aion-context 1.0.0

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always

jobs:
  fmt:
    name: rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      # Tiger Style deny-lints (unwrap_used, expect_used, panic,
      # todo, unreachable, unimplemented) are set to "deny" at the
      # crate level in Cargo.toml and fail clippy on their own.
      # Advisory-level lints (indexing_slicing, arithmetic_side_effects,
      # format_push_string) are intentionally "warn" per Cargo.toml;
      # do not add -D warnings here — that would block CI on hygiene
      # the crate-level posture deliberately leaves as warn.
      - run: cargo clippy --all-targets --all-features

  test:
    name: test (stable)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install uv (for hegeltest backend)
        uses: astral-sh/setup-uv@v5
      - run: cargo build --all-targets --all-features
      - run: cargo test --all-features --no-fail-fast

  deny:
    name: cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check
          arguments: --all-features

  audit:
    name: cargo-audit
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    steps:
      - uses: actions/checkout@v4
      - uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}