picoforge/.github/workflows/ci.yml

name: PicoForge CI

on:
  push:
    branches:
      - "**"
  pull_request:
    branches:
      - "**"

env:
  CARGO_TERM_COLOR: always

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  checks:
    name: Code Quality Checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: install dependencies (linux)
        run: |
          sudo apt-get update
          sudo apt install -y \
            pkg-config libpcsclite-dev libudev-dev libvulkan-dev \
            libwayland-dev wayland-protocols libxkbcommon-dev \
            libxcb1-dev libxkbcommon-x11-dev libfontconfig1-dev \
            libasound2-dev libdbus-1-dev libx11-dev \
            libxcb-shape0-dev libxcb-xfixes0-dev libusb-1.0-0-dev

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Run cargo check
        run: cargo check --all-targets

      - name: Run clippy
        run: cargo clippy --all-targets -- -D warnings

      - name: Check for missing documentation
        run: RUSTFLAGS="-D missing_docs" cargo check --all-targets

      - name: Check documentation builds cleanly
        run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --document-private-items

      - name: Build project
        run: cargo build --verbose

      - name: Run tests
        run: cargo test --verbose

  verify-build:
    name: Build (${{ matrix.platform }} / ${{ matrix.target }})
    needs: checks
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            target: aarch64-apple-darwin
          - platform: macos-latest
            target: x86_64-apple-darwin
          - platform: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
          - platform: windows-latest
            target: x86_64-pc-windows-msvc
          - platform: windows-latest
            target: i686-pc-windows-msvc
          - platform: windows-latest
            target: aarch64-pc-windows-msvc
    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v7

      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.platform }}-${{ matrix.target }}

      - name: install dependencies (linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt install -y \
            pkg-config libpcsclite-dev libudev-dev libvulkan-dev \
            libwayland-dev wayland-protocols libxkbcommon-dev \
            libxcb1-dev libxkbcommon-x11-dev libfontconfig1-dev \
            libasound2-dev libdbus-1-dev libx11-dev \
            libxcb-shape0-dev libxcb-xfixes0-dev libusb-1.0-0-dev

      - name: Build
        run: cargo build --verbose --target ${{ matrix.target }}

  audit:
    name: Security Audit
    needs: checks
    runs-on: ubuntu-latest
    permissions:
      checks: write
    steps:
      - uses: actions/checkout@v7
      - uses: rustsec/audit-check@858dc40f52ca2b8570b7a997c1c4e35c6fc9a432
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  codeql:
    name: CodeQL Analysis
    needs: checks
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: rust
          build-mode: none

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4