ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  # Shared cache prefix for better cache reuse across jobs
  CACHE_PREFIX: ci-v1

jobs:
  # ============================================================
  # Fast checks - run first, fail fast on basic issues
  # ============================================================

  fmt:
    name: Formatting
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - name: Check formatting
        run: cargo fmt -- --check

  lockfile:
    name: Cargo.lock Check
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Check Cargo.lock is up to date
        run: cargo check --locked

  unused-deps:
    name: Unused Dependencies
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-machete
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-machete
      - name: Check for unused dependencies
        run: cargo machete

  # ============================================================
  # Code quality warnings - informational only
  # ============================================================

  code-quality:
    name: Code Quality Warnings
    runs-on: ubuntu-latest
    timeout-minutes: 5
    # This job is informational only, doesn't block CI
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4

      - name: Check for TODO/FIXME comments in production code
        run: |
          echo "Scanning for TODO/FIXME comments in src/..."
          # Find TODO/FIXME comments (informational, doesn't fail CI)
          findings=$(grep -rn --include="*.rs" "TODO\|FIXME" src/ || true)
          if [ -n "$findings" ]; then
            echo "::warning::Found TODO/FIXME comments in production code:"
            echo "$findings"
            count=$(echo "$findings" | wc -l)
            echo "::notice::Total: $count TODO/FIXME comments found"
          else
            echo "✅ No TODO/FIXME comments found in production code"
          fi

      - name: Check for large files
        run: |
          echo "Checking for large source files (>500 lines)..."
          # Find files with more than 500 lines
          large_files=$(find src/ -name "*.rs" -exec wc -l {} + | awk '$1 > 500 && !/total$/ {print}' || true)
          if [ -n "$large_files" ]; then
            echo "::warning::Found large source files (>500 lines):"
            echo "$large_files"
          else
            echo "✅ All source files are under 500 lines"
          fi

  # ============================================================
  # Security checks - important for every PR
  # ============================================================

  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: Run security audit
        uses: rustsec/audit-check@v2
        with:
          token: ${{ github.token }}

  deny:
    name: Dependency & License Check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check all
          arguments: --all-features

  # ============================================================
  # Linting - requires build artifacts, shares cache
  # ============================================================

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # Wait for fast checks to pass before spending time on compilation
    needs: [fmt, lockfile]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          shared-key: ${{ env.CACHE_PREFIX }}-clippy
      - name: Clippy (default features)
        run: cargo clippy -- -D warnings
      - name: Clippy (all features)
        run: cargo clippy --all-features -- -D warnings
      - name: Clippy (no features)
        run: cargo clippy --no-default-features -- -D warnings

  # ============================================================
  # Build verification
  # ============================================================

  build:
    name: Build (${{ matrix.build-type }})
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: [fmt, lockfile]
    strategy:
      fail-fast: true  # Fail fast on build errors
      matrix:
        build-type: [debug, release]
        include:
          - build-type: debug
            cargo-flags: ""
          - build-type: release
            cargo-flags: "--release"
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          shared-key: ${{ env.CACHE_PREFIX }}-${{ matrix.build-type }}
      - name: Build (default features)
        run: cargo build ${{ matrix.cargo-flags }}
      - name: Build (all features)
        run: cargo build --all-features ${{ matrix.cargo-flags }}
      - name: Build (no features)
        run: cargo build --no-default-features ${{ matrix.cargo-flags }}

  # ============================================================
  # Windows build verification
  # ============================================================

  build-windows:
    name: Build (Windows)
    runs-on: windows-latest
    timeout-minutes: 25
    needs: [fmt, lockfile]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-pc-windows-msvc
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          shared-key: ${{ env.CACHE_PREFIX }}-windows
      - name: Build (default features)
        run: cargo build --target x86_64-pc-windows-msvc
      - name: Build (all features)
        run: cargo build --all-features --target x86_64-pc-windows-msvc
      - name: Build (no features)
        run: cargo build --no-default-features --target x86_64-pc-windows-msvc
      - name: Check for warnings
        run: cargo check --target x86_64-pc-windows-msvc 2>&1

  # ============================================================
  # Test execution
  # ============================================================

  test:
    name: Tests
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: [fmt, lockfile]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          shared-key: ${{ env.CACHE_PREFIX }}-test
      - name: Run tests (all features)
        run: cargo test --all-features
      - name: Run tests (no features)
        run: cargo test --no-default-features
      # Note: Doc tests require a library target, which this binary-only crate doesn't have

  # ============================================================
  # Documentation
  # ============================================================

  docs:
    name: Documentation
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [fmt, lockfile]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          shared-key: ${{ env.CACHE_PREFIX }}-docs
      - name: Build documentation
        run: cargo doc --all-features --no-deps
        env:
          RUSTDOCFLAGS: -D warnings

  # ============================================================
  # Windows tests - run tests on Windows
  # ============================================================

  test-windows:
    name: Tests (Windows)
    runs-on: windows-latest
    timeout-minutes: 25
    needs: [fmt, lockfile]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-pc-windows-msvc
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          shared-key: ${{ env.CACHE_PREFIX }}-windows-test
      - name: Run tests (all features)
        run: cargo test --all-features --target x86_64-pc-windows-msvc

  # ============================================================
  # Install script tests - verify installers work
  # ============================================================

  test-install-script:
    name: Install Script (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    needs: [fmt, lockfile]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            shell: bash
          - os: windows-latest
            shell: pwsh
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.os == 'windows-latest' && 'x86_64-pc-windows-msvc' || 'x86_64-unknown-linux-gnu' }}
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          shared-key: ${{ env.CACHE_PREFIX }}-install-${{ matrix.os }}

      - name: Build binary
        shell: bash
        run: cargo build --release

      - name: Test one-liner install (Unix)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          export PAPERBOAT_BINARY_PATH="${PWD}/target/release/paperboat"
          export PAPERBOAT_INSTALL_DIR="${PWD}/test-install"
          export PAPERBOAT_VERSION="0.0.0-test"
          export PAPERBOAT_NO_HOMEBREW=1
          mkdir -p "$PAPERBOAT_INSTALL_DIR"

          # Test the actual one-liner syntax (using local file instead of curl)
          # This verifies: exec trick works, sh runs, and iwr part is never reached
          exec sh -c 'sh scripts/install.sh';iwr -useb https://example.com|iex

          # Note: if exec works correctly, we never reach here in this shell
          # The install script runs and exits, then this shell is replaced

      - name: Verify Unix installation
        if: runner.os != 'Windows'
        shell: bash
        run: |
          # Verify installation worked (run in new shell since exec replaced the previous one)
          ./test-install/paperboat --help
          echo "✅ Unix install test passed!"

      - name: Test one-liner install (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $env:PAPERBOAT_BINARY_PATH = "$PWD\target\release\paperboat.exe"
          $env:PAPERBOAT_INSTALL_DIR = "$PWD\test-install"
          $env:PAPERBOAT_VERSION = "0.0.0-test"
          New-Item -ItemType Directory -Path $env:PAPERBOAT_INSTALL_DIR -Force | Out-Null

          # Test the one-liner in a subprocess to simulate interactive shell behavior
          pwsh -NoProfile -Command "exec sh -c 'curl -fsSL https://example.com|sh';& '$PWD\scripts\install.ps1'"

          # Verify installation
          & "$env:PAPERBOAT_INSTALL_DIR\paperboat.exe" --help
          Write-Host "✅ Windows install test passed!"

  # ============================================================
  # Final status check - required for branch protection
  # ============================================================

  ci-success:
    name: CI Success
    runs-on: ubuntu-latest
    needs: [fmt, lockfile, unused-deps, security-audit, deny, clippy, build, build-windows, test, test-windows, test-install-script, docs]
    if: always()
    steps:
      - name: Check all jobs passed
        run: |
          results=(
            "${{ needs.fmt.result }}"
            "${{ needs.lockfile.result }}"
            "${{ needs.unused-deps.result }}"
            "${{ needs.security-audit.result }}"
            "${{ needs.deny.result }}"
            "${{ needs.clippy.result }}"
            "${{ needs.build.result }}"
            "${{ needs.build-windows.result }}"
            "${{ needs.test.result }}"
            "${{ needs.test-windows.result }}"
            "${{ needs.test-install-script.result }}"
            "${{ needs.docs.result }}"
          )
          for result in "${results[@]}"; do
            if [[ "$result" != "success" ]]; then
              echo "❌ One or more jobs failed or were cancelled"
              exit 1
            fi
          done
          echo "✅ All CI jobs passed!"