---
name: check

"on":
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

# this allows a subsequently queued workflow run to interrupt previous runs in pull requests only
concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}

defaults:
  run:
    shell: bash --noprofile --norc -euo pipefail {0}

env:
  MISE_ENV: dart,dotnet,java,js,kotlin,python,r,rust,zig

jobs:
  # Each OS runs two lanes: `mise run check`, and the feature powerset (cargo-hack-check) as a lane of its own.
  # The powerset is several hundred clippy runs, which no shared timeout fits, and as a separate lane it runs in
  # parallel rather than lengthening the check. Running it as a step after `mise run check` also fails on Windows,
  # where the next `mise` call dies at once with
  #     mise: recursive shim invocation detected for mise: C:/Users/runneradmin/AppData/Local/mise/shims/mise
  # because the check's install-all rewrites mise's own shim, which install-mise-tools had removed. Observed on
  # commit https://github.com/edge-toolkit/core/commit/aa260c59248d8eb227e310f78d553ddb1b9445a2 at
  # https://github.com/edge-toolkit/core/actions/runs/37386640989/job/112021398135.
  # Each lane is named explicitly so the check lanes keep their existing `check (<os>, <timeout>)` names.
  check:
    name: ${{ matrix.lane }}
    permissions:
      id-token: write
      contents: write
      # Read-only pull of the maintainer-published ghcr.io mise-tools store (install-mise-tools restore step).
      # Never write: the stores are published only from a maintainer's machine via `mise run push-mise-tools`.
      packages: read
    runs-on: ${{ matrix.os }}
    timeout-minutes: ${{ matrix.timeout }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - lane: check (ubuntu-latest, 40)
            os: ubuntu-latest
            task: check
            timeout: 40
          - lane: check (macos-latest, 75)
            os: macos-latest
            task: check
            timeout: 75
          - lane: check (windows-latest, 120)
            os: windows-latest
            task: check
            timeout: 120
          - lane: features (ubuntu-latest)
            os: ubuntu-latest
            task: cargo-hack-check
            timeout: 60
          - lane: features (macos-latest)
            os: macos-latest
            task: cargo-hack-check
            timeout: 90
          - lane: features (windows-latest)
            os: windows-latest
            task: cargo-hack-check
            timeout: 180
    # Windows runs the checkers under busybox-w32 ash, same as test.yaml's Windows lane.
    # That's the shell mise's `shell = "bash"` tasks run on; Git Bash's MSYS fork-emulation cygheap breaks
    # down on long task chains. The path matches the version pin in `.mise/config.windows.toml`'s
    # [tools."http:busybox"] entry, and its `C:\i` root is the MISE_INSTALLS_DIR install-mise exports on
    # Windows. A job's `shell` default is resolved before any step runs, so it cannot read that variable and
    # has to spell the root out -- the gha_mise policy holds the two together.
    defaults:
      run:
        shell: >-
          ${{ startsWith(matrix.os, 'windows') &&
              'C:\i\http-busybox\1.37.0\ash.exe -euo pipefail {0}'
              || 'bash --noprofile --norc -euo pipefail {0}' }}
    steps:
      # Full history here due to checks that use git log.
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install mise + tools
        uses: $/.github/actions/install-mise-tools
        timeout-minutes: 60

      - name: Prefetch Rust dependencies
        run: mise run prefetch:rust
        env:
          GITHUB_TOKEN: ${{ github.token }}
          CARGO_NET_RETRY: "5"

      # MISE_JOBS=1 serializes mise's task scheduler so the parallel cargo checkers don't race on Windows.
      # cargo-check / cargo-clippy-check / cargo-doc-check otherwise contend on cargo's
      # `.cargo/registry/index` lock -- on Linux/macOS cargo waits gracefully, on Windows it fails fast
      # (see test.yaml's matching step). mise rejects an empty MISE_JOBS, and GHA has no `if:` on
      # individual env entries, so it's a separate conditional step.
      - name: Serialize mise tasks on Windows
        if: runner.os == 'Windows'
        run: echo "MISE_JOBS=1" >> "$GITHUB_ENV"

      - name: Run checkers
        run: mise run "$TASK"
        env:
          TASK: ${{ matrix.task }}