ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

# One run per ref; newer pushes cancel older in-progress CI.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  # The exact local gate: fmt + clippy -D warnings + test, over
  # the full workspace (which includes the Tauri GUI crate) on Linux + macOS.
  #
  # `[Meta]` changes touch only repo metadata (docs stubs, labels, CI plumbing)
  # and skip the whole gate: a PR whose title starts with `[Meta]`, or a push
  # whose head-commit message starts with `[Meta]`. The `if:` guards below are
  # shared verbatim by every job.
  rust:
    name: rust (${{ matrix.os }})
    if: >-
      !(
        (github.event_name == 'pull_request' &&
         startsWith(github.event.pull_request.title, '[Meta]')) ||
        (github.event_name == 'push' &&
         startsWith(github.event.head_commit.message, '[Meta]'))
      )
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # macos-14 = Apple Silicon. ubuntu-22.04-arm gates the arm64 Linux leg
        # the release builds natively (free GitHub-hosted arm64 runner), so the
        # shipped arm64 .deb is test-covered, not built blind.
        os: [ubuntu-22.04, ubuntu-22.04-arm, macos-14]
    steps:
      - uses: actions/checkout@v4

      # The GUI crate links GTK/WebKit/etc., so `clippy/test --workspace` needs
      # the -dev packages on Linux. macOS uses system frameworks (nothing extra).
      - name: Install Linux GUI build deps
        if: runner.os == 'Linux'
        uses: ./.github/actions/install-gui-deps

      # Toolchain comes from rust-toolchain.toml (1.96.0 + clippy + rustfmt);
      # rustup installs it on first use.
      - name: Show toolchain
        run: rustup show active-toolchain

      - uses: Swatinem/rust-cache@v2

      - name: Format
        if: runner.os == 'Linux'
        run: cargo fmt --all --check

      - name: Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

      - name: Test
        run: cargo test --workspace

      # The Arch package builds the daemon with `--features yerdd/pacman`, which
      # default `--workspace` never exercises — so lint + test that path too
      # (the `PkgFormat::Pacman` selection arm + the cfg-gated stage_update
      # fixtures). Linux-only: it's where the Arch package ships, and the arm64
      # leg also covers the aarch64 selection arm. Mirrors the release `arch`
      # job's build flag so a feature-gated break fails on push, not at tag time.
      - name: Clippy + test (pacman feature)
        if: runner.os == 'Linux'
        run: |
          cargo clippy -p yerdd -p yerd-update --features yerdd/pacman \
            --all-targets -- -D warnings
          cargo test -p yerdd -p yerd-update --features yerdd/pacman

      # The Fedora package builds the daemon with `--features yerdd/rpm`, which
      # default `--workspace` never exercises (the `PkgFormat::Rpm` selection arm +
      # the cfg-gated stage_update fixtures). Mirrors the pacman step above; both
      # matrix arches run it, so the aarch64 selection arm is covered too.
      - name: Clippy + test (rpm feature)
        if: runner.os == 'Linux'
        run: |
          cargo clippy -p yerdd -p yerd-update --features yerdd/rpm \
            --all-targets -- -D warnings
          cargo test -p yerdd -p yerd-update --features yerdd/rpm

      # The `pacman` and `rpm` self-update features are mutually exclusive; enabling
      # both must fail to compile (the `compile_error!` guard in yerd-update). An
      # explicit guard, not a bare `! cargo build` (which `set -e` ignores unless it
      # is the block's terminal command).
      - name: Assert pacman + rpm features are mutually exclusive
        if: runner.os == 'Linux'
        run: |
          if cargo build -p yerdd --features yerdd/pacman,yerdd/rpm 2>/dev/null; then
            echo "::error::yerdd with both pacman and rpm features must not compile"
            exit 1
          fi
          echo "OK: pacman+rpm correctly refuses to compile"

  # Frontend unit/component tests + production build (type-check via vue-tsc).
  frontend:
    name: frontend
    if: >-
      !(
        (github.event_name == 'pull_request' &&
         startsWith(github.event.pull_request.title, '[Meta]')) ||
        (github.event_name == 'push' &&
         startsWith(github.event.head_commit.message, '[Meta]'))
      )
    runs-on: ubuntu-22.04
    defaults:
      run:
        working-directory: apps/yerd-gui
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: apps/yerd-gui/package-lock.json

      - name: Install deps
        run: npm ci

      - name: Test
        run: npm run test

      - name: Build
        run: npm run build

  # Documentation site (VitePress) production build — runs in parallel with the
  # rust and frontend jobs (no `needs:`), so a docs break fails the PR on its own.
  docs:
    name: docs
    if: >-
      !(
        (github.event_name == 'pull_request' &&
         startsWith(github.event.pull_request.title, '[Meta]')) ||
        (github.event_name == 'push' &&
         startsWith(github.event.head_commit.message, '[Meta]'))
      )
    runs-on: ubuntu-22.04
    defaults:
      run:
        working-directory: docs
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: docs/package-lock.json

      - name: Install deps
        run: npm ci

      - name: Build
        run: npm run build