name: CI

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "0 3 * * 1" # weekly audit even without pushes

env:
  CARGO_TERM_COLOR: always

jobs:
  check:
    # macOS runner: the keychain (apple-native) and LocalAuthentication paths
    # only compile there. Touch ID / live-server tests are #[ignore]d, so the
    # default suite is CI-safe: no prompts, no network.
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - name: Format
        run: cargo fmt --check
      - name: Clippy
        run: cargo clippy --locked --all-targets -- -D warnings
      - name: Test
        run: cargo test --locked
      - name: Build (release)
        run: cargo build --locked --release

  audit:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install cargo-audit
        run: cargo install cargo-audit --locked
      - name: Audit
        run: cargo audit
