ci.yml

# caveman: unified BigLinux Rust CI
# customize: env.PROJECT_KIND (app|lib), env.SYSTEM_LIBS, env.BIN_SIZE_MAX_MIB, env.IDLE_RSS_MAX_MIB
name: ci

on:
  push:
    branches: [main, master]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"
  RUST_BACKTRACE: "1"
  # override per project
  PROJECT_KIND: "app"         # app | lib
  SYSTEM_LIBS: "common gtk4 adw webkit"
  BIN_SIZE_MAX_MIB: "7"
  IDLE_RSS_MAX_MIB: "180"
  BIN_NAME: "big-webapps-gui"                # release artifact under target/release/<name>
  # libs only
  ENABLE_SEMVER: "false"
  ENABLE_MIRI: "false"

jobs:
  shellcheck:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: install shellcheck
        run: sudo apt-get update -qq && sudo apt-get install -y shellcheck
      - name: lint all shell scripts
        run: |
          # SC1091 = source-path resolved at runtime; ignore.
          mapfile -t scripts < <(git ls-files '*.sh' 2>/dev/null | sort -u)
          if [ "${#scripts[@]}" -eq 0 ]; then echo "no shell scripts"; exit 0; fi
          shellcheck -e SC1091 -S warning "${scripts[@]}"
  fmt:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/setup-rust
        with:
          system-libs: ${{ env.SYSTEM_LIBS }}
          cache-key: fmt
      - run: cargo fmt --all -- --check

  clippy:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/setup-rust
        with:
          system-libs: ${{ env.SYSTEM_LIBS }}
          cache-key: clippy
      - run: cargo clippy --workspace --all-targets --all-features -- -D warnings

  test:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/setup-rust
        with:
          system-libs: ${{ env.SYSTEM_LIBS }}
          cache-key: test
      # /tmp is noexec on hosts — skip --doc explicitly
      - name: nextest (fallback to cargo test)
        run: |
          set -euxo pipefail
          if command -v cargo-nextest >/dev/null 2>&1; then
            cargo nextest run --all-features --workspace
          else
            cargo test --all-features --tests --workspace
          fi

  deny:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/setup-rust
        with:
          system-libs: common
          cache-key: deny
      - run: cargo deny check advisories bans licenses sources

  audit:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/setup-rust
        with:
          system-libs: common
          cache-key: audit
      - run: cargo audit -D warnings

  machete:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/setup-rust
        with:
          system-libs: common
          cache-key: machete
      - run: cargo machete --with-metadata

  doc:
    runs-on: ubuntu-24.04
    env:
      RUSTDOCFLAGS: "-D warnings"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/setup-rust
        with:
          system-libs: ${{ env.SYSTEM_LIBS }}
          cache-key: doc
      - run: cargo doc --no-deps --all-features --workspace

  semver-checks:
    # libs only
    if: ${{ env.ENABLE_SEMVER == 'true' }}
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with: { fetch-depth: 0 }
      - uses: ./.github/actions/setup-rust
        with:
          system-libs: ${{ env.SYSTEM_LIBS }}
          cache-key: semver
          cargo-tools: cargo-semver-checks
      - run: cargo semver-checks --workspace || echo "no baseline tag yet"

  miri:
    # pure-Rust libs only
    if: ${{ env.ENABLE_MIRI == 'true' }}
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/setup-rust
        with:
          toolchain: nightly
          system-libs: common
          cache-key: miri
          cargo-tools: ""
      - run: |
          rustup component add miri
          cargo miri test --lib

  complexity:
    # apps only — CCN + duplication
    if: ${{ env.PROJECT_KIND == 'app' }}
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: install lizard + jscpd
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends python3-pip nodejs npm
          pip3 install --break-system-packages lizard
          npm i -g jscpd@4
      - name: lizard CCN <=25 avg
        run: |
          set -euxo pipefail
          lizard -l rust -C 25 src crates 2>/dev/null || lizard -l rust -C 25 .
      - name: jscpd duplication <=5%
        run: jscpd --threshold 5 --reporters consoleFull --min-tokens 50 src crates 2>/dev/null || jscpd --threshold 5 .

  i18n:
    # POT round-trip when po/ present
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: skip if no po/
        id: po
        run: |
          if [ -d po ]; then echo "has=true" >> "$GITHUB_OUTPUT"; else echo "has=false" >> "$GITHUB_OUTPUT"; fi
      - name: install gettext
        if: steps.po.outputs.has == 'true'
        run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends gettext
      - name: pot round-trip + msgfmt -c -v
        if: steps.po.outputs.has == 'true'
        run: |
          set -euxo pipefail
          mkdir -p tmp
          find . -name '*.rs' -not -path './target/*' > tmp/pot-sources.txt
          # generate fresh pot
          xgettext --language=C --from-code=UTF-8 --keyword=_ --keyword=gettext --keyword=tr \
            --keyword=ngettext:1,2 -o tmp/ci.pot -f tmp/pot-sources.txt || true
          for po in po/*.po; do
            [ -f "$po" ] || continue
            msgfmt -c -v -o /dev/null "$po"
          done

  budgets:
    # apps only — binary size + idle RSS
    if: ${{ env.PROJECT_KIND == 'app' }}
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/setup-rust
        with:
          system-libs: ${{ env.SYSTEM_LIBS }}
          cache-key: budgets
          cargo-tools: ""
      - name: release build
        run: cargo build --release --workspace
      - name: binary size budget
        run: |
          set -euxo pipefail
          if [ -z "${BIN_NAME}" ]; then echo "BIN_NAME unset; skipping"; exit 0; fi
          bin="target/release/${BIN_NAME}"
          [ -f "$bin" ] || { echo "missing $bin"; exit 1; }
          strip -s "$bin" || true
          sz=$(stat -c%s "$bin")
          mib=$(( (sz + 1048575) / 1048576 ))
          echo "size: ${mib} MiB (max ${BIN_SIZE_MAX_MIB})"
          [ "$mib" -le "${BIN_SIZE_MAX_MIB}" ]
      - name: idle RSS budget (headless)
        run: |
          set -euxo pipefail
          if [ -z "${BIN_NAME}" ]; then echo "BIN_NAME unset; skipping"; exit 0; fi
          sudo apt-get install -y --no-install-recommends xvfb dbus-x11 procps
          bin="target/release/${BIN_NAME}"
          xvfb-run -a dbus-launch --exit-with-session "$bin" --help >/dev/null 2>&1 || true
          # best-effort RSS sample under xvfb
          xvfb-run -a dbus-launch --exit-with-session bash -c "
            \"$bin\" &
            pid=\$!
            sleep 5
            rss=\$(awk '/VmRSS/ {print \$2}' /proc/\$pid/status 2>/dev/null || echo 0)
            kill \$pid 2>/dev/null || true
            mib=\$(( rss / 1024 ))
            echo \"idle RSS: \${mib} MiB (max ${IDLE_RSS_MAX_MIB})\"
            [ \"\$mib\" -le ${IDLE_RSS_MAX_MIB} ]
          " || echo "RSS gate skipped (no display)"

  atspi-smoke:
    # opt-in via label ci:atspi
    if: ${{ contains(github.event.pull_request.labels.*.name, 'ci:atspi') }}
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/setup-rust
        with:
          system-libs: ${{ env.SYSTEM_LIBS }}
          cache-key: atspi
          cargo-tools: ""
      - name: kwin_wayland virtual + screenshot
        run: |
          set -euxo pipefail
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends \
            kwin-wayland dbus-x11 at-spi2-core kde-spectacle xvfb || true
          if [ -z "${BIN_NAME}" ]; then echo "BIN_NAME unset; skipping"; exit 0; fi
          cargo build --release --bin "${BIN_NAME}"
          mkdir -p tmp/atspi
          dbus-run-session -- bash -c "
            kwin_wayland --virtual --no-lockscreen &
            sleep 3
            target/release/${BIN_NAME} &
            sleep 6
            spectacle -b -n -o tmp/atspi/shot.png || true
            pkill -f ${BIN_NAME} || true
            pkill -f kwin_wayland || true
          " || echo "atspi smoke best-effort"
      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
        if: always()
        with:
          name: atspi-screenshot
          path: tmp/atspi/

  vm-smoke:
    # opt-in via label ci:vm-smoke — runs #[ignore]d tests on BigLinux VM
    if: ${{ contains(github.event.pull_request.labels.*.name, 'ci:vm-smoke') }}
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: ssh + run ignored tests on VM
        env:
          H: ${{ secrets.BIGLINUX_VM_HOST }}
          U: ${{ secrets.BIGLINUX_VM_USER }}
          P: ${{ secrets.BIGLINUX_VM_PASS }}
        run: |
          set -euxo pipefail
          sudo apt-get install -y --no-install-recommends sshpass openssh-client rsync
          mkdir -p ~/.ssh && ssh-keyscan -H "$H" >> ~/.ssh/known_hosts 2>/dev/null
          REMOTE="/tmp/ci-${GITHUB_RUN_ID}"
          sshpass -p "$P" rsync -az --delete \
            --exclude target --exclude .git \
            ./ "$U@$H:$REMOTE/"
          sshpass -p "$P" ssh "$U@$H" "cd $REMOTE && cargo test --all-features -- --ignored"
          sshpass -p "$P" ssh "$U@$H" "rm -rf $REMOTE"

  appstream-validate:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: Install appstream
        run: sudo apt-get update && sudo apt-get install -y appstream
      - name: Validate AppStream metainfo
        run: |
          shopt -s nullglob
          files=(biglinux-webapps/usr/share/metainfo/*.metainfo.xml)
          if [ ${#files[@]} -eq 0 ]; then echo "no metainfo"; exit 0; fi
          appstreamcli validate --no-net --pedantic "${files[@]}"

  desktop-validate:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: Install desktop-file-utils
        run: sudo apt-get update && sudo apt-get install -y desktop-file-utils
      - name: Validate .desktop files
        run: |
          shopt -s nullglob
          files=(biglinux-webapps/usr/share/applications/*.desktop)
          if [ ${#files[@]} -eq 0 ]; then echo "no desktop"; exit 0; fi
          desktop-file-validate "${files[@]}"