name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -D warnings

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Every job runs on spark-1 (aarch64, 20 cores). Two reasons, and the second
# outlives the first:
#
#  1. GitHub-hosted runners are currently unavailable on this account for
#     billing reasons. Public repos get them free, so this may be temporary.
#  2. aarch64 is the deployment target — Oracle Cloud's Ampere A1. Testing on
#     the architecture we ship is worth more than testing on x86 and hoping.
#
# An x86_64 job is worth adding back once hosted runners work, to catch
# endianness- and width-dependent bugs. Tracked in ROADMAP.md.
#
# ⚠️ Do NOT add Swatinem/rust-cache to these jobs. On a self-hosted runner its
# post-step prunes ~/.cargo — which here is a real, persistent toolchain, not a
# disposable one. It silently deleted the rustup binary and every subsequent
# job failed with exit 127. The toolchain now lives at /opt/rust (wired via the
# runner's .env and .path) partly to put it out of reach, but do not re-add the
# action. The runner keeps its target dir between runs anyway, so caching buys
# nothing here.

jobs:
  check:
    name: check · test · clippy · fmt
    runs-on: [self-hosted, Linux, ARM64, spark-1]
    steps:
      - uses: actions/checkout@v5
      - run: cargo fmt --all --check
      - run: cargo clippy --workspace --all-targets --all-features
      - run: cargo test --workspace --all-features

  licences:
    name: licence policy (ADR 0002)
    runs-on: [self-hosted, Linux, ARM64, spark-1]
    steps:
      - uses: actions/checkout@v5
      - run: cargo deny check licenses bans sources advisories

  release:
    name: release build · aarch64
    runs-on: [self-hosted, Linux, ARM64, spark-1]
    if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    steps:
      - uses: actions/checkout@v5
      - run: cargo build --release --workspace --locked
      - uses: actions/upload-artifact@v4
        with:
          name: openmail-aarch64
          path: target/release/openmail
          if-no-files-found: error