name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  RUST_BACKTRACE: 1

jobs:
  fmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: Clippy (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.os }}
      - run: cargo clippy --all-targets -- -D warnings

  test:
    name: Tests (${{ matrix.os }} / ${{ matrix.toolchain }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
        # MSRV is 1.92 (bumped from 1.85 when ascii-dag was adopted in
        # mermaid-text 0.14.0). Test stable + the floor.
        toolchain: [stable, "1.92"]
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.toolchain }}
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.os }}-${{ matrix.toolchain }}
      - run: cargo test --workspace

  doc:
    name: Docs
    runs-on: ubuntu-latest
    # Pre-existing intra-doc-link warnings make `-D warnings` too
    # noisy to flip the gate yet. Build docs anyway so a doc-breaking
    # change still surfaces in the log; just don't block PRs on it
    # until the existing warnings are cleaned up.
    continue-on-error: true
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo doc --no-deps --workspace

  deny:
    name: cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check bans licenses sources advisories

  audit:
    name: cargo-audit
    runs-on: ubuntu-latest
    # Advisory hits shouldn't block PRs (transitive deps move on
    # vendor schedules); keep the signal but don't fail the workflow.
    continue-on-error: true
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install cargo-audit
        run: cargo install cargo-audit --locked
      - run: cargo audit
