# Pull-request validation for Crucible. Releases and wrapper synchronization
# have their own narrow workflows because they need tag/main events.
name: ci

on:
  pull_request:

permissions: read-all

jobs:
  ci:
    runs-on: nix-docker
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: vet + test + lint
        run: |
          nix develop --command bash -c '
            set -euo pipefail
            go vet ./...
            go test ./...
            shellcheck scripts/*.sh
            yamllint .gitea
          '

      - name: binary smoke (fail-closed contract)
        run: nix develop --command make smoke

      - name: Cross-build all targets
        run: |
          nix develop --command bash -c '
            set -euo pipefail
            sha="$(git rev-parse --short=12 HEAD)"
            ldflags="-s -w -X git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/buildinfo.Version=${sha}"
            rm -rf dist && mkdir -p dist
            export CGO_ENABLED=0
            for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64; do
              os="${target%/*}"; arch="${target#*/}"
              ext=""; [ "$os" = windows ] && ext=".exe"
              echo "building crucible-${os}-${arch}${ext}"
              GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags "$ldflags" \
                -o "dist/crucible-${os}-${arch}${ext}" ./cmd/crucible
            done
          '