name: CI

on:
  push:
    branches: [main]
  pull_request:

# Least privilege: CI only needs to read the repo.
permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Prove the artifact the way a future maintainer meets it: clean checkout ->
  # bootstrap -> the full gate, on every supported platform.
  check:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy, llvm-tools-preview
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@v2
        with:
          tool: just,nextest,cargo-llvm-cov,shellcheck
      - name: Bootstrap
        run: just bootstrap
      - name: Full gate (fmt, clippy, tests, coverage, build, smoke)
        run: just check

  # Advisory + license audit, on its own because it needs a network advisory DB.
  deny:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-deny
      - run: cargo deny check
