name: CI

# Test/lint gate (offline, no secrets) on every push/PR, plus a live-network
# job that exercises the real source sites and the token-gated pixiv tests.
#
# Layering:
#   changes — decides whether anything but documentation changed; a docs-only
#           push/PR skips `test` (which then reports as skipped, not missing).
#   test  — fmt + clippy + the full offline unit suite + a release-profile
#           build + cargo-audit dependency gate. Runs on every push and PR,
#           including forks (it needs no secrets).
#   live  — the #[ignore]d live-network tests plus the pixiv tests that are
#           gated on PIXIV_REFRESH_TOKEN. Runs on schedule / manual dispatch
#           / tag pushes only, because pull requests from forks cannot read
#           repository secrets. continue-on-error keeps a flaky external site
#           from blocking, while the run still records the outcome.
#
# Every action is pinned to a commit SHA (Dependabot keeps the pins current);
# `dtolnay/rust-toolchain` deliberately stays on its channel ref, because the
# ref itself is what selects the toolchain (`@stable` = install stable).
#
# Test gating convention (keep in sync with AGENTS.md "Testing & QA"):
#   - pure unit tests: plain #[test] / #[tokio::test], always run.
#   - live-network tests: #[ignore = "live network: ..."], only run here.
#   - token-gated tests (pixiv): #[tokio::test] with an early return when
#     PIXIV_REFRESH_TOKEN is absent or empty (empty = unset CI secret).

on:
  push:
    branches: [master]
  pull_request:
  schedule:
    # Weekly probe of the live endpoints, so external API changes surface.
    - cron: '0 3 * * 1'
  workflow_dispatch:

permissions:
  contents: read

# A newer push to the same ref supersedes the older run; without this every
# intermediate commit of a PR branch keeps a runner busy to completion.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  # Panicking tests print their backtrace; free when nothing fails.
  RUST_BACKTRACE: 1

jobs:
  # Docs-only changes skip the heavy job: a README edit does not need a four
  # minute Rust build (and it cannot break one). A gate job rather than a
  # workflow-level `paths` filter — that leaves the run without a `test` check
  # at all, and a required status check then waits for something that will
  # never be reported, while a *skipped* job reports as neutral.
  changes:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    outputs:
      code: ${{ steps.diff.outputs.code }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0 # the diff below needs the pushed range
      - id: diff
        shell: bash
        run: |
          set -euo pipefail
          zero=0000000000000000000000000000000000000000
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            base="origin/${{ github.base_ref }}"
            git fetch --quiet --no-tags origin "${{ github.base_ref }}"
            changed="$(git diff --name-only "$base...HEAD")"
          else
            before="${{ github.event.before }}"
            if [ -z "$before" ] || [ "$before" = "$zero" ]; then
              # New branch or force push: no usable base to compare against,
              # so the full suite runs. Same for schedule/dispatch, which have
              # no `before` at all.
              changed=""
            else
              changed="$(git diff --name-only "$before..${{ github.sha }}")"
            fi
          fi
          # Only a change that is *entirely* markdown may skip the job;
          # anything else — and an empty diff, i.e. a re-run of the same
          # commit — counts as code.
          code=true
          if [ -n "$changed" ] && ! grep -qvE '\.md$' <<<"$changed"; then
            code=false
          fi
          echo "changed: ${changed:-<no diff>}"
          echo "code=$code" >> "$GITHUB_OUTPUT"

  test:
    needs: changes
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-latest
    # Generous on purpose: the release-profile build below is cold on the very
    # first run (thin LTO + codegen-units = 1 across every dependency), and a
    # timeout there would kill the job *before* rust-cache saves its cache —
    # leaving every later run cold again.
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
      # `--locked` on every cargo invocation: the version bump edits
      # Cargo.lock by hand (AGENTS.md), so a stale lock must fail here instead
      # of being silently re-resolved — otherwise CI tests a different
      # dependency set than the one committed, and than the one the released
      # image is built from.
      - name: Check formatting
        run: cargo fmt --check
      - name: Lint (deny warnings)
        run: cargo clippy --workspace --all-targets --locked -- -D warnings
      - name: Run offline tests
        run: cargo test --workspace --locked
      # The release profile (lto/strip/codegen-units=1, overflow checks off)
      # was otherwise only exercised by the Docker build on master/tag. Same
      # package the Dockerfile builds; the cache keeps it cheap after the
      # first run.
      - name: Build release profile
        run: cargo build --release --locked -p xmedia-bot
      # Dependency vulnerability gate: fails the build when a crate in
      # Cargo.lock has an unfixed security advisory. Unmaintained/unsound
      # *warnings* (dotenv, proc-macro-error2, anyhow transitive) do not fail
      # the build by default; the advisory DB is cached across runs.
      - name: Audit dependencies
        uses: actions-rust-lang/audit@72c09e02f132669d52284a3323acdb503cfc1a24 # v1

  live:
    needs: test
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    timeout-minutes: 30
    continue-on-error: true
    env:
      PIXIV_REFRESH_TOKEN: ${{ secrets.PIXIV_REFRESH_TOKEN }}
      TWITTER_AUTH_TOKEN: ${{ secrets.TWITTER_AUTH_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
      # Everything network- or secret-gated lives in x-media, and the bot
      # crate's suite (MockSender + tempdir stores, no network) already ran in
      # the `test` job — rebuilding it here bought nothing.
      - name: Run token-gated tests
        run: cargo test -p x-media --locked
      # The live-network tests, by the "live" name filter (all #[ignore]d).
      - name: Run live-network tests
        run: cargo test -p x-media --locked -- --ignored live