name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  CI: 1

jobs:
  check:
    name: Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - name: Check
        run: cargo check --all-targets
      - name: Clippy
        run: cargo clippy -- -D warnings
      - name: Format
        run: cargo fmt --all -- --check

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Test
        run: cargo test

  audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-audit
        run: cargo install cargo-audit --locked
      - name: Run audit
        # RUSTSEC-2026-0009: time < 0.3.47 via tauri — ignored until tauri releases a fix
        run: cargo audit --ignore RUSTSEC-2026-0009

  sbom:
    name: Generate SBOM
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-cyclonedx
        run: cargo install cargo-cyclonedx --locked
      - name: Generate SBOM
        run: cargo cyclonedx -f json
      - uses: actions/upload-artifact@v7
        with:
          name: sbom
          path: "*.cdx.json"
