audit-cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.cargo/bin/cargo-audit
          key: cargo-audit-${{ runner.os }}-${{ env.CARGO_AUDIT_VERSION }}
      - name: Install cargo-audit
        if: steps.cargo-audit-cache.outputs.cache-hit != 'true'
        run: cargo install cargo-audit --version "$CARGO_AUDIT_VERSION" --locked
      - name: Run Rust advisory scan
        shell: bash
        run: |
          time_features="$(cargo tree -e features -i time --locked)"
          if grep -q 'time feature "parsing"' <<<"$time_features"; then
            echo "time parsing is enabled; RUSTSEC-2026-0009 must not be ignored" >&2
            exit 1
          fi
          cargo audit --ignore RUSTSEC-2026-0009

  publish-dry-run:
    name: cargo publish dry-run
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Verify crates.io package
        run: cargo publish --dry-run --locked
      - name: Enforce crates.io package size limit
        shell: bash
        run: |
          set -euo pipefail
          cargo package --locked --no-verify
          crate_path="$(find target/package -maxdepth 1 -type f -name 'codebase-graph-*.crate' -print -quit)"
          test -n "$crate_path"
          cargo run -p xtask -- verify-crate-size "$crate_path"
      - name: Verify Knowledge Wiki package archive
        run: cargo package -p k-wiki --locked --no-verify --config 'patch.crates-io.codebase-graph.path="."'

  native:
    name: native (${{ matrix.target }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: linux-x86_64
            run-tests: true
          - target: macos-arm64
            run-tests: true
          - target: macos-x86_64
            run-tests: false
          - target: windows-x86_64
            run-tests: true
    uses: ./.github/workflows/native.yml
    with:
      target: ${{ matrix.target }}
      source-sha: ${{ github.sha }}
      run-tests: ${{ matrix.run-tests }}
      upload-artifact: ${{ github.event_name == 'push' }}
      artifact-retention-days: 90

  required:
    name: required
    if: ${{ always() }}
    needs:
      - fmt
      - clippy
      - supply-chain
      - publish-dry-run
      - native
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Require every mandatory job
        env:
          RESULTS: ${{ toJSON(needs) }}
        shell: bash
        run: |
          set -euo pipefail
          if jq -e 'to_entries | any(.value.result != "success")' <<<"$RESULTS" >/dev/null; then
            echo "$RESULTS"
            exit 1
          fi