name: CI

on:
  push:
    branches: [ main ]
    tags: [ 'v*' ]
  pull_request:
    branches: [ main ]

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        rust:
          - stable
          - beta
          - nightly
    steps:
    - uses: actions/checkout@v6
    - uses: dtolnay/rust-toolchain@master
      with:
        toolchain: ${{ matrix.rust }}
    - uses: Swatinem/rust-cache@v2
    - name: Run tests
      run: cargo test --verbose

  fmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - uses: dtolnay/rust-toolchain@stable
      with:
        components: rustfmt
    - name: Check formatting
      run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - uses: dtolnay/rust-toolchain@stable
      with:
        components: clippy
    - uses: Swatinem/rust-cache@v2
    - name: Run clippy
      run: cargo clippy -- -D warnings

  docs:
    name: Docs
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - uses: dtolnay/rust-toolchain@stable
    - uses: Swatinem/rust-cache@v2
    - name: Build docs
      run: cargo doc --no-deps --document-private-items

  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - uses: dtolnay/rust-toolchain@stable
      with:
        components: llvm-tools-preview
    - uses: Swatinem/rust-cache@v2
    - name: Install cargo-llvm-cov
      uses: taiki-e/install-action@cargo-llvm-cov
    - name: Generate coverage report
      run: cargo llvm-cov --all-features --workspace --codecov --output-path codecov.json --fail-under-lines 30
    - name: Upload to codecov.io
      uses: codecov/codecov-action@v6
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        files: codecov.json
        fail_ci_if_error: true

  nix:
    name: Nix Build
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - uses: cachix/install-nix-action@v31
      with:
        github_access_token: ${{ secrets.GITHUB_TOKEN }}
        extra_nix_config: |
          experimental-features = nix-command flakes
    - uses: cachix/cachix-action@v17
      with:
        name: omni-dev
        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
        extraPullNames: nix-community
        skipPush: ${{ !startsWith(github.ref, 'refs/tags/') }}
    - name: Check Nix flake
      run: nix flake check
    - name: Build with Nix
      run: nix build --no-link
    - name: Test Nix app
      run: nix run . -- --version

  audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - name: Install cargo-audit
      run: cargo install cargo-audit --locked
    - name: Run cargo-audit
      run: cargo audit

  deny:
    name: Dependency Policy
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - uses: EmbarkStudios/cargo-deny-action@v2.0.17
      with:
        command: check all

  secrets:
    name: Secret Scanning
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0
    - name: TruffleHog scan
      uses: trufflesecurity/trufflehog@main
      with:
        extra_args: --only-verified

