name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  rust:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4

      - name: Install native dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            pkg-config \
            libfuse3-dev \
            libgtk-4-dev \
            libadwaita-1-dev \
            libwebkitgtk-6.0-dev \
            libsecret-1-dev \
            libdbus-1-dev

      - name: Install minimum supported Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: '1.96'
          components: rustfmt, clippy

      - uses: swatinem/rust-cache@v2

      - name: Formatting
        run: cargo fmt --all -- --check

      - name: Lints
        run: cargo clippy --workspace --all-targets -- -D warnings

      - name: Unit tests
        run: cargo test --workspace --locked

      - name: Account-free filesystem acceptance
        run: scripts/fuse-acceptance.sh --offline-only

      - name: Acceptance runner safety guard
        run: |
          if scripts/fuse-acceptance.sh /tmp >acceptance.out 2>&1; then
            echo "runner unexpectedly accepted a non-FUSE path"
            exit 1
          fi
          grep -q "refusing primary non-FUSE path" acceptance.out

  # Real Proton credentials and /dev/fuse deliberately do not run on pull
  # requests. Follow docs/TESTING.md on a dedicated test-account runner.