ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  rust:
    name: Rust core
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Rust
        run: |
          rustup toolchain install 1.85.0 --profile minimal --component clippy,rustfmt
          rustup default 1.85.0

      - name: Check formatting
        run: make fmt

      - name: Run Clippy
        run: make clippy

      - name: Run Rust tests
        run: make cargo-test

      - name: Run doc tests
        run: make cargo-doc

      - name: Coverage gate
        run: make coverage-check

      - name: Upload coverage artifact
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: rust-coverage
          path: reports/coverage.txt
          if-no-files-found: ignore

  trunk:
    name: Trunk Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Trunk
        run: sudo TRUNK_VERSION=1.25.0 bash scripts/install-trunk-ci.sh

      - name: Run Trunk Check
        run: trunk check --show-existing --all --no-fix

  raycast:
    name: Raycast extension
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node
        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: integrations/raycast/package-lock.json

      - name: Install Raycast extension dependencies
        run: npm ci --ignore-scripts --no-audit
        working-directory: integrations/raycast

      - name: Run Raycast extension tests with JUnit
        id: raycast-tests
        continue-on-error: true
        run: npm run test:junit
        working-directory: integrations/raycast

      - name: Upload Raycast test report artifact
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: raycast-test-junit
          path: reports/junit/raycast.xml
          if-no-files-found: error

      - name: Fail on Raycast test failure
        if: ${{ steps.raycast-tests.outcome != 'success' }}
        run: exit 1

      - name: Audit Raycast dependencies
        run: npm audit --audit-level=moderate
        working-directory: integrations/raycast

      - name: Lint Raycast extension
        run: npm run lint
        working-directory: integrations/raycast

      - name: Build Raycast extension
        run: npm run build
        working-directory: integrations/raycast

  npm-package:
    name: NPM package
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node
        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: packages/npm/package-lock.json

      - name: Install npm package dependencies
        run: npm ci --ignore-scripts --no-audit
        working-directory: packages/npm

      - name: Test npm launcher and MCP Registry metadata
        run: npm test
        working-directory: packages/npm

      - name: Audit npm launcher dependencies
        run: npm audit --audit-level=moderate
        working-directory: packages/npm

      - name: Dry-run npm package
        run: npm run pack:dry-run
        working-directory: packages/npm

  site:
    name: Documentation site
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node
        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: site/package-lock.json

      - name: Install site dependencies
        run: npm ci --ignore-scripts --no-audit
        working-directory: site

      - name: Set up Rust for docs contract tests
        run: |
          rustup toolchain install 1.85.0 --profile minimal
          rustup default 1.85.0

      - name: Audit site dependencies
        run: npm audit --audit-level=moderate
        working-directory: site

      - name: Run documentation contract tests
        run: make docs-qa

      - name: Build documentation site
        run: npm run build
        working-directory: site

  security:
    name: Security scans
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Run Gitleaks
        run: make gitleaks

      - name: Run OSV Scanner
        uses: google/osv-scanner-action/osv-scanner-action@c51854704019a247608d928f370c98740469d4b5 # v2.3.5
        with:
          scan-args: |-
            --recursive
            ./

  dco:
    name: DCO sign-off
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'pull_request' }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Check DCO sign-offs
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: bash scripts/check-dco.sh "${BASE_SHA}" "${HEAD_SHA}"

  release-snapshot:
    name: Release snapshot
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Rust
        run: |
          rustup toolchain install 1.85.0 --profile minimal --component clippy,rustfmt
          rustup default 1.85.0

      - name: Set up Node
        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 24

      - name: Run Rust release snapshot
        run: make release-snapshot