name: CI

on:
  push:
    branches: [main]
    paths-ignore:
      - '**.md'
      - 'book/**'
      - 'proj_docs/**'
      - 'docs/**'
      - 'LICENSE'
      - '.github/workflows/pages.yml'
  pull_request:
    branches: [main]
    paths-ignore:
      - '**.md'
      - 'book/**'
      - 'proj_docs/**'
      - 'docs/**'
      - 'LICENSE'
      - '.github/workflows/pages.yml'

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -D warnings

jobs:
  test:
    name: test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # Windows is included as the Phase 3 §3 fixture for spec §14 #6
        # (Windows path quirks). Failures here are the canonical signal
        # that std::fs::rename, lockfile semantics, or path resolution
        # need a Windows-specific cfg branch.
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - name: cargo fmt --check
        run: cargo fmt --all -- --check
      - name: cargo clippy
        run: cargo clippy --all-targets --all-features -- -D warnings
      - name: cargo build
        run: cargo build --all-targets
      - name: cargo test
        run: cargo test --all-targets

  deny:
    name: cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check advisories bans licenses sources

  audit:
    name: cargo-audit
    runs-on: ubuntu-latest
    # rustsec/audit-check posts findings as a GitHub check-run annotation,
    # which requires `checks: write`. Without it the action errors out at
    # the end even when the advisories list is acceptable.
    permissions:
      contents: read
      checks: write
    steps:
      - uses: actions/checkout@v4
      - uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # Same two transitive deps cargo-deny already ignores in
          # deny.toml — `atomic-polyfill` and `paste` are upstream-
          # archived but carry no security vulnerability. Keep the two
          # tools in sync so they don't disagree.
          ignore: RUSTSEC-2023-0089,RUSTSEC-2024-0436
