rustlens 0.2.1

name: CI

# Minimal permissions (checks: write for Check Runs API; contents: read for checkout)
permissions:
  checks: write
  contents: read

on:
  workflow_dispatch:
  push:
    branches: [main, master, develop]
  pull_request:
    branches: [main, master, develop]

# Cancel in-progress runs for same PR/branch
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  # Quick format check - fails fast
  lint-formatting:
    name: Check Formatting
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly
          components: rustfmt
      - name: Check formatting
        run: cargo fmt --all -- --check

  # Check for typos in the codebase
  lint-typos:
    name: Check Typos
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: crate-ci/typos@master

  # Check for unused dependencies
  cargo-machete:
    name: Check Unused Dependencies
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: bnjbvr/cargo-machete@main
      - name: Run cargo machete with metadata
        run: cargo machete --with-metadata

  # Clippy linting with strict settings
  lint-clippy:
    name: Clippy (${{ matrix.toolchain }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        toolchain: [stable, beta]
    continue-on-error: ${{ matrix.toolchain == 'beta' }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.toolchain }}
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - name: Run Clippy
        run: |
          cargo clippy --all-targets --all-features -- \
            -D warnings \
            -D clippy::all \
            -D clippy::pedantic \
            -A clippy::module_name_repetitions \
            -A clippy::must_use_candidate \
            -A clippy::missing_errors_doc \
            -A clippy::missing_panics_doc \
            -A clippy::too_many_lines \
            -A clippy::cast_possible_truncation \
            -A clippy::cast_precision_loss \
            -A clippy::cast_sign_loss \
            -A clippy::similar_names \
            -A clippy::needless_raw_string_hashes \
            -A clippy::unreadable_literal \
            -A clippy::doc_markdown \
            -A clippy::redundant_closure_for_method_calls \
            -A clippy::unused_self \
            -A clippy::match_same_arms \
            -A clippy::wildcard_imports \
            -A clippy::return_self_not_must_use \
            -A clippy::needless_pass_by_value \
            -A clippy::ref_option \
            -A clippy::doc_link_with_quotes \
            -A clippy::case_sensitive_file_extension_comparisons \
            -A clippy::option_if_let_else \
            -A clippy::single_match \
            -A clippy::struct_field_names \
            -A clippy::needless_lifetimes \
            -A clippy::map_unwrap_or \
            -A clippy::match_wild_err_arm \
            -A clippy::if_same_then_else \
            -A clippy::range_plus_one \
            -A clippy::branches_sharing_code \
            -A clippy::manual_let_else \
            -A clippy::uninlined_format_args \
            -A clippy::stable_sort_primitive \
            -A clippy::struct_excessive_bools \
            -A clippy::match_wildcard_for_single_variants \
            -A clippy::elidable_lifetime_names \
            -A clippy::comparison_chain \
            -A clippy::if_not_else

  # Check for disallowed dependencies (license/security)
  cargo-deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    strategy:
      matrix:
        checks: [advisories, bans licenses sources]
    continue-on-error: ${{ matrix.checks == 'advisories' }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check ${{ matrix.checks }}
          arguments: --all-features

  # Type checking on multiple platforms (stable = Cargo that supports Cargo.lock v4; MSRV in Cargo.toml)
  check:
    name: Check (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.os }}
      - name: Type check
        run: cargo check --all-targets --all-features

  # Run tests
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Run tests
        run: cargo test --all-features --no-fail-fast

  # Test documentation examples
  test-docs:
    name: Test Docs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Test documentation
        run: cargo test --doc --all-features

  # Build release binaries
  build:
    name: Build (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.os }}
      - name: Build release
        run: cargo build --release
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: rustlens-${{ matrix.os }}
          path: |
            target/release/rustlens
            target/release/rustlens.exe
          if-no-files-found: ignore

  # Documentation build check
  lint-docs:
    name: Check Docs
    runs-on: ubuntu-latest
    env:
      RUSTDOCFLAGS: -Dwarnings
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
      - name: Build docs
        run: cargo doc --no-deps --all-features

  # Markdown linting
  lint-markdown:
    name: Check Markdown
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: DavidAnson/markdownlint-cli2-action@v19
        with:
          globs: |
            '**/*.md'
            '!target'

  # Security audit
  security:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}