# The CI gate. Runs inside the prebuilt nix toolchain image (built + pushed by
# build-ci-image.yaml), so the pinned 1.95.0 toolchain is already warm — steps
# just enter the flake devShell and run cargo.
#
# Gate = fmt + clippy + test. The fmt gate (`cargo fmt --check`, stock defaults)
# was enabled once the tree was reformatted on main (ADR-ci-002 Amendment 1 /
# issue #35). The release job (static binary for D2) and the platform matrix
# layer on later, step by step.
#
# A separate, lightweight `manifests` job logic-tests the package-manifest
# render scripts (Scoop/Homebrew) used by publish.yaml — bash + node only, no
# toolchain — so a render regression surfaces on the breaking push rather than
# weeks later at the next manual publish dispatch (ADR-0056 Amendment 2).
name: ci
on:
  push:
    # Only `main` (the post-merge gate + canonical branch). Feature branches
    # are gated via `pull_request` instead. Running both on a push to a PR'd
    # branch was pure duplication on Gitea: unlike GitHub it has no merge-
    # preview ref — its `pull_request` checks out `refs/pull/N/head`, the same
    # commit a branch push would, so the two runs were byte-identical
    # (docs.gitea.com/usage/actions/faq). Gating on `pull_request` is also
    # forward-compatible: if Gitea ever adds the merge ref, these runs upgrade
    # to testing the merged result for free. Tags stay unmatched (release.yaml
    # owns them).
    branches: [main]
    # Skip the gate for changes that can't affect clippy/test — docs, markdown,
    # and the website subproject (it has its own workflow, website.yaml, that
    # builds + publishes it). A push touching crate code *and* these still runs
    # (paths-ignore only skips when *all* changed files match).
    # Note: flake/toolchain changes are NOT ignored — they can shift the
    # toolchain and thus lint/test outcomes.
    paths-ignore:
      - 'docs/**'
      - '**/*.md'
      - 'website/**'
      - '.gitea/workflows/website.yaml'
  pull_request:
    paths-ignore:
      - 'docs/**'
      - '**/*.md'
      - 'website/**'
      - '.gitea/workflows/website.yaml'

jobs:
  gate:
    runs-on: ci-public
    # Public package → anonymous pull, no credentials needed.
    container:
      image: git.lazyeval.net/oli/rdbms-playground-ci:latest
    steps:
      - uses: actions/checkout@v4
      - name: fmt (check, stock defaults)
        run: nix develop -c cargo fmt --check
      - name: clippy (warnings denied)
        run: nix develop -c cargo clippy --all-targets -- -D warnings
      - name: test
        run: nix develop -c cargo test --no-fail-fast

  # Logic test for the package-manifest render scripts. Renders with DUMMY
  # inputs and validates the output — it never publishes or touches the lazyeval
  # repos (that is publish.yaml's manual job). Runs on the same image but skips
  # nix: it needs only bash + node, both in the base image.
  #
  # NOTE: the CI image has no ruby, so the script's `ruby -c` formula syntax
  # check is skipped here (it degrades gracefully); the Scoop JSON is still
  # validated with node and both manifests' fields are asserted. Full formula
  # syntax is checked dev-side (ruby present) on every pre-commit local run.
  manifests:
    runs-on: ci-public
    container:
      image: git.lazyeval.net/oli/rdbms-playground-ci:latest
    steps:
      - uses: actions/checkout@v4
      - name: render-script tests (Scoop + Homebrew)
        run: bash scripts/test-package-renders.sh