ci.yml

name: CI

on:
  push:
    branches: [master, main, develop]
  pull_request:
    branches: [master, main]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  # Nightly multithreaded frontend for faster compilation
  RUSTFLAGS: "-Zthreads=16"
  # Sparse registry for faster index updates
  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
  # Incremental compilation off for CI (more reproducible, better caching)
  CARGO_INCREMENTAL: 0

# Ensure only one CI run per branch at a time
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ==========================================================================
  # Setup job to prepare shared cache
  # ==========================================================================
  setup-cache:
    name: Setup Cache
    runs-on: ubuntu-latest
    outputs:
      cache-key: ${{ steps.cache-key.outputs.key }}
    steps:
      - uses: actions/checkout@v4
      
      - name: Generate cache key
        id: cache-key
        run: |
          echo "key=rust-${{ hashFiles('**/Cargo.lock', '**/Cargo.toml') }}" >> $GITHUB_OUTPUT

  # ==========================================================================
  # Fast checks (fmt, clippy) - Run in parallel
  # ==========================================================================
  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt
      
      - name: Check formatting
        run: cargo +nightly fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    needs: setup-cache
    steps:
      - uses: actions/checkout@v4
      
      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libglib2.0-dev
      
      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: clippy
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          prefix-key: "rust-clippy"
          shared-key: ${{ needs.setup-cache.outputs.cache-key }}
      
      - name: Run clippy
        run: cargo +nightly clippy --workspace --all-targets --all-features --exclude cortex-gui -- -D warnings

  # ==========================================================================
  # Test jobs - Matrix for all platforms
  # ==========================================================================
  test:
    name: Test (${{ matrix.name }})
    runs-on: ${{ matrix.runner }}
    needs: setup-cache
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: ubuntu
            runner: ubuntu-latest
          - name: macos
            runner: macos-latest
          - name: windows
            runner: windows-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Install Linux dependencies
        if: matrix.name == 'ubuntu'
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libglib2.0-dev
      
      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@nightly
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          prefix-key: "rust-test-${{ matrix.name }}"
          shared-key: ${{ needs.setup-cache.outputs.cache-key }}
      
      - name: Run tests
        run: cargo +nightly test --workspace --all-features --exclude cortex-gui
        env:
          RUSTFLAGS: "-Zthreads=16"

  # ==========================================================================
  # Build check - All platforms
  # ==========================================================================
  build-check:
    name: Build Check (${{ matrix.name }})
    runs-on: ${{ matrix.runner }}
    needs: setup-cache
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: ubuntu
            runner: ubuntu-latest
          - name: macos
            runner: macos-latest
          - name: windows
            runner: windows-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Install Linux dependencies
        if: matrix.name == 'ubuntu'
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libglib2.0-dev
      
      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@nightly
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          prefix-key: "rust-build-${{ matrix.name }}"
          shared-key: ${{ needs.setup-cache.outputs.cache-key }}
      
      - name: Check build
        run: cargo +nightly check --workspace --all-features --exclude cortex-gui
        env:
          RUSTFLAGS: "-Zthreads=16"

  # ==========================================================================
  # GUI Check - All platforms
  # ==========================================================================
  gui-check:
    name: GUI Check (${{ matrix.name }})
    runs-on: ${{ matrix.runner }}
    needs: setup-cache
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: ubuntu
            runner: ubuntu-latest
          - name: macos
            runner: macos-latest
          - name: windows
            runner: windows-latest
    steps:
      - uses: actions/checkout@v4
      
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "npm"
          cache-dependency-path: cortex-gui/package-lock.json
      
      - name: Install Linux dependencies
        if: matrix.name == 'ubuntu'
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libglib2.0-dev
      
      - name: Cache npm
        uses: actions/cache@v4
        with:
          path: |
            cortex-gui/node_modules
            ~/.npm
          key: npm-${{ matrix.name }}-${{ hashFiles('cortex-gui/package-lock.json') }}
          restore-keys: |
            npm-${{ matrix.name }}-
      
      - name: Install frontend dependencies
        working-directory: cortex-gui
        run: npm ci
      
      - name: Build frontend
        working-directory: cortex-gui
        run: npm run build
      
      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@nightly
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          prefix-key: "rust-gui-${{ matrix.name }}"
          shared-key: ${{ needs.setup-cache.outputs.cache-key }}
      
      - name: Check GUI build
        run: cargo +nightly check -p cortex-gui
        env:
          RUSTFLAGS: "-Zthreads=16"

  # ==========================================================================
  # Security Audit
  # ==========================================================================
  audit:
    name: Security Audit
    runs-on: ubuntu-latest
    permissions:
      checks: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      
      - name: Cache cargo-audit
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/cargo-audit
            ~/.cargo/advisory-db
          key: cargo-audit-${{ runner.os }}
      
      - uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  # ==========================================================================
  # Final status check (for branch protection)
  # ==========================================================================
  ci-success:
    name: CI Success
    runs-on: ubuntu-latest
    needs: [fmt, clippy, test, build-check, gui-check, audit]
    if: always()
    steps:
      - name: Check all jobs
        run: |
          if [[ "${{ needs.fmt.result }}" == "failure" || \
                "${{ needs.clippy.result }}" == "failure" || \
                "${{ needs.test.result }}" == "failure" || \
                "${{ needs.build-check.result }}" == "failure" || \
                "${{ needs.gui-check.result }}" == "failure" || \
                "${{ needs.audit.result }}" == "failure" ]]; then
            echo "One or more jobs failed"
            exit 1
          fi
          echo "All CI checks passed!"