name: build

on:
  push:
    branches: [main, master]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            llvm: "19"
          - os: macos-latest
            llvm: "" # use Homebrew-default

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Install system deps (linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            clang-${{ matrix.llvm }} \
            llvm-${{ matrix.llvm }}-dev \
            libclang-${{ matrix.llvm }}-dev \
            libclang-cpp${{ matrix.llvm }}-dev \
            libz3-dev libsqlite3-dev \
            meson ninja-build pkg-config \
            nlohmann-json3-dev \
            libcli11-dev libspdlog-dev libfmt-dev
          {
            echo "CC=clang-${{ matrix.llvm }}"
            echo "CXX=clang++-${{ matrix.llvm }}"
            echo "LLVM_CONFIG=llvm-config-${{ matrix.llvm }}"
          } >> "$GITHUB_ENV"

      - name: Install system deps (macos)
        if: runner.os == 'macOS'
        run: |
          brew update
          brew install llvm@22 z3 meson ninja pkg-config nlohmann-json cli11 spdlog
          echo "LLVM_CONFIG=$(brew --prefix llvm@22)/bin/llvm-config" >> "$GITHUB_ENV"
          echo "PKG_CONFIG_PATH=$(brew --prefix z3)/lib/pkgconfig:$(brew --prefix)/lib/pkgconfig" >> "$GITHUB_ENV"

      - name: Set up Python (for Conan)
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"

      - name: Install Conan
        run: |
          python -m pip install --upgrade pip
          python -m pip install 'conan>=2,<3'
          conan profile detect --force

      - name: Install Rust frontend toolchains
        run: |
          rustup toolchain install nightly-2026-05-28 \
            --component rustc-dev --component rustfmt --component llvm-tools-preview
          # A newer target nightly exercises Cargo/analyzer skew when available.
          # The validation artifact records an explicit skip if it is not newer.
          rustup toolchain install nightly-2026-07-28
          rustup run nightly-2026-05-28 rustc -Vv
          rustup run nightly-2026-07-28 rustc -Vv

      - name: Cache Conan
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.conan2
          key: conan-${{ runner.os }}-${{ hashFiles('conanfile.py') }}
          restore-keys: |
            conan-${{ runner.os }}-

      - name: Configure and compile through setup.sh
        run: ./setup.sh release

      - name: Test
        run: meson test -C build/release --print-errorlogs

      - name: Set up uv for coverage
        if: matrix.os == 'ubuntu-latest'
        uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5

      - name: Enforce reviewed coverage floor
        if: matrix.os == 'ubuntu-latest'
        env:
          COVERAGE_MIN_LINE: "70"
        run: ./scripts/coverage.sh

      - name: Smoke
        run: |
          ./build/release/src/cli/fold --version
          ./build/release/src/cli/fold scan \
            tests/fixtures/clones \
            --std c++20 \
            --detectors clone \
            --format markdown --output fold-smoke.md \
            --processes 1
          head -30 fold-smoke.md

      - name: Generate quality report
        run: |
          ./build/release/src/cli/fold quality \
            --skip-format --skip-tests --skip-policy --skip-diff-scan \
            --out-dir quality-report

      - name: Upload smoke report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: smoke-${{ matrix.os }}
          path: fold-smoke.md
          if-no-files-found: ignore

      - name: Upload quality report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: quality-${{ matrix.os }}
          path: quality-report/
          if-no-files-found: ignore

      - name: Upload Rust toolchain evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: rust-toolchain-${{ matrix.os }}
          path: build/release/meson-logs/rust-toolchain-skew.json
          if-no-files-found: error