name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Default to no permissions — every job declares its own least-privilege
# scopes (OSS_SPEC §10.3).
permissions: {}

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@1.88.0
        with:
          components: clippy, rustfmt
      - run: cargo build --all-targets
      - run: cargo test --all
      - run: cargo clippy --all-targets -- -D warnings
      - run: cargo fmt --all -- --check

  # Lint workflow YAML with actionlint and shell scripts with
  # shellcheck. Catches invalid action pins, bad expressions,
  # quoting bugs, and SC-class issues in `scripts/*.sh` before
  # they hit `main`. (shellcheck is preinstalled on ubuntu-latest.)
  shell-lint:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
      - name: Install actionlint
        run: |
          bash <(curl -sSfL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
          echo "${PWD}" >> "$GITHUB_PATH"
      - name: make actionlint
        run: make actionlint
      - name: make shellcheck
        run: make shellcheck
