name: Clippy
on:
  pull_request:
    branches: ["main"]
  merge_group:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  toolchains:
    name: Determine toolchains
    runs-on: ubuntu-24.04
    outputs:
      toolchains: ${{ steps.toolchains.outputs.toolchains }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - id: toolchains
        uses: ./.github/actions/toolchains

  clippy:
    name: cargo clippy
    needs: toolchains
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, macos-15, windows-2025]
        rust-toolchain: ${{ fromJSON(needs.toolchains.outputs.toolchains) }}
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/rust
        with:
          version: ${{ matrix.rust-toolchain }}
          components: clippy
          tools: cargo-hack
          token: ${{ secrets.GITHUB_TOKEN }}

      - id: nss-version
        run: echo "minimum=$(cat min_version.txt)" >> "$GITHUB_OUTPUT"

      - uses: ./.github/actions/nss
        with:
          minimum-version: ${{ steps.nss-version.outputs.minimum }}

      # Use cargo-hack to run clippy on each crate individually with its
      # respective default features only. Can reveal warnings otherwise
      # hidden given that a plain cargo clippy combines all features of the
      # workspace. See e.g. https://github.com/mozilla/neqo/pull/1695.
      - run: cargo hack clippy --feature-powerset --no-dev-deps --exclude-features gecko -- -D warnings
      - run: cargo doc --workspace --no-deps --document-private-items
        env:
          RUSTDOCFLAGS: "--deny rustdoc::broken_intra_doc_links --deny warnings"