name: CI

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always

jobs:
  # Pull requests that only touch Markdown or docs/ skip the build jobs (they still report, as
  # skipped). Pushes to main and manual runs always run everything.
  changes:
    name: Select checks
    runs-on: ubuntu-24.04
    outputs:
      code: ${{ steps.paths.outputs.code }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - id: paths
        name: Detect code changes
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          if [ "$EVENT_NAME" != "pull_request" ]; then
            echo "code=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          changed=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
          code=false
          while IFS= read -r f; do
            case "$f" in
              docs/features.md) code=true ;;
              *.md|docs/*) ;;
              "") ;;
              *) code=true ;;
            esac
          done <<< "$changed"
          echo "code=$code" >> "$GITHUB_OUTPUT"
          echo "code changes: $code"

  ci:
    name: cargo xtask ci
    needs: changes
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
          targets: wasm32-unknown-unknown
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - run: cargo xtask ci

  advisories:
    name: Dependency advisories and sources
    needs: changes
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-deny
        run: cargo install cargo-deny --version 0.20.2 --locked
      - run: cargo deny --locked check --warn unmaintained advisories bans sources