max-sixty__worktrunk/.github/workflows/ci.yaml

name: ci

# Runner versions are pinned to avoid surprise breaking changes from -latest migrations.
# The tend-weekly workflow checks for updates and opens bump PRs (see
# .claude/skills/running-tend/SKILL.md → "Weekly Maintenance: CI Pin Bumps").
# - windows-2025: Pinned to current -latest equivalent
# - ubuntu-24.04, macos-26: Pinned to current -latest equivalents

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always
  # CI does clean builds, so incremental compilation tracking adds I/O overhead
  # with no benefit. Especially impactful on Windows where I/O is the bottleneck.
  CARGO_INCREMENTAL: 0
  RUSTFLAGS: -C debuginfo=0

jobs:
  lint:
    runs-on: ubuntu-24.04
    steps:
    - name: 📂 Checkout code
      uses: actions/checkout@v7

    - name: 💰 Cache
      uses: Swatinem/rust-cache@v2
      with:
        # Own cache (clippy builds check artifacts the shared test cache can't
        # supply), gated to main so PRs restore but never write.
        cache-bin: "false"
        save-if: ${{ github.ref == 'refs/heads/main' }}

    - name: 🔍 Pre-commit hooks
      uses: pre-commit/action@v3.0.1

  feature-check:
    # Guards the library/CLI cleave: the `cli` feature gates clap, skim,
    # crossterm, termimad, env_logger, humantime. If anything reachable from
    # `pub mod` in src/lib.rs starts using one of those crates, library
    # consumers (e.g. worktrunk-sync) would silently regain the transitive
    # dependency graph. These checks fail before that can ship.
    runs-on: ubuntu-24.04
    steps:
    - name: 📂 Checkout code
      uses: actions/checkout@v7

    - name: 💰 Cache
      uses: Swatinem/rust-cache@v2
      with:
        # Own cache (its `--no-default-features` builds want a smaller dep set
        # than the shared test cache), gated to main.
        cache-bin: "false"
        save-if: ${{ github.ref == 'refs/heads/main' }}

    - name: Library builds without any features
      run: cargo check --lib --no-default-features

    - name: Library builds with syntax-highlighting only
      run: cargo check --lib --no-default-features --features syntax-highlighting

    - name: Binary builds without syntax-highlighting
      run: cargo check --bin wt --no-default-features --features cli

  test:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            name: linux
          - os: macos-26
            name: macos
          - os: windows-2025
            name: windows
    name: test (${{ matrix.name }})
    runs-on: ${{ matrix.os }}

    steps:
    - name: 📂 Checkout code
      uses: actions/checkout@v7

    - uses: ./.github/actions/test-setup

    - name: Install wt
      uses: baptiste0928/cargo-install@v3
      with:
        crate: worktrunk
        version: "=0.75.0"

    - name: "Use fast D: drive for temp files (Windows)"
      if: runner.os == 'Windows'
      shell: pwsh
      run: |
        New-Item -ItemType Directory -Force -Path "D:\tmp" | Out-Null
        echo "TEMP=D:\tmp" >> $env:GITHUB_ENV
        echo "TMP=D:\tmp" >> $env:GITHUB_ENV

    # The full nextest suite (snapshots included) — CI's long-pole. The fast
    # pre-merge gates (lockfile/doctest/rustdoc) live in the `fast-checks` job,
    # so this job is now just the suite and can later be swapped for the
    # cargo-affected legs on PRs without disturbing those gates. The `insta`
    # step runs `--unreferenced reject` on Linux (orphan-snapshot detection) —
    # an intrinsically full-suite check that rides this job on push-to-main and,
    # after the flip, stays there.
    - name: 🧪 Full test suite
      run: wt hook pre-merge --yes insta

    # Anything tests leave behind in the working tree is a leak we want to see
    # before it lands. `target/` is gitignored, so a normal run is clean —
    # untracked files here mean a test wrote outside its sandbox (the
    # `default_*.profraw` stray that prompted this guard is the canonical case).
    - name: 🧹 Verify clean working tree
      shell: bash
      run: |
        if [ -n "$(git status --porcelain)" ]; then
          echo "::error::tests left files behind in the working tree:"
          git status --porcelain
          exit 1
        fi

    - name: 📊 Upload test timing
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: junit-${{ matrix.name }}
        path: target/nextest/default/junit.xml

    - name: 📊 Upload test results to Codecov
      if: ${{ !cancelled() }}
      uses: codecov/codecov-action@v7.0.0
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        files: target/nextest/default/junit.xml
        report_type: test_results

  # The pre-merge gates that aren't the nextest suite: Cargo.lock freshness,
  # doctests, and the rustdoc `-Dwarnings` build. Split out of `test` so the
  # full suite (the long-pole) can later be replaced on PRs by the
  # cargo-affected legs without dropping these — they stay required and
  # untouched by that flip. Linux-only: all three are platform-independent. The
  # one blind spot is doc/doctest inside `#[cfg(windows)]` / `#[cfg(target_os
  # = …)]` code, which only the full `test` matrix compiles; acceptable for a
  # gate whose job is broken links and stale locks, not platform behavior.
  fast-checks:
    runs-on: ubuntu-24.04
    steps:
    - name: 📂 Checkout code
      uses: actions/checkout@v7

    - uses: ./.github/actions/test-setup

    - name: Install wt
      uses: baptiste0928/cargo-install@v3
      with:
        crate: worktrunk
        version: "=0.75.0"

    - name: 🧪 Lockfile, doctests, rustdoc
      run: wt hook pre-merge --yes lockfile doctest doc

  # Check if Cargo/CI files changed (for conditional jobs below)
  changes:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: read
    outputs:
      cargo: ${{ steps.filter.outputs.cargo }}
      docs: ${{ steps.filter.outputs.docs }}
    steps:
    - name: 📂 Checkout code
      uses: actions/checkout@v7
    - uses: dorny/paths-filter@v4
      id: filter
      with:
        filters: |
          cargo:
            - 'Cargo.toml'
            - 'Cargo.lock'
            - 'rust-toolchain.toml'
            - '.github/workflows/ci.yaml'
          docs:
            - 'docs/**'
            - 'src/cli/mod.rs'
            - '.github/actions/docs-build/**'
            - '.github/workflows/ci.yaml'
            - '.github/workflows/nightly.yaml'
            - '.github/workflows/publish-docs.yaml'

  msrv:
    runs-on: ubuntu-24.04
    needs: changes
    if: needs.changes.outputs.cargo == 'true' || github.event_name == 'workflow_dispatch'
    steps:
    - name: 📂 Checkout code
      uses: actions/checkout@v7

    - name: 💰 Cache
      uses: Swatinem/rust-cache@v2
      with:
        # Own cache — `cargo msrv verify` builds with older toolchains whose
        # rustc hash never matches the shared (stable) test cache. Gated to
        # main; this job only runs when Cargo/toolchain files change.
        cache-bin: "false"
        save-if: ${{ github.ref == 'refs/heads/main' }}

    - uses: baptiste0928/cargo-install@v3
      with:
        crate: cargo-msrv
        version: "=0.19.3"

    - name: Verify minimum rust version
      run: cargo msrv verify

  check-docs:
    runs-on: ubuntu-24.04
    needs: changes
    if: needs.changes.outputs.docs == 'true' || github.event_name == 'workflow_dispatch'
    steps:
    - name: 📂 Checkout code
      uses: actions/checkout@v7

    - name: 🕷️ Check and build docs
      uses: ./.github/actions/docs-build