name: CI

# Quality gates for every push to main and every pull request (`cargo xtask ci`), through the
# suite's shared gate workflow in craft-common-actions. Nightly fuzzing is in fuzz.yml.
on:
  push:
    branches: [main]
  pull_request:
    # `labeled` so that adding `full-ci` to an open PR starts a run with Windows in it.
    types: [opened, synchronize, reopened, labeled]
  workflow_dispatch:

# The token is only used to check out the code: no job writes to the repository.
permissions:
  contents: read

# A newer push to a PR branch cancels its older run; every push to main runs to the end. Adding
# any label but `full-ci` gets a group of its own, so it neither runs the gate nor cancels a run.
concurrency:
  group: ci-${{ github.event_name == 'pull_request' && (github.event.action != 'labeled' || github.event.label.name == 'full-ci') && github.ref || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # The shared gate doesn't check where git dependencies come from; release.yml runs the same job.
  git-sources:
    if: github.event.action != 'labeled' || github.event.label.name == 'full-ci'
    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
    uses: storytold/craft-common-actions/.github/workflows/git-sources.yml@main

  gate:
    if: github.event.action != 'labeled' || github.event.label.name == 'full-ci'
    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
    with:
      # Windows on main, manual runs and pull requests labelled `full-ci`. No macOS on PRs or main:
      # the org's 5 macOS slots are kept for release builds, and release.yml builds macOS.
      os: ${{ (github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'full-ci')) && '["ubuntu-24.04","windows-latest"]' || '["ubuntu-24.04"]' }}
      # Same craft-fonts commit as release.yml and freebsd.yml.
      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
      # egui/winit/rfd, and the independent oracles (crates/oracle).
      packages: >-
        libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev
        libgtk-3-dev qpdf poppler-utils
      # cargo-deny for the deny step of `cargo xtask ci`, which requires it under CI.
      tools: cargo-nextest@0.9.150,cargo-deny@0.20.2
      # A missing oracle fails the job instead of printing a skip notice that reads as a pass.
      linux-env: PDFCRAFT_ORACLES_REQUIRED=1
      windows-env: PDFCRAFT_REQUIRE_WINRES=1
      # Windows checks what differs by platform: the build (with resources) and the tests.
      windows-command: |
        cargo clippy --workspace --all-targets --locked -- -D warnings
        cargo test --workspace --locked