name: CI
on:
  push:
    branches: [main, release]
  pull_request:

env:
  CARGO_TERM_COLOR: always

jobs:
  rust-lint:
    name: Rust Lint
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
      - uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2
      - name: Format check
        run: just fmt-check
      - name: Clippy
        run: just clippy

  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
      - uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2
      - name: Unit tests
        run: just test-unit

  desktop:
    name: Desktop
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
      - uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2
        with:
          workspaces: desktop/src-tauri
      - name: Install Tauri dependencies (Linux)
        env:
          DEBIAN_FRONTEND: noninteractive
        run: |
          sudo apt-get update \
            -o Acquire::Retries=3 \
            -o Acquire::http::Timeout=30 \
            -o Acquire::https::Timeout=30
          sudo apt-get install -y --no-install-recommends \
            -o Acquire::Retries=3 \
            -o Acquire::http::Timeout=30 \
            -o Acquire::https::Timeout=30 \
            -o DPkg::Lock::Timeout=120 \
            build-essential \
            curl \
            file \
            libayatana-appindicator3-dev \
            libgtk-3-dev \
            librsvg2-dev \
            libssl-dev \
            libwebkit2gtk-4.1-dev \
            libxdo-dev \
            patchelf \
            wget
      - name: Install desktop dependencies
        run: just desktop-install-ci
      - name: Desktop lint and format
        run: just desktop-check
      - name: Desktop build
        run: just desktop-build
      - name: Desktop Tauri check
        run: just desktop-tauri-check

  security:
    name: Security
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
      - name: Dependency policy
        run: cargo-deny check