name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  rust:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7

      - name: Install native dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            pkg-config \
            libfuse3-dev \
            libgtk-4-dev \
            libadwaita-1-dev \
            libwebkitgtk-6.0-dev \
            libsecret-1-dev \
            libdbus-1-dev

      - name: Install minimum supported Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: '1.96'
          components: rustfmt, clippy
          cache: false

      # Tags can only restore caches saved on main, so only main saves one. The
      # release workflow restores this key for its quality gates.
      - uses: swatinem/rust-cache@v2
        with:
          shared-key: debug
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Formatting
        run: cargo fmt --all -- --check

      - name: Lints
        run: cargo clippy --workspace --all-targets -- -D warnings

      - name: Unit tests
        run: cargo test --workspace --locked

      - name: Account-free filesystem acceptance
        run: scripts/fuse-acceptance.sh --offline-only

      - name: Acceptance runner safety guard
        run: |
          if scripts/fuse-acceptance.sh /tmp >acceptance.out 2>&1; then
            echo "runner unexpectedly accepted a non-FUSE path"
            exit 1
          fi
          grep -q "refusing primary non-FUSE path" acceptance.out

  # Real Proton credentials and /dev/fuse deliberately do not run on pull
  # requests. Follow docs/TESTING.md on a dedicated test-account runner.

  # The seeded simulation runs (docs/TESTING.md): real FUSE
  # daemons against an in-memory Drive, so they need /dev/fuse but no account.
  simulation:
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-24.04
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v7

      - name: Install native dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            pkg-config \
            fuse3 \
            libfuse3-dev \
            libgtk-4-dev \
            libadwaita-1-dev \
            libwebkitgtk-6.0-dev \
            libsecret-1-dev \
            libdbus-1-dev

      - name: Install minimum supported Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: '1.96'
          cache: false

      - uses: swatinem/rust-cache@v2
        with:
          shared-key: debug
          save-if: false

      - name: Simulation runs
        run: 'cargo test -p pdfs-fuse --lib --locked sim:: -- --ignored --test-threads=1'

      # A hung step writes every daemon thread's stack next to the run's
      # state; without them a hang that does not replay cannot be told apart.
      - name: Keep the stacks of a hung run
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: simulation-stacks
          path: /tmp/pdfs-sim-*/stacks.txt
          if-no-files-found: ignore

  # Keeps the release-profile dependencies cached on main, where the release
  # workflow can restore them; a tag cannot reuse the caches of earlier tags.
  release-cache:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@v7

      - name: Install native dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            pkg-config \
            libfuse3-dev \
            libgtk-4-dev \
            libadwaita-1-dev \
            libwebkitgtk-6.0-dev \
            libsecret-1-dev \
            libdbus-1-dev

      - name: Install minimum supported Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: '1.96'
          cache: false

      - uses: swatinem/rust-cache@v2
        with:
          shared-key: release

      - name: Release build
        run: cargo build --release --locked