name: lint

on:
  push:
    branches: [main, master]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: lint-${{ github.ref }}
  cancel-in-progress: true

jobs:
  benchmark-python:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - name: Run benchmark Python regression tests
        run: python -m unittest discover -s tests/benchmarks -p 'test_fold_eval.py'

  clang-format:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - name: Install clang-format
        run: sudo apt-get update && sudo apt-get install -y clang-format-19
      - name: Run clang-format --check
        run: |
          LLVM_BIN="$(dirname "$(command -v clang-format-19)")"
          export LLVM_BIN
          ./scripts/format-code.sh --check

  clang-tidy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Install system deps
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            clang-19 clang-tidy-19 \
            llvm-19-dev libclang-19-dev libclang-cpp19-dev \
            libz3-dev libsqlite3-dev \
            meson ninja-build pkg-config \
            nlohmann-json3-dev \
            libcli11-dev libspdlog-dev libfmt-dev

      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - run: |
          python -m pip install --upgrade pip
          python -m pip install 'conan>=2,<3'
          conan profile detect --force

      - name: Cache Conan
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.conan2
          key: conan-tidy-${{ hashFiles('conanfile.py') }}

      - name: Configure
        env:
          CC: clang-19
          CXX: clang++-19
        run: |
          conan install . --output-folder=build/lint --build=missing \
            -s build_type=Debug -o build_tests=True
          ln -sf /usr/lib/x86_64-linux-gnu/pkgconfig/z3.pc build/lint/z3.pc
          meson setup build/lint \
            --native-file build/lint/conan_meson_native.ini \
            -Dcpp_std=c++23 \
            -Dbuild-tests=true \
            -Dllvm-config-path="$(command -v llvm-config-19)"

      - name: Run clang-tidy and retain complete diagnostics
        run: |
          set +e
          find src -name '*.cpp' -print0 \
            | xargs -0 -n1 -P "$(nproc)" \
                clang-tidy-19 -p build/lint --quiet \
                >clang-tidy.txt 2>&1
          echo "$?" >clang-tidy.exit
          set -e
          cat clang-tidy.txt

      - name: Gate new clang-tidy diagnostics
        run: |
          python scripts/compare_lint_baseline.py \
            --tool clang-tidy \
            --baseline tests/lint/clang_tidy_baseline.json \
            --input clang-tidy.txt \
            --analyzer-exit-file clang-tidy.exit \
            --root "$GITHUB_WORKSPACE" \
            --path-base "$GITHUB_WORKSPACE/build/lint" \
            --output clang-tidy-summary.json

      - name: Upload clang-tidy diagnostics
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: clang-tidy-${{ github.sha }}
          path: |
            clang-tidy.txt
            clang-tidy.exit
            clang-tidy-summary.json
          if-no-files-found: error

  shellcheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - name: Install shellcheck
        run: sudo apt-get update && sudo apt-get install -y shellcheck
      - name: Run ShellCheck and retain complete diagnostics
        run: |
          set +e
          {
            find scripts docker tools tests -name '*.sh' -print0
            printf 'setup.sh\0'
          } | sort -z | xargs -0 shellcheck -S warning -f gcc \
            >shellcheck.txt 2>&1
          echo "$?" >shellcheck.exit
          set -e
          cat shellcheck.txt

      - name: Gate new ShellCheck diagnostics
        run: |
          python scripts/compare_lint_baseline.py \
            --tool shellcheck \
            --baseline tests/lint/shellcheck_baseline.json \
            --input shellcheck.txt \
            --analyzer-exit-file shellcheck.exit \
            --root "$GITHUB_WORKSPACE" \
            --output shellcheck-summary.json

      - name: Upload ShellCheck diagnostics
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: shellcheck-${{ github.sha }}
          path: |
            shellcheck.txt
            shellcheck.exit
            shellcheck-summary.json
          if-no-files-found: error