name: CI

on:
  # Documentation-only or local agent state changes do not trigger CI jobs.
  pull_request:
    paths-ignore: ['**.md', 'docs/**', 'LICENSE*', '.gitignore', '.githooks/**', '.wolf/**', '.claude/**', '.opencode/**', '.codex/**', '.cursor/**', '.superpowers/**', '.superset/**', '.gitea/ISSUE_TEMPLATE/**', 'scripts/release-notes.sh', '.gitea/workflows/release.yml']
  workflow_call:

concurrency:
  group: ci-${{ gitea.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -D warnings
  # The runner persists /opt/hostedtoolcache across jobs: rustup toolchains,
  # cargo registry, npm/apt caches, and target directories live there so nothing
  # is re-downloaded or rebuilt from scratch on every run. Each job uses its own
  # target directory so differing RUSTFLAGS do not invalidate another job's cache.
  CARGO_HOME: /opt/hostedtoolcache/cargo
  RUSTUP_HOME: /opt/hostedtoolcache/rustup
  NPM_CONFIG_CACHE: /opt/hostedtoolcache/npm-cache
  # Prebuilt libduckdb (scripts/fetch-libduckdb.sh), cached on the persistent
  # runner volume. Every CI job runs on linux-arm64.
  DUCKDB_LIB_DIR: /opt/hostedtoolcache/duckdb/linux-arm64
  DUCKDB_INCLUDE_DIR: /opt/hostedtoolcache/duckdb/linux-arm64
  LD_LIBRARY_PATH: /opt/hostedtoolcache/duckdb/linux-arm64

jobs:
  lint:
    name: Format and clippy
    runs-on: linux-arm64
    env:
      CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/acaua-lint
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: actions/setup-node@v7
        with:
          node-version: 22
      - name: UI translation coverage
        run: node scripts/check-ui-i18n.mjs
      - name: Prebuilt libduckdb
        run: |
          command -v unzip >/dev/null || scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/unzip unzip
          scripts/fetch-libduckdb.sh "$DUCKDB_LIB_DIR"
      - run: cargo fmt --all -- --check
      - run: cargo clippy --workspace --all-targets

  # Linux-only runner (ARM64).
  test:
    name: Tests (Linux)
    runs-on: linux-arm64
    env:
      CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/acaua-test
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - name: Prebuilt libduckdb
        run: |
          command -v unzip >/dev/null || scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/unzip unzip
          scripts/fetch-libduckdb.sh "$DUCKDB_LIB_DIR"
      - run: cargo test --workspace

  audit:
    name: Dependency audit
    runs-on: linux-arm64
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      # rustsec/audit-check depends on GitHub's checks API. cargo-audit itself
      # needs nothing but the advisory database, and installing it once into the
      # persistent CARGO_HOME makes every later run skip compilation.
      - name: cargo audit
        run: |
          command -v cargo-audit >/dev/null || cargo install cargo-audit --locked
          cargo audit

  image:
    name: Docker image (build and smoke test)
    if: ${{ gitea.event_name == 'pull_request' }}
    runs-on: linux-arm64
    steps:
      - uses: actions/checkout@v7
      - name: Build
        run: docker build -t "acaua-ci:${{ gitea.run_id }}" .
      - name: Smoke test
        run: scripts/smoke-image.sh "acaua-ci:${{ gitea.run_id }}"
      - name: Clean up
        if: always()
        run: docker rmi -f "acaua-ci:${{ gitea.run_id }}" >/dev/null 2>&1 || true