ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -D warnings

jobs:
  version:
    name: Version
    runs-on: ubuntu-latest
    outputs:
      semver: ${{ steps.gitversion.outputs.semVer }}
      major: ${{ steps.gitversion.outputs.major }}
      minor: ${{ steps.gitversion.outputs.minor }}
      patch: ${{ steps.gitversion.outputs.patch }}
      prerelease: ${{ steps.gitversion.outputs.preReleaseLabel }}
      nuget: ${{ steps.gitversion.outputs.semVer }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Verify GitVersion and Cargo baseline versions are aligned
        run: ./scripts/check-version-sync.sh
      - uses: gittools/actions/gitversion/setup@v4.3.3
        with:
          versionSpec: '6.x'
      - id: gitversion
        uses: gittools/actions/gitversion/execute@v4.3.3

  fmt:
    name: rustfmt
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v6
      - run: rustup component add rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
      - uses: Swatinem/rust-cache@v2
      - run: rustup component add clippy
      - run: cargo clippy --all-targets --all-features -- -D warnings

  clippy-strict:
    name: clippy strict
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
      - uses: Swatinem/rust-cache@v2
      - run: rustup component add clippy
      - run: cargo clippy --workspace --lib --bins --examples -- -D warnings -D clippy::unwrap_used -D clippy::expect_used

  clippy-pedantic:
    name: clippy pedantic (advisory)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
      - uses: Swatinem/rust-cache@v2
      - run: rustup component add clippy
      - name: Run pedantic audit (non-blocking)
        run: |
          cargo clippy --workspace --all-targets --all-features -- -D warnings -W clippy::pedantic || {
            echo "::warning::Pedantic lint debt detected (non-blocking advisory job)."
          }

  rust-test:
    name: Rust tests (${{ matrix.name }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            name: Linux x64
            cache_key: linux-test
          - os: windows-latest
            name: Windows x64
            cache_key: windows-test
          - os: macos-latest
            name: macOS
            cache_key: macos-test
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.cache_key }}
      - run: cargo test --release

  rust-artifacts:
    name: Rust artifacts (${{ matrix.name }})
    if: github.event_name == 'push'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            name: Linux x64
            cache_key: linux-artifacts
            artifact_name: linux-x64
            artifact_path: |
              target/release/libsurge.so
              target/release/surge
              target/release/surge-installer
              target/release/surge-installer-ui
              target/release/surge-supervisor
          - os: ubuntu-24.04-arm
            name: Linux arm64
            cache_key: linux-arm64-artifacts
            artifact_name: linux-arm64
            artifact_path: |
              target/release/libsurge.so
              target/release/surge
              target/release/surge-installer
              target/release/surge-installer-ui
              target/release/surge-supervisor
          - os: windows-latest
            name: Windows x64
            cache_key: windows-artifacts
            artifact_name: win-x64
            artifact_path: |
              target/release/surge.dll
              target/release/surge.dll.lib
              target/release/surge.exe
              target/release/surge-installer.exe
              target/release/surge-installer-ui.exe
              target/release/surge-supervisor.exe
          - os: macos-latest
            name: macOS
            cache_key: macos-artifacts
            artifact_name: osx-x64
            artifact_path: |
              target/release/libsurge.dylib
              target/release/surge
              target/release/surge-installer
              target/release/surge-installer-ui
              target/release/surge-supervisor
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.cache_key }}
      - run: cargo build --release
      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.artifact_name }}
          path: ${{ matrix.artifact_path }}

  dotnet:
    name: .NET
    runs-on: ubuntu-latest
    needs: [version]
    defaults:
      run:
        working-directory: dotnet
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'
      - uses: actions/cache@v5
        with:
          path: ~/.nuget/packages
          key: nuget-${{ hashFiles('dotnet/Directory.Packages.props') }}
          restore-keys: nuget-
      - run: dotnet restore
      - run: dotnet format --verify-no-changes --verbosity diagnostic
      - run: dotnet build --no-restore --configuration Release -p:Version=${{ needs.version.outputs.semver }}
      - run: dotnet test --no-build --configuration Release --verbosity normal

  nuget:
    name: Publish NuGet
    runs-on: ubuntu-latest
    needs: [version, clippy, clippy-strict, rust-test, rust-artifacts, dotnet]
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
    defaults:
      run:
        working-directory: dotnet
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'
      - uses: actions/cache@v5
        with:
          path: ~/.nuget/packages
          key: nuget-${{ hashFiles('dotnet/Directory.Packages.props') }}
          restore-keys: nuget-
      - name: Pack
        run: dotnet pack Surge.NET/Surge.NET.csproj --configuration Release -p:Version=${{ needs.version.outputs.nuget }} --output ../nupkgs
      - name: Push to NuGet
        run: dotnet nuget push ../nupkgs/*.nupkg --source nuget.org --api-key ${{ secrets.PETERSUNDE_NUGET_ORG_API_KEY }} --skip-duplicate

  cargo-crates-io-publish:
    name: Publish Cargo (crates.io)
    runs-on: ubuntu-latest
    needs: [version, clippy, clippy-strict, rust-test, rust-artifacts, dotnet]
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
    env:
      CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
      - uses: Swatinem/rust-cache@v2
      - name: Validate crates.io API token
        run: |
          if [ -z "${CARGO_REGISTRY_TOKEN}" ]; then
            echo "CARGO_REGISTRY_TOKEN secret is required for crates.io publish."
            exit 1
          fi
      - name: Set version
        run: |
          sed -i 's/^version = ".*"/version = "${{ needs.version.outputs.semver }}"/' Cargo.toml
          sed -i -E 's|surge-core = \{ path = "crates/surge-core", version = ".*"(, registry = "surge")? \}|surge-core = { path = "crates/surge-core", version = "${{ needs.version.outputs.semver }}" }|' Cargo.toml
          cargo generate-lockfile
      - name: Publish surge-core to crates.io
        run: cargo publish -p surge-core --allow-dirty
      - name: Publish surge-cli to crates.io
        run: |
          for attempt in $(seq 1 10); do
            if cargo publish -p surge-cli --allow-dirty; then
              exit 0
            fi
            if [ "${attempt}" -eq 10 ]; then
              echo "Failed to publish surge-cli after waiting for surge-core to sync on crates.io."
              exit 1
            fi
            sleep $((attempt * 5))
          done

  cargo-cloudsmith-publish:
    name: Publish Cargo (Cloudsmith)
    runs-on: ubuntu-latest
    needs: [version, clippy, clippy-strict, rust-test, rust-artifacts, dotnet]
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
    env:
      CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
      CLOUDSMITH_NAMESPACE: finter-as
      CLOUDSMITH_REPOSITORY: surge
      CARGO_REGISTRIES_SURGE_INDEX: sparse+https://cargo.cloudsmith.io/finter-as/surge/
      CARGO_REGISTRIES_SURGE_TOKEN: ${{ secrets.CLOUDSMITH_API_KEY }}
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
      - uses: Swatinem/rust-cache@v2
      - name: Validate Cloudsmith API key
        run: |
          if [ -z "${CLOUDSMITH_API_KEY}" ]; then
            echo "CLOUDSMITH_API_KEY secret is required for cargo publish."
            exit 1
          fi
      - name: Set version
        run: |
          sed -i 's/^version = ".*"/version = "${{ needs.version.outputs.semver }}"/' Cargo.toml
          sed -i -E 's|surge-core = \{ path = "crates/surge-core", version = ".*"(, registry = "surge")? \}|surge-core = { path = "crates/surge-core", version = "${{ needs.version.outputs.semver }}", registry = "surge" }|' Cargo.toml
          cargo generate-lockfile
      - name: Install Cloudsmith CLI
        run: |
          python3 -m pip install --upgrade pip
          python3 -m pip install cloudsmith-cli
      - name: Ensure Cloudsmith repository exists
        run: |
          if ! cloudsmith repos list "${CLOUDSMITH_NAMESPACE}" --output-format json --api-key "${CLOUDSMITH_API_KEY}" | jq -e --arg slug "${CLOUDSMITH_REPOSITORY}" '.data[] | select(.slug == $slug)' >/dev/null; then
            cat > cloudsmith-repo.json <<EOF
          {"name":"surge","description":"Public Cargo registry for Surge pre-releases","repository_type_str":"Public","slug":"surge"}
          EOF
            cloudsmith repos create "${CLOUDSMITH_NAMESPACE}" cloudsmith-repo.json --api-key "${CLOUDSMITH_API_KEY}"
          fi
      - name: Publish surge-core to Cloudsmith Cargo registry
        run: |
          cargo publish -p surge-core --registry surge --allow-dirty
      - name: Publish surge-supervisor to Cloudsmith Cargo registry
        run: |
          for attempt in $(seq 1 10); do
            if cargo publish -p surge-supervisor --registry surge --allow-dirty; then
              exit 0
            fi
            if [ "${attempt}" -eq 10 ]; then
              echo "Failed to publish surge-supervisor after waiting for surge-core to sync in registry."
              exit 1
            fi
            sleep $((attempt * 5))
          done
      - name: Publish surge-installer to Cloudsmith Cargo registry
        run: |
          for attempt in $(seq 1 10); do
            if cargo publish -p surge-installer --registry surge --allow-dirty; then
              exit 0
            fi
            if [ "${attempt}" -eq 10 ]; then
              echo "Failed to publish surge-installer after waiting for surge-core to sync in registry."
              exit 1
            fi
            sleep $((attempt * 5))
          done
      - name: Publish surge-installer-ui to Cloudsmith Cargo registry
        run: |
          for attempt in $(seq 1 10); do
            if cargo publish -p surge-installer-ui --registry surge --allow-dirty; then
              exit 0
            fi
            if [ "${attempt}" -eq 10 ]; then
              echo "Failed to publish surge-installer-ui after waiting for surge-core to sync in registry."
              exit 1
            fi
            sleep $((attempt * 5))
          done
      - name: Publish surge-cli to Cloudsmith Cargo registry
        run: |
          for attempt in $(seq 1 10); do
            if cargo publish -p surge-cli --registry surge --allow-dirty; then
              exit 0
            fi
            if [ "${attempt}" -eq 10 ]; then
              echo "Failed to publish surge-cli after waiting for surge-core to sync in registry."
              exit 1
            fi
            sleep $((attempt * 5))
          done

  release:
    name: Draft Release
    runs-on: ubuntu-latest
    needs: [version, clippy, clippy-strict, rust-test, rust-artifacts, dotnet]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts

      - name: Package release assets
        run: |
          cd artifacts
          tar czf ../surge-linux-x64.tar.gz -C linux-x64 .
          tar czf ../surge-osx-x64.tar.gz -C osx-x64 .
          cd win-x64 && zip -r ../../surge-win-x64.zip . && cd ..

      - name: Create draft release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.version.outputs.semver }}
          name: v${{ needs.version.outputs.semver }}
          draft: true
          generate_release_notes: true
          files: |
            surge-linux-x64.tar.gz
            surge-osx-x64.tar.gz
            surge-win-x64.zip
            include/surge/surge_api.h