# Gitea Actions CI for ltk.
#
# Runs on every push and pull request against `master`. Two independent
# jobs share the cache layer but otherwise execute in parallel:
#
#  - `test`  builds the workspace and runs the full test corpus.
#  - `audit` runs `cargo audit` against the RustSec advisory database to
#    catch dependency CVEs without waiting for a human to remember to run
#    it locally.
#
# Note: ltk uses Modified Allman style (not rustfmt's default), so there
# is no `cargo fmt --check` step here on purpose. If rustfmt ever ships
# a stable Allman config, add a third `fmt` job.
#
# Compatible syntax with GitHub Actions, so swapping host providers does
# not require touching this file. Gitea also reads `.github/workflows/`
# by default, but `.gitea/workflows/` is preferred for clarity.

name: CI

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

env:
  CARGO_TERM_COLOR: always
  # Surface the MSRV that `Cargo.toml` declares so the runner pins the
  # toolchain to the same version the package is published against.
  RUST_TOOLCHAIN: "1.85"

jobs:
  test:
    name: build + test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install system dependencies
        # ltk links against Wayland / EGL / xkbcommon at compile time
        # through smithay-client-toolkit, wayland-egl and khronos-egl.
        # The runner image does not ship these headers by default.
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libwayland-dev libegl-dev libxkbcommon-dev pkg-config

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Cache cargo registry and target
        uses: Swatinem/rust-cache@v2

      - name: Build
        run: cargo build --workspace --all-targets

      - name: Test
        run: cargo test --workspace --all-targets

      # External-Markdown doctests. `cargo test --doc` only sees doctests
      # inside `src/`; the cookbook and widget reference under `docs/`
      # are stand-alone Markdown files that rustdoc has to be invoked
      # against directly. The script discovers the freshly-built rlib
      # from the `Build` step's `target/debug/` and runs `rustdoc --test`
      # over each `.md`. Snippets are `no_run` so this only typechecks —
      # the goal is to catch API drift, not integration-test the runtime.
      - name: Markdown doctests
        run: ./scripts/doctest-md.sh

  audit:
    name: cargo audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-audit
        # `--locked` so the audit tool itself does not pick up an
        # advisory-affected transitive dep at install time.
        run: cargo install cargo-audit --locked

      - name: Run cargo audit
        # Default behaviour: fail on any active advisory. Add
        # `--ignore RUSTSEC-...` here for advisories that have a
        # documented mitigation upstream we cannot avoid yet.
        run: cargo audit