name: CI

# Pipeline: ci + coverage (in parallel) must pass, then release on a v* tag.
# ARM-first: the agent runs on a Raspberry Pi (aarch64 Linux); macOS is Apple Silicon (also ARM).
on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:

env:
  CARGO_TERM_COLOR: always

jobs:
  ci:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04-arm, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - name: Format
        run: cargo fmt --all -- --check
      - name: Clippy
        run: cargo clippy --all-targets -- -D warnings
      - name: Test
        run: cargo test --all

  coverage:
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview
      - uses: Swatinem/rust-cache@v2
      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov
      - name: Generate coverage
        run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
      - name: Upload to Codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          fail_ci_if_error: false

  # Runs only on a v* tag, and only after ci + coverage succeed.
  release:
    needs: [ci, coverage]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      # Idempotent: `cargo publish` can exit non-zero AFTER a successful upload (a transient
      # post-upload index refresh — e.g. an HTTP2 framing error downloading config.json), and a
      # re-run hits "already exists". Treat an already-published version as success so a transient
      # blip never blocks the GitHub Release + binaries below; any OTHER error still fails the job.
      # The stderr capture lives in $RUNNER_TEMP, NOT the worktree: a publish.err written beside the
      # crate would make `cargo publish`'s own clean-tree check fail ("files not yet committed").
      - name: Publish to crates.io
        run: |
          err="$RUNNER_TEMP/publish.err"
          if cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }} 2>"$err"; then
            cat "$err" >&2
          elif grep -q "already exists" "$err"; then
            cat "$err" >&2
            echo "note: ${GITHUB_REF_NAME} is already on crates.io — treating as success (idempotent re-run / post-upload transient)."
          else
            cat "$err" >&2; exit 1
          fi
      # The published tag becomes a GitHub Release — the single source of truth for
      # what each version shipped. Notes are generated from the commits since the
      # previous tag, so no release history is restated in the docs. Idempotent: skip if the
      # Release already exists (a re-run, or a manually-created Release).
      - name: Create GitHub Release
        run: gh release view "${GITHUB_REF_NAME}" >/dev/null 2>&1 || gh release create "${GITHUB_REF_NAME}" --verify-tag --generate-notes
        env:
          GH_TOKEN: ${{ github.token }}

  # Attach prebuilt static binaries to the GitHub Release so ev drops onto a host with no Rust/C
  # toolchain (the aarch64-linux-musl asset runs on any glibc — e.g. a Raspberry Pi on Debian).
  # Runs after `release` so the Release (with notes) already exists. ev is pure-Rust + no-network,
  # so the musl static builds have no C dependency to vendor.
  release-binaries:
    needs: [release]
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          # aarch64 musl is cross-compiled from an x86_64 host via `cross` (its canonical path);
          # building it on an ARM host makes `cross` mis-detect the host toolchain and fail.
          - target: aarch64-unknown-linux-musl
            os: ubuntu-24.04
          - target: x86_64-unknown-linux-musl
            os: ubuntu-24.04
          - target: aarch64-apple-darwin
            os: macos-latest
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
      - uses: taiki-e/upload-rust-binary-action@v1
        with:
          bin: ev
          target: ${{ matrix.target }}
          archive: ev-$tag-$target
          token: ${{ github.token }}
