name: CI

on:
  pull_request:
  push:

permissions:
  contents: read

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - run: cargo --version
      - run: cargo install --locked cargo-deny --version 0.20.2
      - run: cargo fmt --check
      - run: cargo clippy --all-targets --all-features -- -D warnings
      - run: cargo test --locked --all-targets --all-features
      - run: cargo deny check advisories licenses sources
      - run: cargo build --locked --release

  release:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - run: cargo --version
      - run: cargo test --locked --all-targets --all-features
      - run: cargo test --locked --release --test auth --test ssh --test account_lifecycle --test web_session --test repository_policy
      - run: cargo test --locked --release --test git_repository --test git_http --test git_ssh --test public_routes
      - run: cargo test --locked --release --test git_reads measures_bounded_search_without_an_index -- --ignored --nocapture
      - run: cargo test --locked --release --test sqlite_workload -- --ignored --nocapture
      - run: cargo build --locked --release
      - run: wc -c target/release/tit
      - run: ./scripts/package-release target/release/tit dist
      - name: Verify the release artifact
        run: |
          set -- dist/*.tar.gz
          ./scripts/verify-release-artifact "$1" "$1.sha256"
          mkdir release-test
          tar -xzf "$1" -C release-test
          set -- release-test/tit-*/bin/tit
          TIT_RELEASE_BINARY="$(pwd)/$1" cargo test --locked --release --test serve
      - name: Store the release artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: tit-${{ runner.os }}-${{ runner.arch }}
          path: dist/*
          if-no-files-found: error

  bsd:
    name: release (${{ matrix.platform.name }})
    runs-on: ubuntu-latest
    timeout-minutes: 60
    continue-on-error: ${{ matrix.platform.experimental }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - name: FreeBSD 15.1
            os: freebsd
            version: '15.1'
            install: sudo pkg install -y git rust
            experimental: false
          - name: OpenBSD 7.9
            os: openbsd
            version: '7.9'
            install: sudo pkg_add git rust
            experimental: true
          - name: NetBSD 10.1
            os: netbsd
            version: '10.1'
            install: sudo pkgin -y install git-base rust
            experimental: false
    env:
      CARGO_INCREMENTAL: 0
      CARGO_PROFILE_TEST_DEBUG: 0
    defaults:
      run:
        shell: cpa.sh {0}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Start ${{ matrix.platform.name }}
        uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
        with:
          operating_system: ${{ matrix.platform.os }}
          version: ${{ matrix.platform.version }}
          cpu_count: 4
          memory: 6G
      - name: Install build and test tools
        run: ${{ matrix.platform.install }}
      - run: cargo --version
      - run: cargo test --locked --release --all-targets --all-features
      - run: cargo build --locked --release
      - run: wc -c target/release/tit
      - run: ./scripts/package-release target/release/tit dist
      - name: Verify the release artifact
        run: |
          set -- dist/*.tar.gz
          ./scripts/verify-release-artifact "$1" "$1.sha256"
      - name: Store the release artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: tit-${{ matrix.platform.os }}-X64
          path: dist/*
          if-no-files-found: error

  publish:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [quality, release, bsd]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download release artifacts
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          path: release-artifacts
      - name: Publish the GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -- release-artifacts/tit-Linux-*/*.tar.gz
          case "$(basename "$1")" in
            "tit-${GITHUB_REF_NAME#v}-"*) ;;
            *) echo "The tag does not match the package version." >&2; exit 1 ;;
          esac
          gh release create "$GITHUB_REF_NAME" release-artifacts/*/* --verify-tag --generate-notes
