name: ci

on:
  push:
  pull_request:

env:
  CARGO_TERM_COLOR: always

jobs:
  secret-scan:
    name: secret scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: key / seed material
        run: ./tools/secret-scan.sh
      - name: gitleaks (full history)
        run: |
          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz \
            | tar -xz gitleaks
          sudo mv gitleaks /usr/local/bin/
          gitleaks detect --no-banner --redact --source .

  openapi-drift:
    name: openapi drift gate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Regenerate the spec; fail if it drifts from committed openapi.json
        run: |
          cargo run --quiet --bin gen_openapi > /tmp/openapi.json
          diff openapi.json /tmp/openapi.json

  console-drift:
    name: operator console drift gate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      # Rebuild the admin-ui bundle from source (npm ci = reproducible from the
      # lockfile) and fail if the committed admin-ui/dist drifts. rust-embed bakes
      # dist into the server binary, so a stale dist would silently ship an old
      # console. Same guarantee the openapi-drift job gives the API client.
      - name: Rebuild admin-ui; fail if dist drifts from committed
        working-directory: admin-ui
        run: |
          npm ci
          npm run build
      - name: git diff (dist must be committed and current)
        run: git diff --exit-code -- admin-ui/dist

  rust:
    name: fmt / clippy / build / test / doc-test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo fmt --all -- --check
      - run: cargo clippy --all-targets -- -D warnings
      - run: cargo build --all-targets --locked
      - run: cargo test --locked
      - run: cargo test --doc

  integration:
    name: integration (postgres)
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: smirk
          POSTGRES_PASSWORD: smirk
          POSTGRES_DB: smirk_test
        ports: ['5432:5432']
        options: >-
          --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
    env:
      # Fundless L1 harness: a throwaway DB. The harness sets its own non-secret
      # test JWT/peppers internally.
      TEST_DATABASE_URL: postgres://smirk:smirk@localhost:5432/smirk_test
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --locked --test auth_flow --test db_queries

  supply-chain:
    name: cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: EmbarkStudios/cargo-deny-action@v2