name: ci
on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

# Sibling repos are checked out side by side under $GITHUB_WORKSPACE, as the relative path
# dependencies expect (../kestrove-core). If the repos are private, add a fine-grained token with
# read access to them as the CORE_READ_TOKEN secret; github.token can only read this repository.

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, windows-2025]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with: { path: kestrove-desktop, persist-credentials: false }
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository_owner }}/kestrove-core
          path: kestrove-core
          token: ${{ secrets.CORE_READ_TOKEN || github.token }}
          persist-credentials: false
      - if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libxdo-dev
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10
        with: { toolchain: stable, components: "clippy, rustfmt" }
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with: { workspaces: kestrove-desktop/src-tauri }
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: kestrove-desktop/package-lock.json
      # `npm run build` type-checks (tsc --noEmit) and writes dist/, which tauri::generate_context! embeds.
      - working-directory: kestrove-desktop
        run: |
          npm ci
          npm run build
      - working-directory: kestrove-desktop/src-tauri
        run: |
          cargo fmt --all --check
          cargo clippy --all-targets -- -D warnings
          cargo test

  deny:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with: { path: kestrove-desktop, persist-credentials: false }
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository_owner }}/kestrove-core
          path: kestrove-core
          token: ${{ secrets.CORE_READ_TOKEN || github.token }}
          persist-credentials: false
      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
        with: { command: check, manifest-path: kestrove-desktop/src-tauri/Cargo.toml }
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with: { node-version: 24 }
      - working-directory: kestrove-desktop
        run: npm audit --omit=dev