ci.yml

# ReasonKit Web - CI Pipeline
# Production-grade Rust CI/CD following CONS-009 Quality Gates

name: CI

on:
  push:
    branches: [main, develop, feature/*]
    tags: ["v*.*.*"]
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"
  RUST_BACKTRACE: 1
  CARGO_INCREMENTAL: 0
  # Override .cargo/config.toml target-cpu=native to prevent SIGILL on different runners
  CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS: ""

jobs:
  # ===========================================================================
  # GATE 1: Build Matrix
  # ===========================================================================
  build:
    name: "Build (${{ matrix.os }})"
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
        with:
          toolchain: stable

      - name: Configure sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Cache Rust artifacts
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          prefix-key: "v1-build"
          shared-key: "${{ matrix.os }}"
          cache-on-failure: true

      - name: Build
        run: cargo build --release

      - name: Build (all features)
        run: cargo build --release --all-features

  # ===========================================================================
  # GATE 2: Lint with Clippy
  # ===========================================================================
  lint:
    name: "Gate 2: Clippy"
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
        with:
          toolchain: stable
          components: clippy

      - name: Configure sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Cache Rust artifacts
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          prefix-key: "v1-lint"
          cache-on-failure: true

      - name: Run Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

  # ===========================================================================
  # GATE 3: Format Check
  # ===========================================================================
  format:
    name: "Gate 3: Format"
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
        with:
          toolchain: stable
          components: rustfmt

      - name: Check formatting
        run: cargo fmt --all -- --check

  # ===========================================================================
  # GATE 4: Tests
  # ===========================================================================
  test:
    name: "Gate 4: Tests (${{ matrix.os }})"
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
        with:
          toolchain: stable

      - name: Configure sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Cache Rust artifacts
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          prefix-key: "v1-test"
          shared-key: "${{ matrix.os }}"
          cache-on-failure: true

      - name: Run tests
        run: cargo test --all-features

      - name: Run doc tests
        run: cargo test --doc

  # ===========================================================================
  # Documentation Build
  # ===========================================================================
  docs:
    name: "Documentation"
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
        with:
          toolchain: stable

      - name: Configure sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Cache Rust artifacts
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          prefix-key: "v1-docs"
          cache-on-failure: true

      # Use --features full to match docs.rs metadata configuration
      # (avoids wasm feature which requires wasm32 target not in docs.rs)
      - name: Build documentation
        run: cargo doc --no-deps --features full
        env:
          RUSTDOCFLAGS: "-D warnings"

  # ===========================================================================
  # Security Audit
  # ===========================================================================
  security:
    name: "Security Audit"
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
        with:
          toolchain: stable

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Run security audit
        run: cargo audit
        continue-on-error: true

  # ===========================================================================
  # CI Success Gate
  # ===========================================================================
  ci-success:
    name: "CI Success"
    runs-on: ubuntu-latest
    needs: [build, lint, format, test, docs]
    if: always()

    steps:
      - name: Check all required jobs
        run: |
          echo "## CI Pipeline Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Job | Result |" >> $GITHUB_STEP_SUMMARY
          echo "|-----|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Build | ${{ needs.build.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Lint | ${{ needs.lint.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Format | ${{ needs.format.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Test | ${{ needs.test.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Docs | ${{ needs.docs.result }} |" >> $GITHUB_STEP_SUMMARY

          for result in "${{ needs.build.result }}" "${{ needs.lint.result }}" "${{ needs.format.result }}" "${{ needs.test.result }}" "${{ needs.docs.result }}"; do
            if [ "$result" != "success" ]; then
              echo "**CI FAILED**" >> $GITHUB_STEP_SUMMARY
              exit 1
            fi
          done

          echo "**CI PASSED**" >> $GITHUB_STEP_SUMMARY