name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -Dwarnings

jobs:
  fmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --all-targets -- -D warnings

  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --verbose
      - name: Run binary smoke tests
        run: |
          cargo run -- --help
          cargo run -- --version
          cargo run -- -l src/
          cargo run -- --tree --depth 1 src/

  build:
    name: Build (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --release
      - name: Upload binary
        uses: actions/upload-artifact@v4
        with:
          name: lsf-${{ matrix.os }}
          path: target/release/lsf

  audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: rustsec/audit-check@v2.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  msrv:
    name: MSRV Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.74
      - uses: Swatinem/rust-cache@v2
      - run: cargo check

  # This job gates merges — add it as a required status check in branch protection
  ci-pass:
    name: CI Pass
    if: always()
    needs: [fmt, clippy, test, build, audit, msrv]
    runs-on: ubuntu-latest
    steps:
      - name: Check all jobs passed
        run: |
          if [[ "${{ needs.fmt.result }}" != "success" ]]; then
            echo "fmt failed"
            exit 1
          fi
          if [[ "${{ needs.clippy.result }}" != "success" ]]; then
            echo "clippy failed"
            exit 1
          fi
          if [[ "${{ needs.test.result }}" != "success" ]]; then
            echo "test failed"
            exit 1
          fi
          if [[ "${{ needs.build.result }}" != "success" ]]; then
            echo "build failed"
            exit 1
          fi
          if [[ "${{ needs.audit.result }}" != "success" ]]; then
            echo "audit failed"
            exit 1
          fi
          if [[ "${{ needs.msrv.result }}" != "success" ]]; then
            echo "msrv check failed"
            exit 1
          fi
          echo "All CI checks passed!"