# CI — consumes brefwiz/ci-workflows composite actions via local checkout.
#
# Why the double-checkout: this Gitea instance has "require sign-in to view"
# enabled, so the runner's auto-issued job token can't git-fetch ci-workflows
# even though it's internal. Each job pre-checks-out ci-workflows with
# PACKAGE_READER_TOKEN, then uses it via local path.

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
  schedule:
    - cron: "0 6 * * 1"   # weekly Monday 06:00 UTC — surfaces expired allowlist entries and new advisories

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

permissions:
  contents: write
  pull-requests: write

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: "1"
  CARGO_INCREMENTAL: "0"
  ZSTD_NBTHREADS: "0"
  CARGO_NET_GIT_FETCH_WITH_CLI: "true"

jobs:
  # ==========================================================================
  # format
  # ==========================================================================
  format:
    name: Code Formatting
    runs-on: brefwiz
    container:
      image: harbor.brefwiz.com/brefwiz/ci:latest
      options: --user root
      credentials:
        username: ${{ secrets.HARBOR_USER }}
        password: ${{ secrets.HARBOR_TOKEN }}
    env:
      CARGO_REGISTRIES_BREFWIZ_TOKEN: "Bearer ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: brefwiz/ci-workflows
          ref: main
          path: .ci-workflows
          token: ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}
      - uses: ./.ci-workflows/.gitea/actions/fmt
        with:
          checkout: "false"

  # ==========================================================================
  # clippy
  # ==========================================================================
  clippy:
    name: Lint
    runs-on: brefwiz
    container:
      image: harbor.brefwiz.com/brefwiz/ci:latest
      options: --user root -v /var/cache/sccache:/var/cache/sccache
      credentials:
        username: ${{ secrets.HARBOR_USER }}
        password: ${{ secrets.HARBOR_TOKEN }}
    env:
      RUSTC_WRAPPER: sccache
      CARGO_REGISTRIES_BREFWIZ_TOKEN: "Bearer ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: brefwiz/ci-workflows
          ref: main
          path: .ci-workflows
          token: ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}
      - uses: ./.ci-workflows/.gitea/actions/clippy
        with:
          checkout: "false"

  # ==========================================================================
  # audit
  # ==========================================================================
  audit:
    name: Security Audit
    runs-on: brefwiz
    container:
      image: harbor.brefwiz.com/brefwiz/ci:latest
      options: --user root
      credentials:
        username: ${{ secrets.HARBOR_USER }}
        password: ${{ secrets.HARBOR_TOKEN }}
    env:
      CARGO_REGISTRIES_BREFWIZ_TOKEN: "Bearer ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: brefwiz/ci-workflows
          ref: main
          path: .ci-workflows
          token: ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}
      - uses: ./.ci-workflows/.gitea/actions/audit
        with:
          checkout: "false"
          policies-token: ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}

  # ==========================================================================
  # deny
  # ==========================================================================
  deny:
    name: Dependency License Audit
    runs-on: brefwiz
    container:
      image: harbor.brefwiz.com/brefwiz/ci:latest
      options: --user root
      credentials:
        username: ${{ secrets.HARBOR_USER }}
        password: ${{ secrets.HARBOR_TOKEN }}
    env:
      CARGO_REGISTRIES_BREFWIZ_TOKEN: "Bearer ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: brefwiz/ci-workflows
          ref: main
          path: .ci-workflows
          token: ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}
      - uses: ./.ci-workflows/.gitea/actions/deny
        with:
          checkout: "false"
          policies-token: ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}

  # ==========================================================================
  # coverage — runs all tests; no separate test job needed.
  # groundwork has no DB integration tests so no postgres/redis sidecars.
  # ==========================================================================
  coverage:
    name: Test Coverage
    runs-on: brefwiz
    container:
      image: harbor.brefwiz.com/brefwiz/ci:latest
      options: --user root -v /var/cache/sccache:/var/cache/sccache
      credentials:
        username: ${{ secrets.HARBOR_USER }}
        password: ${{ secrets.HARBOR_TOKEN }}
    env:
      RUSTC_WRAPPER: sccache
      CARGO_REGISTRIES_BREFWIZ_TOKEN: "Bearer ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: brefwiz/ci-workflows
          ref: main
          path: .ci-workflows
          token: ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}
      - uses: ./.ci-workflows/.gitea/actions/coverage
        with:
          checkout: "false"
      - name: Coverage summary
        if: always()
        run: |
          {
            echo "### 📊 Coverage Report"
            echo ""
            echo "\`\`\`"
            cargo llvm-cov report --summary-only 2>/dev/null || echo "(report unavailable)"
            echo "\`\`\`"
          } >> "$GITHUB_STEP_SUMMARY"

  # ==========================================================================
  # cargo-package — verify the crate packages cleanly before publish.
  # ==========================================================================
  cargo-package:
    name: Cargo Package Validation
    runs-on: brefwiz
    container:
      image: harbor.brefwiz.com/brefwiz/ci:latest
      options: --user root
      credentials:
        username: ${{ secrets.HARBOR_USER }}
        password: ${{ secrets.HARBOR_TOKEN }}
    env:
      CARGO_REGISTRIES_BREFWIZ_TOKEN: "Bearer ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: brefwiz/ci-workflows
          ref: main
          path: .ci-workflows
          token: ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}
      - uses: ./.ci-workflows/.gitea/actions/cargo-package
        with:
          checkout: "false"

  # ==========================================================================
  # auto-tag — push semver tag on green main; release.yml fires from the tag.
  # ==========================================================================
  auto-tag:
    name: Auto-tag release
    needs: [format, clippy, audit, deny, coverage, cargo-package]
    if: >-
      ${{
        always() &&
        !contains(needs.*.result, 'failure') &&
        !contains(needs.*.result, 'cancelled') &&
        github.event_name == 'push' &&
        github.ref == 'refs/heads/main'
      }}
    runs-on: brefwiz
    container:
      image: harbor.brefwiz.com/brefwiz/ci:latest
      options: --user root
      credentials:
        username: ${{ secrets.HARBOR_USER }}
        password: ${{ secrets.HARBOR_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.PACKAGE_PUBLISHER_TOKEN }}
      - uses: actions/checkout@v4
        with:
          repository: brefwiz/ci-workflows
          ref: main
          path: .ci-workflows
          token: ${{ secrets.PACKAGE_READER_TOKEN || secrets.PACKAGE_PUBLISHER_TOKEN }}
      - uses: ./.ci-workflows/.gitea/actions/auto-tag
        with:
          checkout: "false"
          gitea-token: ${{ secrets.PACKAGE_PUBLISHER_TOKEN }}
