ci.yml

name: CI

on:
  pull_request:
  # Called by the deploy workflow, so nothing reaches production without
  # passing the same checks first.
  workflow_call:

# Deliberately not `on: push` for main. Deploy already calls this workflow, and
# running both put two jobs in the same concurrency group, where one cancelled
# the other and reported it as a cancelled run.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Checking out the code is all this workflow asks of the token. Callers grant no
# more than this, so a reusable-workflow call cannot widen it either.
permissions:
  contents: read

jobs:
  installers:
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7

      - name: Exercise Unix platform routing and checksums
        if: runner.os == 'Linux'
        run: sh scripts/test-installers.sh

      - name: Parse the PowerShell installer
        if: runner.os == 'Windows'
        shell: pwsh
        run: '[scriptblock]::Create((Get-Content -Raw install.ps1)) | Out-Null'

      - name: Test Windows installer architecture detection
        if: runner.os == 'Windows'
        shell: pwsh
        run: ./scripts/test-installers.ps1

  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14

      - name: Install
        run: bun install --frozen-lockfile

      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          components: rustfmt, clippy

      - uses: Swatinem/rust-cache@v2

      - name: Verify generated Rust protocol contract
        run: |
          bun run protocol:rust
          git diff --exit-code -- crates/exeora-cli/protocol crates/exeora-cli/src/generated

      - name: Check CLI
        run: |
          cargo fmt --all -- --check
          cargo clippy --workspace --all-targets -- -D warnings
          cargo test --workspace
          cargo bench --workspace --no-run

      - name: Lint and format
        run: bun run check

      - name: File length
        run: bun run check:file-length

      - name: Typecheck
        run: bun run typecheck

      # The gateway's tests run under workerd, which needs the wrangler config
      # to resolve bindings. It reads .dev.vars for secrets, so a placeholder
      # file is enough: no test touches a real credential.
      - name: Prepare test secrets
        run: |
          cat > apps/gateway/.dev.vars <<'EOF'
          EXEORA_BASE_URL=http://localhost:8787
          GITHUB_CLIENT_ID=ci-placeholder
          GITHUB_CLIENT_SECRET=ci-placeholder
          GOOGLE_CLIENT_ID=ci-placeholder
          GOOGLE_CLIENT_SECRET=ci-placeholder
          COOKIE_SECRET=ci-placeholder-cookie-secret
          REQUEST_STATE_SECRET=ci-placeholder-request-state-secret-32-bytes
          EOF

      # Before the tests, not after: the gateway serves the built site through
      # its ASSETS binding, and the tests that cover that read the real files.
      - name: Build
        run: bun run --cwd apps/web build

      - name: Test
        run: bun run test

  cli-platforms:
    strategy:
      matrix:
        os: [macos-15, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7

      # GitHub-hosted macOS images pre-tap aws/tap. Homebrew 6 requires
      # explicit trust for third-party taps, so every brew call — including
      # `brew install bash` inside setup-rust-toolchain — annotates the job.
      # We do not use that tap; drop it before any brew call.
      - name: Untap unused Homebrew aws/tap
        if: runner.os == 'macOS'
        env:
          HOMEBREW_NO_REQUIRE_TAP_TRUST: "1"
        run: brew untap --force aws/tap || true

      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          components: clippy

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.os }}

      - name: Check native CLI
        run: cargo check --locked -p exeora-cli --all-targets