ci.yml

name: CI

on:
  push:
    branches: [main]
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - 'mkdocs.yml'
      - '.github/workflows/docs.yml'
      - '.github/workflows/mkdocs-preview.yml'
      - '.github/workflows/test.yml'
      - '.github/workflows/rmw-zenoh-rs.yml'
      - '.github/workflows/semantic-pr.yml'
      - '.github/workflows/pr-draft-check.yml'
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    branches: [main]
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - 'mkdocs.yml'
      - '.github/workflows/docs.yml'
      - '.github/workflows/mkdocs-preview.yml'
      - '.github/workflows/test.yml'
      - '.github/workflows/rmw-zenoh-rs.yml'
      - '.github/workflows/semantic-pr.yml'
      - '.github/workflows/pr-draft-check.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  formatting:
    name: Check Formatting
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            extra-substituters = https://hiroz.cachix.org
            extra-trusted-public-keys = hiroz.cachix.org-1:wKJuqEckTG0DL3Df7Ly9OVsg5S5TGBHtvlPGs+vlqrY=

      - name: Setup Cachix
        uses: cachix/cachix-action@v15
        with:
          name: hiroz
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          skipPush: ${{ github.event_name == 'pull_request' }}

      - name: Check formatting
        run: nix build .#checks.x86_64-linux.pre-commit-check -L

  no-ros-test:
    name: ROS-independent Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # Linux-specific setup
      - name: Free Disk Space (Ubuntu)
        if: runner.os == 'Linux'
        uses: jlumbroso/free-disk-space@main
        with:
          large-packages: true
          tool-cache: true
          android: true
          dotnet: true
          haskell: true
          docker-images: true
          swap-storage: false

      - name: Install Nix (Linux)
        if: runner.os == 'Linux'
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            extra-substituters = https://hiroz.cachix.org
            extra-trusted-public-keys = hiroz.cachix.org-1:wKJuqEckTG0DL3Df7Ly9OVsg5S5TGBHtvlPGs+vlqrY=

      - name: Setup Cachix (Linux)
        if: runner.os == 'Linux'
        uses: cachix/cachix-action@v15
        with:
          name: hiroz
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          skipPush: ${{ github.event_name == 'pull_request' }}

      - name: Install Nushell (Linux via Nix)
        if: runner.os == 'Linux'
        run: |
          nix profile install nixpkgs#nushell
          chmod +x scripts/test-pure-rust.nu

      - name: Setup nix environment (Linux)
        # `nix print-dev-env` has no internal timeout: a substituter fetch that
        # stalls hangs until GitHub's 6h job limit. Observed healthy range is
        # 34-63s, so 20m is ~19x headroom while turning a stall into a fast,
        # re-runnable failure. A cold cache after a flake.lock bump that needs
        # real source builds will exceed this -- that should surface as a
        # failure telling you to populate cachix, not run silently for hours.
        timeout-minutes: 20
        if: runner.os == 'Linux'
        run: |
          nix print-dev-env '.#pureRust-ci' --accept-flake-config > /tmp/nix-dev-env.sh
          echo "export CI=true" >> /tmp/nix-dev-env.sh

      # macOS-specific setup
      - name: Install Rust toolchain (macOS)
        if: runner.os == 'macOS'
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: stable
          components: clippy, rustfmt

      - name: Install dependencies (macOS)
        if: runner.os == 'macOS'
        run: |
          brew install nushell protobuf
          chmod +x scripts/test-pure-rust.nu

      - name: Install cargo-nextest (macOS)
        if: runner.os == 'macOS'
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-nextest

      # Common setup
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ${{ runner.os }}-pureRust-test

      - name: Set environment variables (macOS)
        if: runner.os == 'macOS'
        run: |
          echo "CI=true" >> $GITHUB_ENV

      # Test steps
      - name: Clippy (default workspace)
        run: |
          if [ "$RUNNER_OS" == "Linux" ]; then
            source /tmp/nix-dev-env.sh
          fi
          nu scripts/test-pure-rust.nu clippy-workspace
        shell: bash

      - name: Run tests
        run: |
          if [ "$RUNNER_OS" == "Linux" ]; then
            source /tmp/nix-dev-env.sh
          fi
          nu scripts/test-pure-rust.nu run-tests
        shell: bash

  no-ros-shm:
    name: SHM Tests (ubuntu-latest)
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@main
        with:
          large-packages: true
          tool-cache: true
          android: true
          dotnet: true
          haskell: true
          docker-images: true
          swap-storage: false

      - name: Install Nix (Linux)
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            extra-substituters = https://hiroz.cachix.org
            extra-trusted-public-keys = hiroz.cachix.org-1:wKJuqEckTG0DL3Df7Ly9OVsg5S5TGBHtvlPGs+vlqrY=

      - name: Setup Cachix
        uses: cachix/cachix-action@v15
        with:
          name: hiroz
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          skipPush: ${{ github.event_name == 'pull_request' }}

      - name: Install Nushell (Linux via Nix)
        run: |
          nix profile install nixpkgs#nushell
          chmod +x scripts/test-pure-rust.nu

      - name: Setup nix environment (Linux)
        # `nix print-dev-env` has no internal timeout: a substituter fetch that
        # stalls hangs until GitHub's 6h job limit. Observed healthy range is
        # 34-63s, so 20m is ~19x headroom while turning a stall into a fast,
        # re-runnable failure. A cold cache after a flake.lock bump that needs
        # real source builds will exceed this -- that should surface as a
        # failure telling you to populate cachix, not run silently for hours.
        timeout-minutes: 20
        run: |
          nix print-dev-env '.#pureRust-ci' --accept-flake-config > /tmp/nix-dev-env.sh
          echo "export CI=true" >> /tmp/nix-dev-env.sh

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ${{ runner.os }}-pureRust-shm

      - name: SHM tests
        run: |
          sudo prlimit --memlock=unlimited --pid=$$
          source /tmp/nix-dev-env.sh
          nu scripts/test-pure-rust.nu test-shm
        shell: bash

  coverage:
    name: Code Coverage (ubuntu-latest)
    runs-on: ubuntu-latest
    continue-on-error: false
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@main
        with:
          large-packages: true
          tool-cache: true
          android: true
          dotnet: true
          haskell: true
          docker-images: true
          swap-storage: false

      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            extra-substituters = https://hiroz.cachix.org
            extra-trusted-public-keys = hiroz.cachix.org-1:wKJuqEckTG0DL3Df7Ly9OVsg5S5TGBHtvlPGs+vlqrY=

      - name: Setup Cachix
        uses: cachix/cachix-action@v15
        with:
          name: hiroz
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          skipPush: ${{ github.event_name == 'pull_request' }}

      - name: Install Nushell
        run: nix profile install nixpkgs#nushell

      - name: Setup nix environment
        # `nix print-dev-env` has no internal timeout: a substituter fetch that
        # stalls hangs until GitHub's 6h job limit. Observed healthy range is
        # 34-63s, so 20m is ~19x headroom while turning a stall into a fast,
        # re-runnable failure. A cold cache after a flake.lock bump that needs
        # real source builds will exceed this -- that should surface as a
        # failure telling you to populate cachix, not run silently for hours.
        timeout-minutes: 20
        run: |
          nix print-dev-env '.#pureRust-ci' --accept-flake-config > /tmp/nix-dev-env.sh
          echo "export CI=true" >> /tmp/nix-dev-env.sh

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ubuntu-latest-coverage

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-llvm-cov

      - name: Run coverage
        run: |
          source /tmp/nix-dev-env.sh
          # Without its features hiroz-tests compiles to empty binaries, so
          # coverage taken blind under-reports the paths they exercise.
          cargo llvm-cov \
            -p hiroz -p hiroz-codegen -p hiroz-cdr -p hiroz-protocol -p hiroz-schema \
            -p hiroz-tests \
            --features hiroz-tests/ros-msgs,hiroz-tests/jazzy \
            -j4 \
            --lcov --output-path lcov.info
        shell: bash

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        continue-on-error: true
        with:
          files: lcov.info
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false

  no-ros-checks:
    name: ROS-independent Checks (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # Linux-specific setup
      - name: Free Disk Space (Ubuntu)
        if: runner.os == 'Linux'
        uses: jlumbroso/free-disk-space@main
        with:
          large-packages: true
          tool-cache: true
          android: true
          dotnet: true
          haskell: true
          docker-images: true
          swap-storage: false

      - name: Install Nix (Linux)
        if: runner.os == 'Linux'
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            extra-substituters = https://hiroz.cachix.org
            extra-trusted-public-keys = hiroz.cachix.org-1:wKJuqEckTG0DL3Df7Ly9OVsg5S5TGBHtvlPGs+vlqrY=

      - name: Setup Cachix (Linux)
        if: runner.os == 'Linux'
        uses: cachix/cachix-action@v15
        with:
          name: hiroz
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          skipPush: ${{ github.event_name == 'pull_request' }}

      - name: Install Nushell (Linux via Nix)
        if: runner.os == 'Linux'
        run: |
          nix profile install nixpkgs#nushell
          chmod +x scripts/test-pure-rust.nu

      - name: Setup nix environment (Linux)
        # `nix print-dev-env` has no internal timeout: a substituter fetch that
        # stalls hangs until GitHub's 6h job limit. Observed healthy range is
        # 34-63s, so 20m is ~19x headroom while turning a stall into a fast,
        # re-runnable failure. A cold cache after a flake.lock bump that needs
        # real source builds will exceed this -- that should surface as a
        # failure telling you to populate cachix, not run silently for hours.
        timeout-minutes: 20
        if: runner.os == 'Linux'
        run: |
          nix print-dev-env '.#pureRust-ci' --accept-flake-config > /tmp/nix-dev-env.sh
          echo "export CI=true" >> /tmp/nix-dev-env.sh

      # macOS-specific setup
      - name: Install Rust toolchain (macOS)
        if: runner.os == 'macOS'
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: stable
          target: wasm32-wasip2
          components: clippy, rustfmt

      - name: Install dependencies (macOS)
        if: runner.os == 'macOS'
        run: |
          brew install nushell protobuf
          chmod +x scripts/test-pure-rust.nu

      # Common setup
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ${{ runner.os }}-pureRust-checks-v2

      - name: Set environment variables (macOS)
        if: runner.os == 'macOS'
        run: |
          echo "CI=true" >> $GITHUB_ENV

      # Check steps
      - name: Check hiroz-msgs feature flags
        run: |
          if [ "$RUNNER_OS" == "Linux" ]; then
            source /tmp/nix-dev-env.sh
          fi
          nu scripts/test-pure-rust.nu check-bundled-msgs
        shell: bash

      - name: Check hu (hiroz-union)
        run: |
          if [ "$RUNNER_OS" == "Linux" ]; then
            source /tmp/nix-dev-env.sh
          fi
          nu scripts/test-pure-rust.nu check-hu
        shell: bash

      - name: Check all examples
        run: |
          if [ "$RUNNER_OS" == "Linux" ]; then
            source /tmp/nix-dev-env.sh
          fi
          nu scripts/test-pure-rust.nu check-examples
        shell: bash
      - name: Check rustdoc links
        run: |
          if [ "$RUNNER_OS" == "Linux" ]; then
            source /tmp/nix-dev-env.sh
          fi
          nu scripts/test-pure-rust.nu check-rustdoc-links
        shell: bash


      - name: Check distro feature flags
        run: |
          if [ "$RUNNER_OS" == "Linux" ]; then
            source /tmp/nix-dev-env.sh
          fi
          nu scripts/test-pure-rust.nu check-distro-features
        shell: bash

      - name: Clippy (hiroz-py)
        run: |
          if [ "$RUNNER_OS" == "Linux" ]; then
            source /tmp/nix-dev-env.sh
          fi
          nu scripts/test-pure-rust.nu clippy-hiroz-py
        shell: bash

      - name: Clippy (hiroz-tests, interop features)
        run: |
          if [ "$RUNNER_OS" == "Linux" ]; then
            source /tmp/nix-dev-env.sh
          fi
          nu scripts/test-pure-rust.nu clippy-tests
        shell: bash

  wasm-plugin-tests:
    name: WASM Plugin Tests (ubuntu-latest)
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@main
        with:
          large-packages: true
          tool-cache: true
          android: true
          dotnet: true
          haskell: true
          docker-images: true
          swap-storage: false

      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            extra-substituters = https://hiroz.cachix.org
            extra-trusted-public-keys = hiroz.cachix.org-1:wKJuqEckTG0DL3Df7Ly9OVsg5S5TGBHtvlPGs+vlqrY=

      - name: Setup Cachix
        uses: cachix/cachix-action@v15
        with:
          name: hiroz
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          skipPush: ${{ github.event_name == 'pull_request' }}

      - name: Setup nix environment
        # `nix print-dev-env` has no internal timeout: a substituter fetch that
        # stalls hangs until GitHub's 6h job limit. Observed healthy range is
        # 34-63s, so 20m is ~19x headroom while turning a stall into a fast,
        # re-runnable failure. A cold cache after a flake.lock bump that needs
        # real source builds will exceed this -- that should surface as a
        # failure telling you to populate cachix, not run silently for hours.
        timeout-minutes: 20
        run: |
          nix print-dev-env '.#pureRust-ci' --accept-flake-config > /tmp/nix-dev-env.sh
          echo "export CI=true" >> /tmp/nix-dev-env.sh

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ubuntu-latest-wasm-plugin-tests

      - name: Run WASM plugin tests
        run: |
          source /tmp/nix-dev-env.sh
          bash scripts/ci/hu-tests.sh

  python-stubs-fresh:
    name: Generated Python Stubs (ubuntu-latest)
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@main
        with:
          large-packages: true
          tool-cache: true
          android: true
          dotnet: true
          haskell: true
          docker-images: true
          swap-storage: false

      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            extra-substituters = https://hiroz.cachix.org
            extra-trusted-public-keys = hiroz.cachix.org-1:wKJuqEckTG0DL3Df7Ly9OVsg5S5TGBHtvlPGs+vlqrY=

      - name: Setup Cachix
        uses: cachix/cachix-action@v15
        with:
          name: hiroz
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          skipPush: ${{ github.event_name == 'pull_request' }}

      - name: Install Nushell
        run: |
          nix profile install nixpkgs#nushell
          chmod +x scripts/test-pure-rust.nu

      - name: Setup nix environment
        run: |
          nix print-dev-env '.#pureRust-ci' --accept-flake-config > /tmp/nix-dev-env.sh
          echo "export CI=true" >> /tmp/nix-dev-env.sh

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ubuntu-latest-python-stubs

      # Deliberately does NOT restore the `python-tests` job's generated-types
      # cache: a restored copy would be compared against the tree instead of a
      # freshly generated one, and the check would report on the cache.
      - name: Generated Python stubs are up to date
        run: |
          source /tmp/nix-dev-env.sh
          nu scripts/test-pure-rust.nu check-python-stubs

  go-tests:
    name: Go Tests (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: stable

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ${{ runner.os }}-go-ffi

      - name: Install Nushell
        uses: hustcer/setup-nu@v3
        with:
          version: '0.102'

      - name: Go vet (static analysis)
        run: nu scripts/test-go.nu --vet-only

      - name: Go pure tests (codegen + testdata)
        run: nu scripts/test-go.nu --codegen-only

      - name: Go FFI tests (hiroz unit tests)
        run: nu scripts/test-go.nu --ffi-only

  python-tests:
    name: Python Tests (hiroz-py) (${{ matrix.distro }})
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        distro: [humble, jazzy, kilted, lyrical]
    # Skip for draft PRs to save CI time during development
    if: |
      github.event_name == 'push' ||
      github.event.pull_request.draft == false

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@main
        with:
          large-packages: true
          tool-cache: true
          android: true
          dotnet: true
          haskell: true
          docker-images: true
          swap-storage: false

      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            extra-substituters = https://ros.cachix.org https://hiroz.cachix.org
            extra-trusted-public-keys = ros.cachix.org-1:dSyZxI8geDCJrwgvCOHDoAfOm5sV1wCPjBkKL+38Rvo=
            extra-trusted-public-keys = hiroz.cachix.org-1:wKJuqEckTG0DL3Df7Ly9OVsg5S5TGBHtvlPGs+vlqrY=

      - name: Setup Cachix
        uses: cachix/cachix-action@v15
        with:
          name: hiroz
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          # Push hiroz's own built Nix derivations on main-branch runs so
          # subsequent runs (including PRs) can download them from Cachix
          # instead of rebuilding. hiroz.cachix.org is our own cache;
          # ros.cachix.org is read-only for upstream ROS packages.
          skipPush: ${{ github.event_name == 'pull_request' }}

      - name: Install Nushell
        run: |
          nix profile install nixpkgs#nushell
          chmod +x scripts/test-python.nu

      - name: Setup nix environment
        # `nix print-dev-env` has no internal timeout: a substituter fetch that
        # stalls hangs until GitHub's 6h job limit. Observed healthy range is
        # 34-63s, so 20m is ~19x headroom while turning a stall into a fast,
        # re-runnable failure. A cold cache after a flake.lock bump that needs
        # real source builds will exceed this -- that should surface as a
        # failure telling you to populate cachix, not run silently for hours.
        timeout-minutes: 20
        run: |
          nix print-dev-env '.#ros-${{ matrix.distro }}-ci' --accept-flake-config > /tmp/nix-dev-env.sh
          echo "export CI=true" >> /tmp/nix-dev-env.sh

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ${{ matrix.distro }}-python

      - name: Clean pyo3 build artifacts
        run: find target -name 'build-script-build' -path '*pyo3-build-config*' -delete 2>/dev/null || true

      - name: Cache generated Python types
        uses: actions/cache@v4
        with:
          path: crates/hiroz-msgs/python/hiroz_msgs_py/types
          key: >-
            ${{ runner.os }}-${{ matrix.distro }}-python-types-${{
            hashFiles('Cargo.lock', 'crates/hiroz-msgs/python/**') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.distro }}-python-types-

      - name: Setup venv
        run: |
          source /tmp/nix-dev-env.sh
          nu scripts/test-python.nu --distro ${{ matrix.distro }} setup-venv

      - name: Ruff linting
        run: |
          source /tmp/nix-dev-env.sh
          nu scripts/test-python.nu --distro ${{ matrix.distro }} lint-ruff

      - name: Ruff format check
        run: |
          source /tmp/nix-dev-env.sh
          nu scripts/test-python.nu --distro ${{ matrix.distro }} format-ruff

      - name: MyPy type checking
        run: |
          source /tmp/nix-dev-env.sh
          nu scripts/test-python.nu --distro ${{ matrix.distro }} typecheck-mypy

      - name: Run pytest
        run: |
          sudo prlimit --memlock=unlimited --pid=$$
          source /tmp/nix-dev-env.sh
          nu scripts/test-python.nu --distro ${{ matrix.distro }} run-pytest

      - name: Run examples
        run: |
           source /tmp/nix-dev-env.sh
           nu scripts/test-python.nu --distro ${{ matrix.distro }} run-examples

      - name: Run Python-Rust interop tests
        run: |
          source /tmp/nix-dev-env.sh
          nu scripts/test-python.nu --distro ${{ matrix.distro }} run-python-interop

      - name: Cleanup
        run: |
          source /tmp/nix-dev-env.sh
          nu scripts/test-python.nu --distro ${{ matrix.distro }} cleanup-python

  ros-tests:
    name: ROS Tests (clippy-rmw, interop) (${{ matrix.distro }})
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        distro: [humble, jazzy, kilted, lyrical]
    # Skip for draft PRs to save CI time during development
    if: |
      github.event_name == 'push' ||
      github.event.pull_request.draft == false

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@main
        with:
          large-packages: true
          tool-cache: true
          android: true
          dotnet: true
          haskell: true
          docker-images: true
          swap-storage: false

      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            extra-substituters = https://ros.cachix.org https://hiroz.cachix.org
            extra-trusted-public-keys = ros.cachix.org-1:dSyZxI8geDCJrwgvCOHDoAfOm5sV1wCPjBkKL+38Rvo=
            extra-trusted-public-keys = hiroz.cachix.org-1:wKJuqEckTG0DL3Df7Ly9OVsg5S5TGBHtvlPGs+vlqrY=

      - name: Setup Cachix
        uses: cachix/cachix-action@v15
        with:
          name: hiroz
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          skipPush: ${{ github.event_name == 'pull_request' }}

      - name: Install Nushell
        run: |
          nix profile install nixpkgs#nushell
          chmod +x scripts/test-ros.nu

      - name: Setup nix environment
        # `nix print-dev-env` has no internal timeout: a substituter fetch that
        # stalls hangs until GitHub's 6h job limit. Observed healthy range is
        # 34-63s, so 20m is ~19x headroom while turning a stall into a fast,
        # re-runnable failure. A cold cache after a flake.lock bump that needs
        # real source builds will exceed this -- that should surface as a
        # failure telling you to populate cachix, not run silently for hours.
        timeout-minutes: 20
        run: |
          nix print-dev-env '.#ros-${{ matrix.distro }}-ci' \
            --accept-flake-config > /tmp/nix-dev-env.sh
          echo "export CI=true" >> /tmp/nix-dev-env.sh

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ${{ matrix.distro }}-ros-v2

      - name: Run ROS tests
        run: |
          source /tmp/nix-dev-env.sh
          nu scripts/test-ros.nu --distro ${{ matrix.distro }}