engram-core 0.19.0

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  # =============================================================================
  # Fast checks (run on every PR)
  # =============================================================================

  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --all-targets --all-features -- -D warnings

  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --all-features

  # Property tests (critical for vector store + parsers)
  property-tests:
    name: Property Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --test property_tests -- --test-threads=1
        env:
          PROPTEST_CASES: 500

  # Golden tests (prevent output drift)
  golden-tests:
    name: Golden Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --test golden_tests

  # =============================================================================
  # Security & Supply Chain
  # =============================================================================

  audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check bans licenses sources

  # =============================================================================
  # Coverage (with threshold)
  # =============================================================================

  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview
      - uses: Swatinem/rust-cache@v2

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov

      - name: Generate coverage
        run: cargo llvm-cov --all-features --lcov --output-path lcov.info

      - name: Check coverage threshold
        run: |
          cargo llvm-cov --all-features --fail-under-lines 70

      - name: Upload to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: lcov.info
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  # =============================================================================
  # Benchmarks (quick on PR, full on main)
  # =============================================================================

  bench-check:
    name: Bench Compile Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo bench --no-run

  bench:
    name: Benchmark Regression Check
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2

      - name: Run benchmarks (Criterion JSON output)
        run: cargo bench -- --output-format bencher | tee bench-output.txt

      - name: Store benchmark results
        uses: benchmark-action/github-action-benchmark@v1
        with:
          name: Engram Performance
          tool: cargo
          output-file-path: bench-output.txt
          github-token: ${{ secrets.GITHUB_TOKEN }}
          # On main: update baseline and publish to gh-pages
          auto-push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
          # On PRs: compare against baseline and comment
          comment-on-alert: true
          comment-always: ${{ github.event_name == 'pull_request' }}
          # Fail if any benchmark regresses by more than 15%
          alert-threshold: '115%'
          fail-on-alert: ${{ github.event_name == 'pull_request' }}
          # Store history in gh-pages branch
          gh-pages-branch: gh-pages
          benchmark-data-dir-path: dev/bench

      - name: Upload raw Criterion reports
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: benchmark-results
          path: target/criterion/

  # =============================================================================
  # Documentation
  # =============================================================================

  docs:
    name: Documentation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo doc --no-deps --document-private-items
        env:
          RUSTDOCFLAGS: -D warnings

  # =============================================================================
  # Release builds
  # =============================================================================

  release:
    name: Release Build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: macos-latest
            target: x86_64-apple-darwin
          - os: macos-latest
            target: aarch64-apple-darwin
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2

      - name: Build release
        run: cargo build --release --target ${{ matrix.target }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: engram-${{ matrix.target }}
          path: |
            target/${{ matrix.target }}/release/engram-server
            target/${{ matrix.target }}/release/engram-cli