name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -D warnings

jobs:
  # ── Fast lane: OS × toolchain matrix ──────────────────────────────
  check:
    name: check (${{ matrix.os }}, ${{ matrix.toolchain }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        toolchain: [stable, "1.93.0"] # MSRV
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.toolchain }}
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-nextest
      - name: fmt
        run: cargo fmt --check
      - name: clippy
        run: cargo clippy --all-targets --all-features -- -D warnings
      - name: nextest
        run: cargo nextest run --all-features --profile ci
      - name: doctests
        run: cargo test --doc --all-features

  # ── Supply-chain hygiene ──────────────────────────────────────────
  deny:
    name: cargo deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-deny
      - run: cargo deny check

  audit:
    name: cargo audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit
      # cargo-audit doesn't read deny.toml, so mirror its ignore list here.
      # See deny.toml [advisories] for rationale on each ID.
      - run: cargo audit --ignore RUSTSEC-2026-0119 --ignore RUSTSEC-2026-0120

  # ── Public-API semver compliance (PR only) ────────────────────────
  semver:
    name: cargo semver-checks
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-semver-checks
      - name: semver-checks (non-blocking until 0.1 on crates.io)
        run: cargo semver-checks check-release || echo "pre-publish; ignoring"

  # ── Line + branch coverage (Linux stable only) ────────────────────
  coverage:
    name: coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-llvm-cov,cargo-nextest
      - name: lcov
        run: cargo llvm-cov nextest --all-features --lcov --output-path lcov.info
      - uses: codecov/codecov-action@v6
        with:
          files: lcov.info
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  # ── Build examples (smoke) ────────────────────────────────────────
  examples:
    name: examples build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --example quickstart
      - run: cargo build --example simulator --features sim

  # ── Stateright BFS safety proof (fast) ────────────────────────────
  stateright:
    name: stateright BFS N=3 K=2
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --test stateright_model --release --all-features -- bfs_n3_k2 --ignored