ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always

jobs:
  rustfmt:
    name: Rustfmt
    runs-on: blacksmith-32vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          components: rustfmt

      - name: Check Rust formatting
        run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: blacksmith-32vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          components: clippy

      - name: Mount sticky cache
        uses: ./.github/actions/mount-sticky-cache
        with:
          key-prefix: ${{ github.repository }}-ci-${{ github.job }}
          cargo: "true"
          target: target

      - name: Run Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

  typecheck:
    name: TypeScript check
    runs-on: blacksmith-32vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
        with:
          node-version-file: ".node-version"
          cache: true
          run-install: true

      - name: Check TypeScript
        run: vp run check:ts

  test:
    name: Test
    runs-on: blacksmith-32vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
        with:
          node-version-file: ".node-version"
          cache: true
          run-install: true

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Mount sticky cache
        uses: ./.github/actions/mount-sticky-cache
        with:
          key-prefix: ${{ github.repository }}-ci-${{ github.job }}
          cargo: "true"
          target: target

      - name: Check browser availability
        run: google-chrome --version

      - name: Run tests
        run: vp run test

  vscode-test:
    name: VS Code extension tests
    runs-on: blacksmith-32vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
        with:
          node-version-file: ".node-version"
          cache: true
          run-install: true

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Mount sticky cache
        uses: ./.github/actions/mount-sticky-cache
        with:
          key-prefix: ${{ github.repository }}-ci-${{ github.job }}
          cargo: "true"
          target: target

      - name: Build ox-content-lsp (release)
        run: vp run build:lsp

      - name: Build VS Code extension
        run: vp run vscode:build

      - name: Run VS Code unit tests
        run: vp run test:vscode-unit

      - name: Run VS Code integration tests (xvfb)
        # `vscode-test` launches a real Electron process, which needs an
        # X server on Linux. xvfb-run -a allocates one on the fly.
        run: xvfb-run -a node scripts/run-vscode-tests.mjs

  zed-extension:
    name: Zed extension build
    runs-on: blacksmith-32vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          targets: wasm32-unknown-unknown

      - name: Build Zed extension WASM
        run: cargo build --manifest-path editors/zed/Cargo.toml --target wasm32-unknown-unknown

  dependency-policy:
    name: Dependency policy
    runs-on: blacksmith-32vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
        with:
          node-version-file: ".node-version"
          cache: true
          run-install: true

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Mount sticky cache
        uses: ./.github/actions/mount-sticky-cache
        with:
          key-prefix: ${{ github.repository }}-ci-${{ github.job }}
          cargo: "true"

      - name: Install Cargo audit tools
        run: cargo install cargo-audit cargo-deny --locked

      - name: Check Cargo advisories
        run: cargo audit --deny warnings

      - name: Check Cargo licenses
        run: cargo deny check licenses

      - name: Check npm advisories
        run: node scripts/check-npm-advisories.mjs

      - name: Check npm licenses
        run: node scripts/check-npm-licenses.mjs

  package-dry-run:
    name: Package dry-run
    runs-on: blacksmith-32vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
        with:
          node-version-file: ".node-version"
          cache: true
          run-install: true

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Mount sticky cache
        uses: ./.github/actions/mount-sticky-cache
        with:
          key-prefix: ${{ github.repository }}-ci-${{ github.job }}
          cargo: "true"
          target: target

      - name: Build publishable packages
        run: vp run build:npm

      - name: Ensure generated NAPI declarations are fresh
        run: git diff --exit-code -- crates/ox_content_napi/index.d.ts

      - name: Pack and inspect publishable packages
        run: node scripts/package-dry-run.mjs

  napi-smoke:
    name: NAPI smoke - ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - blacksmith-32vcpu-ubuntu-2404
          - macos-latest
          - windows-2025
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
        with:
          node-version-file: ".node-version"
          cache: true
          run-install: true

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Mount sticky cache
        if: startsWith(matrix.os, 'blacksmith-')
        uses: ./.github/actions/mount-sticky-cache
        with:
          key-prefix: ${{ github.repository }}-ci-${{ github.job }}-${{ matrix.os }}
          cargo: "true"
          target: target

      - name: Cache cargo
        if: runner.os != 'Windows' && !startsWith(matrix.os, 'blacksmith-')
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      # Debug build: the smoke test only verifies the binding loads and that
      # parseAndRender produces correct output — it does not benchmark. A debug
      # build validates the same ABI/load/correctness path far faster than the
      # release profile (fat LTO + codegen-units=1). Release artifacts are built
      # and verified separately in publish.yml.
      - name: Build local NAPI binding
        working-directory: crates/ox_content_napi
        run: vp exec -- napi build

      - name: Load and parse smoke test
        shell: bash
        run: |
          node - <<'NODE'
          const napi = require("./crates/ox_content_napi");
          const result = napi.parseAndRender("# Hello\n\nSmoke test", { gfm: true });
          if (result.errors.length > 0) {
            throw new Error(result.errors.join("\n"));
          }
          if (!result.html.includes("Hello</h1>")) {
            throw new Error(`Unexpected render output: ${result.html}`);
          }
          console.log(`@ox-content/napi ${napi.version()} loaded on ${process.platform}-${process.arch}`);
          NODE

  build:
    name: Build
    runs-on: blacksmith-32vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
        with:
          node-version-file: ".node-version"
          cache: true
          run-install: true

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Mount sticky cache
        uses: ./.github/actions/mount-sticky-cache
        with:
          key-prefix: ${{ github.repository }}-ci-${{ github.job }}
          cargo: "true"
          target: target
          browsers: "true"

      - name: Install browsers for docs rendering
        run: |
          vp exec --filter @ox-content/vite-plugin -- playwright install --with-deps chromium
          vp exec --filter @ox-content/vite-plugin -- puppeteer browsers install chrome-headless-shell

      - name: Build
        run: vp build