tuliprox/.github/workflows/ci.yaml

name: CI

on:
  # push:
  #   branches: []
  pull_request:
    branches: [develop, experimental]

# Avoid running the same CI multiple times for the same PR
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Job 1: Check Markdown files
  markdown:
    name: Markdown Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Lint Markdown files
        uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
        with:
          globs: '**/*.md'

  # Job 2: Check code style (very fast)
  style:
    name: Format & Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Nightly Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
        with:
          toolchain: nightly-2026-09-21
          components: rustfmt, clippy

      - name: Check Formatting
        # This now works with cargo +nightly fmt
        run: make fmt-check

      - name: Check workspace architecture
        run: make architecture-check

      - name: Lint with Clippy
        run: make lint

      - name: Validate native Docker workspace skeleton
        run: docker build --target workspace-skeleton -f docker/Dockerfile .

      - name: Validate cross Docker workspace skeleton
        run: docker build --target rust-toolchain -f docker/cross.Dockerfile .

  docs:
    name: Documentation Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install mdBook
        uses: taiki-e/install-action@9114bf4d891761788c546334fd37538eae1bf8b3 # v2.87.16
        with:
          tool: mdbook

      - name: Build documentation
        run: make docs

  frontend:
    name: Frontend Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Rust Tools
        uses: taiki-e/install-action@9114bf4d891761788c546334fd37538eae1bf8b3 # v2.87.16
        with:
          tool: trunk,wasm-bindgen-cli,mdbook

      - name: Install Stable Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
        with:
          toolchain: stable
          targets: wasm32-unknown-unknown

      - name: Rust Cache
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          cache-targets: "true"

      - name: Install wasm tools 128
        run: |
          chmod +x ./bin/install_wasm_tools.sh
          WASM_TOOLS_BIN="$(./bin/install_wasm_tools.sh 128)"
          echo "${WASM_TOOLS_BIN}" >> "$GITHUB_PATH"

      - name: Build frontend with wasm-opt
        run: |
          chmod +x ./bin/build_docs.sh ./bin/build_fe.sh
          ./bin/build_fe.sh release

  windows:
    name: Windows Build
    runs-on: windows-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Stable Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
        with:
          toolchain: stable

      - name: Rust Cache
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      # `--all-targets` also compiles the test modules, so Unix-only test
      # helpers and imports must stay behind `#[cfg(unix)]`.
      - name: Check Windows build
        run: cargo check --workspace --all-targets

  # Job 3: Build and Test (takes longer)
  test:
    name: Build & Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Stable Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
        with:
          toolchain: stable

      - name: Rust Cache
        # This magic step saves compiled dependencies between runs
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      - name: Run Tests
        run: make test

  admission:
    name: Admission & Provider Lifecycle
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Stable Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
        with:
          toolchain: stable

      - name: Rust Cache
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      - name: Verify admission and provider lifecycle invariants
        run: make admission-test

  testkit:
    name: Testkit Unit & E2E Scenarios
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Stable Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
        with:
          toolchain: stable

      - name: Rust Cache
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      - name: Run Testkit Unit Tests
        run: make testkit-test

      - name: Run Testkit E2E Scenarios
        run: make testkit-e2e

      - name: Upload Testkit Reports
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: testkit-report
          path: testkit-report/