name: CI

on:
  pull_request:
  push:
    branches: ['main']

jobs:
  check:
    runs-on: [self-hosted, hestia]
    # Same container/no-JS-actions convention as package.yml: the archlinux
    # image has no Node, so every step is a shell command that installs its
    # own toolchain and clones manually. Keeps the gate identical to how
    # packages are actually built.
    container:
      image: archlinux:latest
    steps:
      - name: Install build deps
        run: |
          set -euo pipefail
          pacman -Syu --noconfirm base-devel git rust cargo clippy rustfmt \
            libgit2 openssl pam wayland libxkbcommon gtk4
          git config --global --add safe.directory '*'

      - name: Checkout
        env:
          BRANCH: ${{ github.head_ref || github.ref_name }}
        run: |
          set -euo pipefail
          # Try the head/ref branch first (e.g. the PR branch); fall back to a
          # plain default-branch clone so tags/merge refs still check out.
          git clone --depth 1 --branch "$BRANCH" \
            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /src \
            || git clone --depth 1 \
              "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /src

      - name: Format (rustfmt --check)
        working-directory: /src
        run: cargo fmt --all -- --check

      - name: Lint (clippy, warnings as errors)
        working-directory: /src
        run: cargo clippy --workspace --all-targets -- -D warnings

      - name: Test (all targets)
        working-directory: /src
        run: cargo test --workspace --all-targets

      - name: Build (release, locked)
        working-directory: /src
        run: cargo build --release --locked