name: CI

# CI runs once per merge on `develop`, the trunk (AGENTS.md, "Workflow for every change"): the core
# team's pull requests are checked locally on the crates they touch and merged; a red trunk is
# fixed forward. `main` holds released code only (docs/releasing.md).
# Pull requests from forks (outside contributors) run the full gate, once the maintainer approves
# the run, so the review sees it; so do Dependabot's (.github/dependabot.yml), which nobody tests
# locally. The heavy job stays off pull requests.
on:
  pull_request:
    paths:
      - '**'
      - '!**/*.md'
      - '!docs/**'
      - 'docs/features.md'
      - 'docs/oracle.md'
  push:
    branches: [develop]
    # A merge that only touches prose starts no run. The generated pages are checked by the jobs
    # (features.md by `cargo xtask ci`, oracle.md by the oracle job), so they still count.
    # (Later patterns override earlier ones.)
    paths:
      - '**'
      - '!**/*.md'
      - '!docs/**'
      - 'docs/features.md'
      - 'docs/oracle.md'
  schedule:
    # Nightly, on the default branch (develop): the heavy tests.
    - cron: '23 3 * * *'
    # Weekly: the oracle on macOS too, so results that differ by platform show up in CI (the
    # fixtures are often blessed on a Mac; #115).
    - cron: '41 4 * * 0'
  workflow_dispatch:

permissions:
  contents: read

# A newer merge cancels the run still going for the one before it, so a burst of merges is tested
# once, at the tip. Nightly and manual runs are grouped apart and never cancelled by a merge.
concurrency:
  group: ci-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always

jobs:
  ci:
    name: cargo xtask ci
    if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
          targets: wasm32-unknown-unknown
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          save-if: ${{ github.ref == 'refs/heads/develop' }}
      # A dependency update changes THIRD-PARTY-LICENSES.txt, which Dependabot cannot regenerate:
      # regenerate it here so the gate checks everything else, and dependabot-licences.yml commits
      # it to the pull request.
      - name: Regenerate THIRD-PARTY-LICENSES.txt (Dependabot)
        if: github.event.pull_request.user.login == 'dependabot[bot]'
        run: cargo xtask licences
      - run: cargo xtask ci

  heavy:
    # The heavy verification and corpus tests (#[ignore]d) and the doc tests.
    name: cargo xtask test --heavy
    if: github.event.schedule != '41 4 * * 0' && github.event_name != 'pull_request'
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          save-if: ${{ github.ref == 'refs/heads/develop' }}
      - run: cargo xtask test --heavy

  oracle:
    # Verification and validation (docs/verification.md): every case against its reference and
    # its fixture, and docs/oracle.md must be the table the cases produce. Cases marked `slow`
    # run here too while the whole set stays within a few minutes; `--quick` skips them.
    name: cargo xtask oracle
    if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: oracle
          save-if: ${{ github.ref == 'refs/heads/develop' }}
      - run: cargo xtask oracle
      - name: docs/oracle.md is current
        run: git diff --exit-code docs/oracle.md

  oracle-macos:
    # The same oracle on macOS, weekly and on demand: the solvers must agree across platforms
    # to the fixture bands, and docs/oracle.md must read the same.
    name: cargo xtask oracle (macOS)
    if: github.event.schedule == '41 4 * * 0' || github.event_name == 'workflow_dispatch'
    runs-on: macos-14
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: oracle-macos
          save-if: ${{ github.ref == 'refs/heads/develop' }}
      - run: cargo xtask oracle
      - name: docs/oracle.md is current
        run: git diff --exit-code docs/oracle.md

  advisories:
    name: Dependency advisories and sources
    if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-deny
        run: cargo install cargo-deny --version 0.20.2 --locked
      - run: cargo deny --locked check --warn unmaintained advisories bans sources