name: Rust

on:
  push:
    branches: [main]
    paths:
      - "lib/apps/**"
      - "lib/components/**"
      - "lib/foundation/**"
      - "test/**"
      - "Cargo.toml"
      - "Cargo.lock"
      - ".cargo/**"
      - ".config/**"
      - "bin/dev/**"
      - "docs/public/reference/cli.mdx"
      - "docs/public/reference/user-configuration.mdx"
      - "openapi/**"
      - ".github/workflows/rust.yml"
  pull_request:
    branches: [main]
    paths:
      - "lib/apps/**"
      - "lib/components/**"
      - "lib/foundation/**"
      - "test/**"
      - "Cargo.toml"
      - "Cargo.lock"
      - ".cargo/**"
      - ".config/**"
      - "bin/dev/**"
      - "docs/public/reference/cli.mdx"
      - "docs/public/reference/user-configuration.mdx"
      - "openapi/**"
      - ".github/workflows/rust.yml"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

env:
  CARGO_TERM_COLOR: always
  CARGO_NET_RETRY: "10"

jobs:
  fmt:
    name: Format
    runs-on: ubuntu-24.04-x86-32-cores
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
        with:
          toolchain: nightly-2026-04-14
          components: rustfmt
      - run: cargo +nightly-2026-04-14 fmt --check --all

  clippy:
    name: Clippy
    runs-on: ubuntu-24.04-x86-32-cores
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
        with:
          toolchain: nightly-2026-04-14
          components: clippy
      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          cache-on-failure: true
      - name: Verify legacy auth identity removal
        run: |
          if git grep -nE 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*"disabled"' \
            -- lib/apps lib/components lib/foundation apps lib/packages docs/public/api-reference/fabro-api.yaml; then
            echo "::error::Legacy auth identities remain in the repository"
            exit 1
          else
            status=$?
            if [ "$status" -ne 1 ]; then
              exit "$status"
            fi
          fi
      - run: cargo +nightly-2026-04-14 clippy --locked --workspace --all-targets -- -D warnings

  generated-docs:
    name: Generated Docs
    runs-on: ubuntu-24.04-x86-32-cores
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          cache-on-failure: true
      - run: cargo --locked dev docs check

  test:
    name: Test (Linux)
    runs-on: ubuntu-24.04-x86-32-cores
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          cache-on-failure: true
      - uses: taiki-e/install-action@773334c0e05d7e699e4d78234494308223f3a2cf # nextest
      - run: cargo nextest run --locked --workspace --status-level slow --profile ci
      # Twin-mode e2e suites. These are hermetic (in-process twin provider, no
      # secrets): FABRO_TEST_MODE defaults to twin, so live-only tests
      # self-skip. Scoped to the packages whose ignored tests are fully green
      # in twin mode; widen as the remaining suites are fixed up for CI.
      # Must not use the e2e nextest profile here: NEXTEST_PROFILE=e2e implies
      # strict mode, which fails (rather than skips) live tests without keys.
      - run: cargo nextest run --locked --workspace --status-level slow --profile ci --run-ignored only -E 'package(fabro-agent) + package(fabro-llm) + package(twin-openai)'

  test-macos:
    name: Test (macOS)
    if: github.event_name == 'workflow_dispatch'
    runs-on: macos-15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          cache-on-failure: true
      - uses: taiki-e/install-action@773334c0e05d7e699e4d78234494308223f3a2cf # nextest
      - run: cargo nextest run --locked --workspace --status-level slow --profile ci