name: CI

on:
  push:
    branches: [master]
  pull_request:

jobs:
  build:
    runs-on: rust-ci
    steps:
      - uses: actions/checkout@v4

      - name: Cache cargo registry and build artifacts
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            cargo-${{ runner.os }}-

      - name: Cache sccache compilation objects
        uses: actions/cache@v4
        with:
          path: /root/.cache/sccache
          # Not keyed to Cargo.lock: sccache caches individual compiler
          # invocations by content hash, so it should accumulate across
          # dependency bumps rather than reset like the target/ cache above.
          key: sccache-${{ runner.os }}-${{ github.run_id }}
          restore-keys: |
            sccache-${{ runner.os }}-

      - name: Format check
        run: cargo fmt --check

      - name: Clippy
        run: cargo clippy --all-targets -- -D warnings

      # Cognitive complexity (clippy nursery lint — see clippy.toml for why
      # not literal cyclomatic complexity), bin target only so test code's
      # naturally higher complexity isn't gated on this.
      - name: Complexity
        run: cargo clippy --bins -- -D warnings -W clippy::cognitive_complexity

      - name: Check release profile compiles
        run: cargo check --release

  test:
    needs: build
    runs-on: rust-ci
    steps:
      - uses: actions/checkout@v4

      - name: Cache cargo registry and build artifacts
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            cargo-${{ runner.os }}-

      - name: Cache sccache compilation objects
        uses: actions/cache@v4
        with:
          path: /root/.cache/sccache
          key: sccache-${{ runner.os }}-${{ github.run_id }}
          restore-keys: |
            sccache-${{ runner.os }}-

      - name: Test
        run: cargo test

  coverage:
    needs: build
    runs-on: rust-ci
    steps:
      - uses: actions/checkout@v4

      - name: Cache cargo registry and build artifacts
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            cargo-${{ runner.os }}-

      - name: Cache sccache compilation objects
        uses: actions/cache@v4
        with:
          path: /root/.cache/sccache
          key: sccache-${{ runner.os }}-${{ github.run_id }}
          restore-keys: |
            sccache-${{ runner.os }}-

      # cargo-llvm-cov and llvm-tools-preview are baked into the rust-ci
      # image (see docker/rust-ci in infrastructure).
      # Reports coverage only — no --fail-under-lines yet. main.rs is
      # excluded: thin argv dispatch exercised by the real end-to-end
      # `cargo run`, not unit tests, so it's not a meaningful signal here.
      # See Makefile.toml > coverage-report for why pipeline.rs, despite
      # being mostly untestable I/O orchestration too, stays included.
      - name: Coverage
        run: cargo llvm-cov --ignore-filename-regex 'main\.rs' --summary-only

  audit:
    needs: test
    runs-on: rust-ci
    steps:
      - uses: actions/checkout@v4

      - name: cargo audit
        run: cargo audit