name: CI

# Runs on the self-hosted host-mode runner on the desktop (label `arch`). The
# gitbutter VPS only queues the job; all compile/test compute happens locally.
on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

jobs:
  check:
    runs-on: arch
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Toolchain versions
        run: |
          rustc --version
          cargo --version
          cargo clippy --version
          cargo deny --version
          cargo audit --version

      - name: Format check
        run: cargo fmt --all -- --check

      - name: Clippy (all targets, warnings as errors)
        run: cargo clippy --all-targets -- -D warnings

      - name: Tests
        run: cargo test --all-targets

      - name: Doc tests
        run: cargo test --doc

      - name: cargo-deny (advisories, bans, licenses, sources)
        # --locked so the pinned, vetted versions in Cargo.lock are exactly
        # what get audited (the lockfile-as-review-checkpoint model).
        run: cargo deny --locked check

      - name: cargo-audit
        run: cargo audit
