name: ci

on:
  push:
    branches: ["**"]
  pull_request:

jobs:
  rust:
    name: cargo check + cargo test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkout oboe-rs fork
        run: git clone --depth 1 https://github.com/edisonjwa/oboe-rs.git ../oboe-rs
      - name: System deps (cpal / Opus / SQLite)
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libasound2-dev libpulse-dev pkg-config \
            libopus-dev
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: cargo check --workspace
        run: cargo check --workspace --locked
      - name: cargo test --workspace
        env:
          # Storage tests must not hit the real OS keyring on CI:
          # there is no D-Bus session available and the call would
          # block. The runtime code carries the same toggle for
          # headless / sandboxed environments.
          CHANORA_DISABLE_KEYRING: "1"
        run: cargo test --workspace --locked --no-fail-fast
      - name: cargo clippy
        run: cargo clippy --workspace --all-targets -- -D warnings
        continue-on-error: true

  supply-chain:
    name: cargo deny (licenses + advisories + bans + sources)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkout oboe-rs fork
        run: git clone --depth 1 https://github.com/edisonjwa/oboe-rs.git ../oboe-rs
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check
          # `licenses` enforces the DEC-020 license posture; the
          # other three are minimal supply-chain hygiene per
          # `docs/governance/legal-review-readiness.md` §5.
          arguments: --workspace --all-features

  license-inventory:
    name: cargo about (license inventory)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkout oboe-rs fork
        run: git clone --depth 1 https://github.com/edisonjwa/oboe-rs.git ../oboe-rs
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install cargo-about
        run: cargo install --locked --features cli cargo-about
      - name: Regenerate inventory and compare
        # Build the inventory in a temp file and diff against the
        # committed copy. CI fails when the committed inventory is
        # stale, forcing contributors to run the tool locally
        # before opening a PR that touches the dependency tree.
        run: |
          cargo about generate --output-file /tmp/license-inventory.md about-md.hbs
          diff docs/security/license-inventory.md /tmp/license-inventory.md \
            || { echo "::error::docs/security/license-inventory.md is stale; regenerate with 'cargo about generate --output-file docs/security/license-inventory.md about-md.hbs'"; exit 1; }

  flutter-license-inventory:
    name: flutter license inventory
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: subosito/flutter-action@v2
        with:
          channel: stable
      - name: flutter pub get
        working-directory: apps/chanora_flutter
        run: flutter pub get
      - name: Regenerate Flutter license inventory and compare
        env:
          # Resolved by the wrapper from $HOME/sdks/flutter when
          # not set; CI's subosito/flutter-action puts flutter on
          # PATH but exports the SDK root under FLUTTER_ROOT.
          FLUTTER_ROOT: ${{ env.FLUTTER_ROOT }}
        run: |
          ./tools/dump_flutter_licenses.sh
          if ! git diff --quiet docs/security/flutter-license-inventory.md; then
            echo "::error::docs/security/flutter-license-inventory.md is stale; regenerate with 'tools/dump_flutter_licenses.sh'"
            git --no-pager diff docs/security/flutter-license-inventory.md | head -40
            exit 1
          fi

  flutter:
    name: flutter analyze
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: subosito/flutter-action@v2
        with:
          channel: stable
      - name: flutter pub get
        working-directory: apps/chanora_flutter
        run: flutter pub get
      - name: flutter analyze
        working-directory: apps/chanora_flutter
        run: flutter analyze
      - name: flutter test (unit only)
        working-directory: apps/chanora_flutter
        run: flutter test --exclude-tags e2e

  flutter-ios-release-build:
    name: flutter iOS unsigned release build
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkout oboe-rs fork
        run: git clone --depth 1 https://github.com/edisonjwa/oboe-rs.git ../oboe-rs
      - uses: subosito/flutter-action@v2
        with:
          channel: stable
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: flutter pub get
        working-directory: apps/chanora_flutter
        run: flutter pub get
      - name: flutter build ios --no-codesign
        working-directory: apps/chanora_flutter
        run: flutter build ios --release --no-codesign

  flutter-linux-release-package:
    name: flutter Linux release package (.deb)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkout oboe-rs fork
        run: git clone --depth 1 https://github.com/edisonjwa/oboe-rs.git ../oboe-rs
      - name: System deps (Flutter Linux + audio + packaging)
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            clang cmake ninja-build pkg-config libgtk-3-dev liblzma-dev \
            libasound2-dev libpulse-dev libopus-dev libsdl2-dev
      - uses: subosito/flutter-action@v2
        with:
          channel: stable
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Build Linux .deb package
        run: ./tools/build-linux-deb.sh
      - name: Upload Linux package artifact
        uses: actions/upload-artifact@v4
        with:
          name: chanora-linux-deb
          path: dist/linux/*.deb

  flutter-android-release-aab:
    name: flutter Android release AAB
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkout oboe-rs fork
        run: git clone --depth 1 https://github.com/edisonjwa/oboe-rs.git ../oboe-rs
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
      - uses: android-actions/setup-android@v3
      - uses: subosito/flutter-action@v2
        with:
          channel: stable
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,x86_64-linux-android
      - uses: Swatinem/rust-cache@v2
      - name: Install cargo-ndk
        run: cargo install --locked cargo-ndk
      - name: Build Android release AAB
        run: ./tools/build-android-aab.sh
      - name: Upload Android bundle artifact
        uses: actions/upload-artifact@v4
        with:
          name: chanora-android-aab
          path: dist/android/*.aab