name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  lint:
    name: Lint (${{ matrix.linter }})
    runs-on: ubuntu-latest
    strategy:
      matrix:
        linter: [rust, bash, nickel, nushell, markdown]
    steps:
      - uses: actions/checkout@v4

      - name: Install just
        uses: extractions/setup-just@v1

      - name: Install Rust toolchain
        if: matrix.linter == 'rust'
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Install shellcheck
        if: matrix.linter == 'bash'
        run: sudo apt-get install -y shellcheck

      - name: Install Nickel
        if: matrix.linter == 'nickel'
        run: |
          cargo install nickel-lang-cli
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH

      - name: Install Nushell
        if: matrix.linter == 'nushell'
        run: |
          cargo install nu
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH

      - name: Install markdownlint
        if: matrix.linter == 'markdown'
        run: npm install -g markdownlint-cli2

      - name: Run linter
        run: just dev::lint-${{ matrix.linter }}

  coverage:
    name: Code Coverage
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview
      - uses: extractions/setup-just@v1
      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov
      - name: Generate coverage
        run: just dev::coverage-ci
      - name: Upload to Codecov
        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          fail_ci_if_error: true

  test:
    name: Test (${{ matrix.os }})
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - uses: extractions/setup-just@v1
      - name: Run tests
        run: just ci::test-all

  build:
    name: Build (${{ matrix.os }})
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    needs: test
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - uses: extractions/setup-just@v1
      - name: Build release
        run: just ci::build-release

  benchmark:
    name: Benchmark
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: extractions/setup-just@v1
      - name: Run benchmarks
        run: just dev::bench

  security:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-audit
        run: cargo install cargo-audit --locked
      - name: Run security audit
        run: cargo audit

  compliance:
    name: License Compliance
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-deny
        run: cargo install cargo-deny --locked
      - name: Check licenses
        run: cargo deny check licenses
