ci.yml

name: CI

on:
  push:
    branches: [main, master, develop]
  pull_request:
    branches: [main, master, develop]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  detect:
    name: Detect Languages
    runs-on: ubuntu-latest
    outputs:
      has_rust: ${{ steps.detect.outputs.has_rust }}
      has_deny: ${{ steps.detect.outputs.has_deny }}
      has_python: ${{ steps.detect.outputs.has_python }}
      has_go: ${{ steps.detect.outputs.has_go }}
      has_typescript: ${{ steps.detect.outputs.has_typescript }}
      has_security: ${{ steps.detect.outputs.has_security }}
      has_trunk: ${{ steps.detect.outputs.has_trunk }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - id: detect
        run: |
          set +e
          # Initialize all outputs to false (critical: every output must be set)
          echo "has_rust=false" >> $GITHUB_OUTPUT
          echo "has_deny=false" >> $GITHUB_OUTPUT
          echo "has_python=false" >> $GITHUB_OUTPUT
          echo "has_go=false" >> $GITHUB_OUTPUT
          echo "has_typescript=false" >> $GITHUB_OUTPUT
          echo "has_security=false" >> $GITHUB_OUTPUT
          echo "has_trunk=false" >> $GITHUB_OUTPUT

          # Rust: needs Cargo.toml AND deny.toml
          if [ -f "Cargo.toml" ] || [ -f "**/Cargo.toml" ]; then
            echo "has_rust=true" >> $GITHUB_OUTPUT
            if [ -f "deny.toml" ]; then
              echo "has_deny=true" >> $GITHUB_OUTPUT
            fi
          fi

          # Python: needs pyproject.toml, setup.py, requirements.txt, or *.py
          if [ -f "pyproject.toml" ] || [ -f "setup.py" ] || [ -f "requirements.txt" ] || find . -maxdepth 3 -name "*.py" -type f 2>/dev/null | head -1 | grep -q .; then
            echo "has_python=true" >> $GITHUB_OUTPUT
          fi

          # Go: needs go.mod
          if [ -f "go.mod" ]; then
            echo "has_go=true" >> $GITHUB_OUTPUT
          fi

          # TypeScript / JS: needs package.json (with type=module or tsconfig or js files)
          if [ -f "package.json" ]; then
            echo "has_typescript=true" >> $GITHUB_OUTPUT
          fi

          # Security: always run (bandit/gitleaks/dependency-review)
          echo "has_security=true" >> $GITHUB_OUTPUT

          # Trunk: only if trunk.yaml exists
          if [ -f "trunk.yaml" ]; then
            echo "has_trunk=true" >> $GITHUB_OUTPUT
          fi

          echo ""
          echo "=== Detected ==="
          echo "rust=${{ steps.detect.outputs.has_rust }} deny=${{ steps.detect.outputs.has_deny }} python=${{ steps.detect.outputs.has_python }} go=${{ steps.detect.outputs.has_go }} typescript=${{ steps.detect.outputs.has_typescript }} security=${{ steps.detect.outputs.has_security }} trunk=${{ steps.detect.outputs.has_trunk }}"

  rust:
    name: Rust
    needs: detect
    if: needs.detect.outputs.has_rust == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: cargo fmt --check
        run: |
          cargo fmt --all -- --check
      - name: cargo clippy
        run: |
          cargo clippy --all-targets -- -D warnings
      - name: cargo test
        run: |
          cargo test --workspace --no-fail-fast

  cargo-deny:
    name: Cargo Deny (Advisories + Licenses)
    needs: detect
    if: needs.detect.outputs.has_deny == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: cargo-deny check
        # v2 (SHA-pinned, same as rust-ci.yml/cargo-deny.yml): v1 bundles
        # cargo-deny 0.14.21, which cannot parse the current RustSec advisory
        # database (TOML parse error on RUSTSEC-2026-0109).
        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
        with:
          arguments: --all-features

  python:
    name: Python
    needs: detect
    if: needs.detect.outputs.has_python == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Install ruff
        run: pip install ruff
      - name: ruff check
        run: ruff check .
      - name: ruff format --check
        run: ruff format --check .

  go:
    name: Go
    needs: detect
    if: needs.detect.outputs.has_go == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'
      - name: gofmt check
        run: gofmt -l .
      - name: go vet
        run: go vet ./...
      - name: go test
        run: go test ./...

  typescript:
    name: TS/JS
    needs: detect
    if: needs.detect.outputs.has_typescript == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup pnpm
        uses: pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288 # v5
        with:
          run_install: false
      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 22
          cache: pnpm
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: lint
        run: |
          if [ -f package.json ] && grep -q '"lint"' package.json; then
            pnpm run lint
          fi
      - name: test
        run: |
          if [ -f package.json ] && grep -q '"test"' package.json; then
            pnpm run test
          fi

  security:
    name: Security Scan
    needs: detect
    if: needs.detect.outputs.has_security == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # gitleaks-action scans the PR commit range on pull_request events;
          # the default depth-1 checkout lacks the parent commit and makes the
          # git log range fail ("stderr is not empty").
          fetch-depth: 0
      - name: gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  dep-review:
    name: Dependency Review
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: low

  lint:
    name: ci / lint
    if: always()
    needs: [detect, rust, cargo-deny, python, go, typescript, security, dep-review]
    runs-on: ubuntu-latest
    steps:
      - name: Aggregate lint gate
        run: |
          failed=0
          for pair in \
            "rust:${{ needs.rust.result }}" \
            "cargo-deny:${{ needs.cargo-deny.result }}" \
            "python:${{ needs.python.result }}" \
            "go:${{ needs.go.result }}" \
            "typescript:${{ needs.typescript.result }}" \
            "security:${{ needs.security.result }}" \
            "dep-review:${{ needs.dep-review.result }}" \
            ; do
            name="${pair%%:*}"
            result="${pair#*:}"
            if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then
              echo "  ✗ $name: $result"
              failed=$((failed + 1))
            elif [ "$result" = "success" ] || [ "$result" = "skipped" ]; then
              echo "  ✓ $name: $result"
            else
              echo "  ? $name: $result"
            fi
          done
          if [ "$failed" -gt 0 ]; then
            echo ""
            echo "❌ $failed lint check(s) failed"
            exit 1
          fi
          echo ""
          echo "✅ All lint checks passed (or were skipped)"

  test:
    name: ci / test
    if: always()
    needs: [lint]
    runs-on: ubuntu-latest
    steps:
      - name: Test gate
        run: |
          # Test gate is currently combined with lint
          echo "✅ All test stages passed (gated via ci / lint)"