name: CI

on:
  push:
    branches: [master]
    tags: ['v*']
  pull_request:

env:
  CARGO_TERM_COLOR: always
  # Each crate root sets `#![warn(clippy::pedantic)]` and is clean under it;
  # `-D warnings` keeps it so by turning any lint that ever fires into a
  # failed job rather than a line in a log that nobody reads, a warning
  # tolerated being a warning inherited. The lockfile is committed, so every
  # cargo invocation below is `--locked`: it resolves exactly what the tree
  # says or refuses to resolve at all, and a dependency that drifted would
  # fail here rather than ship.
  RUSTFLAGS: "-D warnings"

jobs:
  lint:
    runs-on: lo-runner
    steps:
      - uses: actions/checkout@v6.0.2

      - name: cargo fmt
        run: cargo fmt --all --check

      - name: cargo clippy
        run: cargo clippy --workspace --all-targets --locked --message-format=short

      - name: cargo doc (no deps)
        run: cargo doc --workspace --no-deps --document-private-items --locked
        env:
          RUSTDOCFLAGS: "-D warnings"

      - name: cargo audit
        run: cargo audit

  test:
    runs-on: lo-runner
    steps:
      - uses: actions/checkout@v6.0.2

      - name: cargo test
        run: cargo test --workspace --locked

  build:
    runs-on: lo-runner
    steps:
      - uses: actions/checkout@v6.0.2

      # The workspace states its version once, in one place; a tag that
      # disagrees with it publishes nothing, and says so. Two sources of
      # truth for one number is one more than the calendar tolerates.
      - name: The tag names the version
        run: |
          version=$(cargo pkgid -p loic | sed 's/.*[#@]//')
          echo "workspace version $version, ref $GITHUB_REF"
          case "$GITHUB_REF" in
            refs/tags/v*)
              tag=${GITHUB_REF#refs/tags/}
              [ "$tag" = "v$version" ] || {
                echo "::error::the tag says $tag and the workspace says $version; one of them is wrong and neither is publishing"
                exit 1
              } ;;
          esac

      - name: cargo build --release
        run: cargo build --release --locked -p loic-cli -p loic-gui

      # What crates.io would receive, rehearsed on every push rather than
      # discovered on the tag, when it would be too late to be told.
      - name: cargo publish --dry-run
        run: cargo publish --dry-run --locked -p loic -p loid

  publish:
    needs: [lint, test, build]
    runs-on: lo-runner
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: actions/checkout@v6.0.2

      # One invocation: cargo publishes `loic`, waits for the index to admit
      # it, then publishes `loid` against it — the order the dependency runs
      # in, which is the only order that works.
      - name: Publish loic and loid
        run: cargo publish --locked -p loic -p loid
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}

  release:
    needs: [lint, test, build]
    runs-on: lo-runner
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: actions/checkout@v6.0.2

      - name: Build the oracle and the Observatory
        run: cargo build --release --locked -p loic-cli -p loic-gui

      # The artifacts are the two binaries, exactly as built, and their
      # checksums: nothing repackaged, and nothing stripped that the release
      # profile did not strip itself.
      - name: Collect the binaries
        run: |
          set -eu
          version=${GITHUB_REF#refs/tags/v}
          target=$(rustc -vV | sed -n 's/^host: //p')
          mkdir -p dist
          cp target/release/loic-cli target/release/loic-gui dist/
          (cd dist && sha256sum loic-cli loic-gui | tee SHA256SUMS)

          cat > release-notes.md <<EOF
          The Loic Calendar $version.

          \`loic\` and \`loid\` are on crates.io at this version. Below are the two binaries: the oracle (\`loic-cli\`) and the Observatory (\`loic-gui\`), each a single binary, built for \`$target\` exactly as the release profile left them. Both need Linux with \`CLOCK_TAI\` and a kernel that has been told the TAI offset; the Observatory also needs Wayland and a GPU. On a kernel whose offset is zero they open, say why, and observe nothing, which is the correct number of observations to make through a clock that is lying. The Observatory's icon and desktop entry are an optional step in its README. Checksums are in \`SHA256SUMS\`.
          EOF

      - name: Attach them to the release
        uses: https://code.forgejo.org/actions/forgejo-release@v2
        with:
          direction: upload
          url: ${{ github.server_url }}
          repo: ${{ github.repository }}
          tag: ${{ github.ref_name }}
          release-dir: dist
          release-notes-file: release-notes.md
          token: ${{ secrets.GITHUB_TOKEN }}
          override: true
          prerelease: ${{ contains(github.ref_name, '-') }}