name: CI

# CI runs once per merge, on main (AGENTS.md, "Workflow for every change"): the core team's pull
# requests are checked locally on the crates they touch and merged; a red main is fixed forward.
# Pull requests from forks (outside contributors) run the full gate, once the maintainer approves
# the run, so the review sees it.
on:
  pull_request:
    paths:
      - '**'
      - '!**/*.md'
      - '!docs/**'
      - 'docs/features.md'
      - 'docs/oracle.md'
  push:
    branches: [main]
    # A merge that only touches prose starts no run. The generated pages are checked by the jobs
    # (features.md by `cargo xtask ci`, oracle.md by the oracle job), so they still count.
    # (Later patterns override earlier ones.)
    paths:
      - '**'
      - '!**/*.md'
      - '!docs/**'
      - 'docs/features.md'
      - 'docs/oracle.md'
  schedule:
    # Nightly: the heavy tests on main.
    - cron: '23 3 * * *'
  workflow_dispatch:

permissions:
  contents: read

# A newer merge cancels the run still going for the one before it, so a burst of merges is tested
# once, at the tip. Nightly and manual runs are grouped apart and never cancelled by a merge.
concurrency:
  group: ci-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always

jobs:
  ci:
    name: cargo xtask ci
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
          targets: wasm32-unknown-unknown
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - run: cargo xtask ci

  heavy:
    # The heavy verification and corpus tests (#[ignore]d) and the doc tests.
    name: cargo xtask test --heavy
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - run: cargo xtask test --heavy

  oracle:
    # Verification and validation (docs/verification.md): every case against its reference and
    # its fixture, and docs/oracle.md must be the table the cases produce. Cases marked `slow`
    # run here too while the whole set stays within a few minutes; `--quick` skips them.
    name: cargo xtask oracle
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: oracle
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - run: cargo xtask oracle
      - name: docs/oracle.md is current
        run: git diff --exit-code docs/oracle.md

  advisories:
    name: Dependency advisories and sources
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-deny
        run: cargo install cargo-deny --version 0.20.2 --locked
      - run: cargo deny --locked check --warn unmaintained advisories bans sources