ci.yml

name: CI
on:
  pull_request:
jobs:
  checks:
    runs-on: ubuntu-latest
    # Read-only: this job runs the broadly-executed prek hooks (including unpinned `npx`
    # invocations and lychee/zizmor's tokened online checks), so it must not hold a
    # write-scoped token. The PR coverage comment lives in the separate `coverage-comment`
    # job below, which is the only place that needs `pull-requests: write`.
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d

      - name: Install prek
        run: uv tool install prek --force

      - name: Install yamllint
        run: |-
          uv tool install yamllint --force
          yamllint --version

      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6

      - name: Install Rust components
        run: rustup component add rustfmt clippy llvm-tools-preview

      - name: Install cargo-nextest
        uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8
        with:
          tool: cargo-nextest

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8
        with:
          tool: cargo-llvm-cov

      - name: Install cargo-audit
        uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8
        with:
          tool: cargo-audit

      # Needed by the prek `comment-ratio` hook (source_size.py gate). tokei has no
      # prebuilt release binary and is not in taiki-e/install-action, so install the
      # same conda-forge build run locally via pixi; bump the pin alongside AGENTS.md.
      - name: Install tokei
        uses: prefix-dev/setup-pixi@d3f436a425481402e6a95a1d1fc10331c708cd9e
        with:
          run-install: false
          global-environments: tokei=14.0.0
      - name: Put pixi global tools on PATH
        run: echo "$HOME/.pixi/bin" >> "$GITHUB_PATH"

      - name: Run prek hooks (lint and static checks)
        env:
          SKIP: no-commit-to-branch
          # lychee's external link checks (and zizmor's online supply-chain audits)
          # call the GitHub API; the token avoids anonymous rate limits.
          GITHUB_TOKEN: ${{ github.token }}
        run: prek run --all-files

      - name: Check the minimal build (LSP feature compiled out)
        run: cargo clippy --all-targets --no-default-features -- -D warnings

      - name: Validate the agent skill (skills/ryl)
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh skill publish --dry-run

      - name: Run tests with coverage (nextest + cargo-llvm-cov)
        run: |-
          set -euo pipefail
          # Run the suite once; every report below is derived from this single run's
          # cached profile data via `cargo llvm-cov report` (no re-execution).
          cargo llvm-cov nextest --no-report
          echo '### Test Coverage (nextest + cargo-llvm-cov)' > coverage.md
          echo '```text' >> coverage.md
          cargo llvm-cov report --summary-only | tee -a coverage.md
          echo '```' >> coverage.md
          # Produce LCOV for detailed per-line/branch analysis
          cargo llvm-cov report --lcov --output-path lcov.info
          echo '' >> coverage.md
          echo '#### Missed Lines (per file)' >> coverage.md
          awk -F: '
            /^SF:/ {f=$2}
            /^DA:/ {split($2,a,","); if (a[2]==0) lines[f]=lines[f] a[1] ","}
            END {
              for (f in lines) {
                gsub(/,$/, "", lines[f]);
                printf("- %s: %s\n", f, lines[f]);
              }
            }
          ' lcov.info | sort >> coverage.md || true
          echo '' >> coverage.md
          if grep -q '^BRDA:' lcov.info; then
            echo '#### Missed Branches (per file)' >> coverage.md
            awk -F: '
              /^SF:/ {f=$2}
              /^BRDA:/ {
                split($2,a,",");
                # a[4] is taken count; treat 0 or - as missed
                if (a[4]=="-" || a[4]==0) {
                  branches[f]=branches[f] sprintf("%s(b%s)", a[1], a[3]) ",";
                }
              }
              END {
                for (f in branches) {
                  gsub(/,$/, "", branches[f]);
                  printf("- %s: %s\n", f, branches[f]);
                }
              }
            ' lcov.info | sort >> coverage.md || true
          fi

      - name: Upload coverage artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: coverage
          path: |-
            coverage.md
            lcov.info

      - name: Enforce coverage thresholds
        run: |-
          # Enforce zero missed lines and regions, reusing the single test run's data.
          # Kept as the final step so the coverage artifact is uploaded (and the
          # coverage-comment job can post it) before a coverage gap fails the job.
          cargo llvm-cov report --summary-only \
            --fail-uncovered-lines 0 \
            --fail-uncovered-regions 0

  coverage-comment:
    # Posting the coverage comment needs `pull-requests: write`, so it is isolated here,
    # keeping the `checks` job (and every prek hook it runs) read-only. Runs even when
    # `checks` fails (e.g. a coverage-threshold gap) so the report is still posted; the
    # artifact only exists when the run got far enough to produce coverage, so the comment
    # step is guarded on that.
    needs: checks
    if: ${{ !cancelled() && !github.event.pull_request.head.repo.fork }}
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - name: Download coverage artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: coverage
        continue-on-error: true

      - name: Comment coverage summary on PR
        if: hashFiles('coverage.md') != ''
        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88
        with:
          header: ryl-coverage
          path: coverage.md