onde 1.1.0

name: CI

on:
  push:
  pull_request:
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # ── Dart / Flutter SDK validation ────────────────────────────────────────
  dart-sdk:
    name: Dart SDK (Flutter)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: subosito/flutter-action@v2
        with:
          flutter-version-file: sdk/dart/.flutter-version
          channel: stable
          cache: true
      - name: Install Dart dependencies
        working-directory: sdk/dart
        run: flutter pub get
      - name: Analyze Dart package
        working-directory: sdk/dart
        run: flutter analyze --no-fatal-infos
      - name: Analyze score-sensitive generated Dart files
        working-directory: sdk/dart
        run: |
          flutter analyze lib/src/frb_generated.dart/api.dart
          flutter analyze lib/src/frb_generated.dart/frb_generated.dart
          flutter analyze lib/src/frb_generated.dart/frb_generated.io.dart
      - name: Verify Apple SwiftPM manifests exist
        working-directory: sdk/dart
        run: |
          test -f ios/onde_inference/Package.swift
          test -f ios/onde_inference/Sources/onde_inference/OndeInferencePlugin.swift
          test -f macos/onde_inference/Package.swift
          test -f macos/onde_inference/Sources/onde_inference/OndeInferencePlugin.swift
      - name: Run Dart package tests
        working-directory: sdk/dart
        run: flutter test
      - name: Restore generated files modified by flutter pub get
        working-directory: sdk/dart
        run: git checkout -- . 2>/dev/null || true
      - name: Dry-run Dart publish
        working-directory: sdk/dart
        run: flutter pub publish --dry-run

  # ── Formatting ────────────────────────────────────────────────────────────
  fmt:
    name: Format
    runs-on: macos-26
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  # ── Lint ──────────────────────────────────────────────────────────────────
  clippy:
    name: Clippy (macOS)
    runs-on: macos-26
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
      - run: cargo clippy --all-targets -- -D warnings

  # ── Tests (macOS — the only platform where tests run natively) ────────────
  test:
    name: Test (macOS)
    runs-on: macos-26
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
      - run: cargo test --lib

  # ── Cross-compile checks for Darwin platforms (highest priority) ─────────
  check-macos-arm64:
    name: Check (macOS arm64)
    runs-on: macos-26
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: macos-arm64
      - run: cargo check --target aarch64-apple-darwin

  check-macos-intel:
    name: Check (macOS x86_64)
    runs-on: macos-26
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-apple-darwin
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: macos-intel
      - run: cargo check --target x86_64-apple-darwin

  check-ios:
    name: Check (iOS device)
    runs-on: macos-26
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-ios
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: ios
      - run: cargo check --target aarch64-apple-ios

  check-ios-sim:
    name: Check (iOS simulator)
    runs-on: macos-26
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-ios-sim
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: ios-sim
      - run: cargo check --target aarch64-apple-ios-sim

  check-tvos:
    name: Check (tvOS device)
    runs-on: macos-26
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rust-src
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: tvos
      - run: cargo +nightly check -Z build-std --target aarch64-apple-tvos

  check-tvos-sim:
    name: Check (tvOS simulator)
    runs-on: macos-26
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rust-src
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: tvos-sim
      - run: cargo +nightly check -Z build-std --target aarch64-apple-tvos-sim

  check-visionos:
    name: Check (visionOS device)
    runs-on: macos-26
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rust-src
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: visionos
      - run: cargo +nightly check -Z build-std --target aarch64-apple-visionos

  check-visionos-sim:
    name: Check (visionOS simulator)
    runs-on: macos-26
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rust-src
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: visionos-sim
      - run: cargo +nightly check -Z build-std --target aarch64-apple-visionos-sim

  check-watchos:
    name: Check (watchOS device)
    runs-on: macos-26
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rust-src
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: watchos
      - run: cargo +nightly check -Z build-std --target aarch64-apple-watchos

  check-watchos-sim:
    name: Check (watchOS simulator)
    runs-on: macos-26
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rust-src
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: watchos-sim
      - run: cargo +nightly check -Z build-std --target aarch64-apple-watchos-sim

  # ── Cross-compile checks for Unix-family platforms ────────────────────────
  check-linux:
    name: Check (Linux x86_64)
    runs-on: ubuntu-latest
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: linux-x86_64
      - run: cargo check --target x86_64-unknown-linux-gnu

  check-android:
    name: Check (Android arm64)
    runs-on: ubuntu-latest
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
      CARGO_TARGET_AARCH64_LINUX_ANDROID_LINKER: aarch64-linux-android34-clang
      CC_aarch64_linux_android: aarch64-linux-android34-clang
      AR_aarch64_linux_android: llvm-ar
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android
      - uses: android-actions/setup-android@v4
      - name: Configure Android NDK toolchain
        shell: bash
        run: |
          echo "${ANDROID_NDK_LATEST_HOME}/toolchains/llvm/prebuilt/linux-x86_64/bin" >> "$GITHUB_PATH"
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: android-arm64
      - run: cargo check --target aarch64-linux-android

  # ── Cross-compile checks for Windows (lowest priority) ────────────────────
  check-windows:
    name: Check (Windows x86_64)
    runs-on: windows-latest
    env:
      GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
      GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}
      GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}
      GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}
      HF_TOKEN: ${{ secrets.HF_TOKEN }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-pc-windows-msvc
      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: false
          key: windows-x86_64
      - run: cargo check --target x86_64-pc-windows-msvc