lumbridge-code/.gitea/workflows/ci.yml

name: CI

on:
  push:
  pull_request:

jobs:
  # Everything except the GPUI product. Builds in seconds, gates every push.
  rust-headless:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # The version is read from rust-toolchain.toml rather than written here.
      # That file is the single declaration, and naming the version twice lets
      # CI and a developer drift onto different compilers without either of
      # them noticing -- which is the whole failure this indirection prevents.
      - name: Read the pinned toolchain
        id: toolchain
        run: |
          channel="$(sed -n 's/^channel = "\(.*\)"$/\1/p' rust-toolchain.toml)"
          test -n "$channel" || { echo "no channel in rust-toolchain.toml" >&2; exit 1; }
          echo "channel=$channel" >> "$GITHUB_OUTPUT"

      - name: Install the pinned Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ steps.toolchain.outputs.channel }}
          components: rustfmt, clippy

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: headless-${{ hashFiles('Cargo.lock') }}


      # The gates cannot be allowed to skip themselves. Both tools ship prebuilt
      # binaries; building cargo-deny from source on this runner would cost more
      # than the job it guards. LUMBRIDGE_CI_STRICT below turns a missing tool
      # from a warning into a failure, so a silent skip cannot read as green.
      - name: Install gate tooling
        run: |
          set -euo pipefail
          mkdir -p "$HOME/.local/bin"
          arch="$(uname -m)"
          # nextest names its Linux builds "linux" and "linux-arm"; a target
          # triple here is a 404, and `curl -fsSL | tar` would fail obscurely.
          case "$arch" in
            x86_64) nextest_slug=linux; deny_arch=x86_64-unknown-linux-musl ;;
            aarch64) nextest_slug=linux-arm; deny_arch=aarch64-unknown-linux-musl ;;
            *) echo "unsupported runner architecture: $arch" >&2; exit 1 ;;
          esac
          curl -fsSL "https://get.nexte.st/latest/$nextest_slug" | tar zxf - -C "$HOME/.local/bin"
          # Pinned, and pinned to what a developer on this project actually runs,
          # so a licence or source verdict cannot differ between CI and a laptop.
          deny_version=0.20.2
          curl -fsSL "https://github.com/EmbarkStudios/cargo-deny/releases/download/${deny_version}/cargo-deny-${deny_version}-${deny_arch}.tar.gz" \
            | tar zxf - -C "$HOME/.local/bin" --strip-components=1 --wildcards '*/cargo-deny'
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Headless checks
        env:
          LUMBRIDGE_CI_STRICT: "1"
        run: ./scripts/ci.sh --headless

  # The GPUI product. Kept separate because it pulls a window toolkit, several
  # hundred extra packages, and a large target directory.
  #
  # continue-on-error until this runner's disk, memory, and time budget have
  # actually been measured against a GPUI build. A job that OOMs on every push
  # trains people to ignore CI, which is worse than a job that reports and does
  # not block. Remove the flag once it has run green a few times; do not remove
  # it by assuming it will.
  rust-ui:
    runs-on: ubuntu-latest
    needs: rust-headless
    continue-on-error: true
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # The version is read from rust-toolchain.toml rather than written here.
      # That file is the single declaration, and naming the version twice lets
      # CI and a developer drift onto different compilers without either of
      # them noticing -- which is the whole failure this indirection prevents.
      - name: Read the pinned toolchain
        id: toolchain
        run: |
          channel="$(sed -n 's/^channel = "\(.*\)"$/\1/p' rust-toolchain.toml)"
          test -n "$channel" || { echo "no channel in rust-toolchain.toml" >&2; exit 1; }
          echo "channel=$channel" >> "$GITHUB_OUTPUT"

      - name: Install the pinned Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ steps.toolchain.outputs.channel }}
          components: rustfmt, clippy

      # GPUI's X11 backend links against these. libxkbcommon-x11-dev is the
      # package scripts/native-libs.sh works around when it is missing.
      - name: Install native dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libxkbcommon-x11-dev libxcb1-dev libwayland-dev \
            libasound2-dev libfontconfig1-dev pkg-config

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ui-${{ hashFiles('Cargo.lock') }}

      - name: Report disk before build
        run: df -h .


      # The gates cannot be allowed to skip themselves. Both tools ship prebuilt
      # binaries; building cargo-deny from source on this runner would cost more
      # than the job it guards. LUMBRIDGE_CI_STRICT below turns a missing tool
      # from a warning into a failure, so a silent skip cannot read as green.
      - name: Install gate tooling
        run: |
          set -euo pipefail
          mkdir -p "$HOME/.local/bin"
          arch="$(uname -m)"
          # nextest names its Linux builds "linux" and "linux-arm"; a target
          # triple here is a 404, and `curl -fsSL | tar` would fail obscurely.
          case "$arch" in
            x86_64) nextest_slug=linux; deny_arch=x86_64-unknown-linux-musl ;;
            aarch64) nextest_slug=linux-arm; deny_arch=aarch64-unknown-linux-musl ;;
            *) echo "unsupported runner architecture: $arch" >&2; exit 1 ;;
          esac
          curl -fsSL "https://get.nexte.st/latest/$nextest_slug" | tar zxf - -C "$HOME/.local/bin"
          # Pinned, and pinned to what a developer on this project actually runs,
          # so a licence or source verdict cannot differ between CI and a laptop.
          deny_version=0.20.2
          curl -fsSL "https://github.com/EmbarkStudios/cargo-deny/releases/download/${deny_version}/cargo-deny-${deny_version}-${deny_arch}.tar.gz" \
            | tar zxf - -C "$HOME/.local/bin" --strip-components=1 --wildcards '*/cargo-deny'
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: UI checks
        env:
          LUMBRIDGE_CI_STRICT: "1"
        run: ./scripts/ci.sh --ui

      - name: Report disk after build
        run: df -h .