ci.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:

# 워크플로우 전체에서 GHCR push (image 잡) 와 pull (다른 잡) 권한이 필요합니다.
permissions:
  contents: read
  packages: write

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -D warnings

jobs:
  # ---------------------------------------------------------------------------
  # CI 베이스 이미지: Dockerfile.ci + rust-toolchain.toml 의 해시를 태그로 사용해
  # 입력이 변하지 않으면 BuildKit GHA 캐시로 재빌드 없이 그대로 재사용합니다.
  # 모든 후속 잡이 이 이미지(`needs: image`)를 컨테이너로 받아 동일 환경에서
  # 실행됩니다 — local Docker 와 CI 동작이 비트 단위로 일치합니다.
  # ---------------------------------------------------------------------------
  image:
    name: build CI image
    runs-on: ubuntu-latest
    # 후속 잡의 `container.image` 는 `env` context 를 평가할 수 없으므로
    # 전체 이미지 경로를 outputs 로 노출합니다. 또한 GHCR 은 레포지토리명에
    # 소문자만 허용하므로 owner 를 소문자화합니다.
    outputs:
      image: ${{ steps.meta.outputs.image }}
      image_latest: ${{ steps.meta.outputs.image_latest }}
    steps:
      - uses: actions/checkout@v4

      - name: compute image tag
        id: meta
        run: |
          OWNER=$(printf '%s' "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
          REPO="ghcr.io/${OWNER}/lumen-ci"
          TAG=$(cat .github/docker/Dockerfile.ci rust-toolchain.toml | sha256sum | cut -c1-16)
          echo "image=${REPO}:${TAG}" >> "$GITHUB_OUTPUT"
          echo "image_latest=${REPO}:latest" >> "$GITHUB_OUTPUT"
          echo "이미지: ${REPO}:${TAG}"

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: build & push CI image
        uses: docker/build-push-action@v6
        with:
          context: .github/docker
          file: .github/docker/Dockerfile.ci
          push: true
          tags: |
            ${{ steps.meta.outputs.image }}
            ${{ steps.meta.outputs.image_latest }}
          cache-from: type=gha,scope=lumen-ci
          cache-to: type=gha,scope=lumen-ci,mode=max

  # ---------------------------------------------------------------------------
  # 빌드 + 테스트 (Linux 컨테이너).
  # ---------------------------------------------------------------------------
  build-test:
    name: build & test (linux)
    needs: image
    runs-on: ubuntu-latest
    container:
      image: ${{ needs.image.outputs.image }}
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2
      - name: cargo build
        run: cargo build --workspace --all-targets --locked
      - name: cargo test
        run: cargo test --workspace --locked
      - name: cargo build (no default features)
        run: cargo build --workspace --no-default-features --locked
      - name: build wasm32 echo-agent
        working-directory: agents/echo-agent
        run: cargo build --release --target wasm32-unknown-unknown --locked

  # ---------------------------------------------------------------------------
  # 빌드 + 테스트 (macOS native).
  # macOS 는 Linux 컨테이너를 지원하지 않으므로 별도 native runner 에서
  # 동일한 toolchain (`rust-toolchain.toml` 이 강제) 으로 검증합니다.
  # ---------------------------------------------------------------------------
  build-test-macos:
    name: build & test (macos)
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - name: install protoc
        run: brew install protobuf
      - uses: Swatinem/rust-cache@v2
      - name: cargo build
        run: cargo build --workspace --all-targets --locked
      - name: cargo test
        run: cargo test --workspace --locked
      - name: cargo build (no default features)
        run: cargo build --workspace --no-default-features --locked
      - name: build wasm32 echo-agent
        working-directory: agents/echo-agent
        run: cargo build --release --target wasm32-unknown-unknown --locked

  # ---------------------------------------------------------------------------
  # 무거운 optional features (halo2, candle).
  # ---------------------------------------------------------------------------
  features:
    name: optional features (halo2, candle)
    needs: image
    runs-on: ubuntu-latest
    container:
      image: ${{ needs.image.outputs.image }}
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2
      - name: cargo build --features halo2
        run: cargo build -p lumen-zkml --features halo2 --locked
      - name: cargo test --features halo2
        run: cargo test -p lumen-zkml --features halo2 --locked
      - name: cargo build --features candle
        run: cargo build -p lumen-inference --features candle --locked

  # ---------------------------------------------------------------------------
  # Lint: clippy + rustfmt.
  # ---------------------------------------------------------------------------
  lint:
    name: clippy & fmt
    needs: image
    runs-on: ubuntu-latest
    container:
      image: ${{ needs.image.outputs.image }}
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2
      - run: cargo fmt --all -- --check
      - run: cargo clippy --workspace --all-targets -- -D warnings

  # ---------------------------------------------------------------------------
  # Rustdoc: 깨진 intra-doc link 거부.
  # ---------------------------------------------------------------------------
  docs:
    name: cargo doc
    needs: image
    runs-on: ubuntu-latest
    container:
      image: ${{ needs.image.outputs.image }}
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    env:
      RUSTDOCFLAGS: -D warnings
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2
      - run: cargo doc --workspace --no-deps --document-private-items

  # ---------------------------------------------------------------------------
  # Supply-chain: license/banned/yanked check (cargo-deny 는 이미지에 사전 설치).
  # ---------------------------------------------------------------------------
  deny:
    name: cargo deny
    needs: image
    runs-on: ubuntu-latest
    container:
      image: ${{ needs.image.outputs.image }}
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - run: cargo deny check

  # ---------------------------------------------------------------------------
  # RustSec advisory audit (cargo-audit 는 이미지에 사전 설치).
  # ---------------------------------------------------------------------------
  audit:
    name: cargo audit
    needs: image
    runs-on: ubuntu-latest
    container:
      image: ${{ needs.image.outputs.image }}
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - run: cargo audit