name: CI

on:
  push:
    branches: [main]
  pull_request:

env:
  CARGO_TERM_COLOR: always
  # Ride out transient crates.io/registry blips instead of failing the job.
  CARGO_NET_RETRY: "10"

jobs:
  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - run: cargo fmt --all --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: Swatinem/rust-cache@v2
      # pre-installed tools: https://github.com/actions/runner-images/blob/main/images/ubuntu/
      - run: sudo apt-get update && sudo apt-get install -y libpam0g-dev libselinux1-dev libaudit-dev libcrypt-dev
      - run: cargo clippy --workspace --all-targets -- -D warnings

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: Swatinem/rust-cache@v2
      - run: sudo apt-get update && sudo apt-get install -y libpam0g-dev libselinux1-dev libaudit-dev libcrypt-dev
      - run: cargo test --workspace

  msrv:
    name: MSRV (1.94.0)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@1.94.0
      - uses: Swatinem/rust-cache@v2
      - run: sudo apt-get update && sudo apt-get install -y libpam0g-dev libselinux1-dev libaudit-dev libcrypt-dev
      - run: cargo check --workspace

  deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: EmbarkStudios/cargo-deny-action@v2

  test-docker:
    name: Test (${{ matrix.target }})
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    strategy:
      # One distro's transient registry timeout must not cancel the others.
      fail-fast: false
      matrix:
        target: [debian, alpine, fedora]
    steps:
      - uses: actions/checkout@v6
      # Base images are pulled from Docker Hub at build time; retry to ride
      # out transient registry timeouts that would otherwise fail the job.
      - name: Build ${{ matrix.target }} image
        run: |
          for attempt in 1 2 3; do
            docker compose build ${{ matrix.target }} && exit 0
            if [ "$attempt" -lt 3 ]; then
              echo "::warning::'${{ matrix.target }}' image build attempt $attempt failed (likely a registry timeout); retrying in 30s"
              sleep 30
            fi
          done
          exit 1
      # Forward the workflow-wide CARGO_NET_RETRY into the container (single
      # source of truth) so cargo retries crate downloads; a real test failure
      # still fails fast (no step-level retry).
      - name: Test on ${{ matrix.target }}
        run: docker compose run --rm -e CARGO_NET_RETRY ${{ matrix.target }} cargo test --workspace