ci.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:

# Read-only workflow: checkout + build + test only. Explicit least-privilege
# declaration so a future step cannot silently gain write access.
permissions:
  contents: read

# Optional but recommended: cancel superseded runs on the same ref so a
# fresh push or PR update does not queue behind an outdated run.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  # The agent consumes pd-vm / pd-host-function from the canonical HTTPS Git
  # remote, pinned to a full revision in Cargo.toml; Cargo.lock records that
  # exact git source. `--locked` builds fetch exactly that revision from
  # github.com into the cargo git cache — no sibling checkout of the core
  # repository is required or used (tests/dependency_pin_tests.rs enforces
  # the canonical source and full revision; bump only together with a
  # Cargo.lock refresh).
  # Integration tests place temporary SQLite state and fixture scripts
  # here. Every suite honors this variable; without it they fall back to
  # /mnt/TEMP/rustscript/... which is the local-development default and
  # not writable on CI runners.
  RUSTSCRIPT_AGENT_TEST_TMP: ${{ runner.temp }}/rustscript-agent-tests

jobs:
  quality:
    name: fmt, clippy, tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout rustscript-agent
        # Full-SHA pin, matching the rustscript-lang/rustscript CI policy
        # (actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5).
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

      - name: Install Rust toolchain
        # Full-SHA pin, matching the rustscript-lang/rustscript CI policy
        # (dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30).
        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
        with:
          components: rustfmt, clippy

      - name: Cache cargo registry, git db, and build target
        # Full-SHA pin of the v2 tag (verified: v2 →
        # 6323deb102c322ba6fcbdcafc7e3dddab59af2b6). Caches the fetched
        # pinned core revision (cargo git db) plus registry and build
        # target, so `cargo fetch`/test runs stay correct and fast.
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6

      - name: Format check
        run: cargo fmt --all -- --check

      - name: Clippy (warnings denied)
        run: cargo clippy --locked --all-features --all-targets -- -D warnings

      # The default suite runs all non-ignored tests. The only remaining
      # #[ignore]d suites are the openai_responses / anthropic_messages
      # placeholder references (not_implemented adapter stubs — pure agent
      # work, unrelated to the core contract gate); the core repro driver
      # and all OpenAI Chat suites run by default — see
      # plans/2026-08-13_a3-provider-core-blocker.md.
      - name: Test (workspace, all features, all targets)
        run: cargo test --locked --all-features --all-targets

      # Whitespace diagnostic: `git diff --check` reports trailing-whitespace
      # errors in any tracked-file change a step leaves. On a fresh checkout
      # with no drift it is a no-op, which is the point — the authoritative
      # gate below is what actually fails on drift.
      - name: No whitespace errors in tracked changes
        run: git diff --check

      # Fail on real drift instead: every step above must leave the working
      # tree exactly as checked out. `git diff --exit-code` only sees tracked
      # modifications, so this gate uses `git status --porcelain`, which
      # reports both tracked changes and untracked/generated files — it
      # catches tests writing state into the checkout instead of
      # $RUSTSCRIPT_AGENT_TEST_TMP, and any file a step leaves behind.
      - name: Working tree must stay clean (tracked and untracked)
        run: |
          status="$(git status --porcelain)"
          if [[ -n "$status" ]]; then
            echo "::error::working tree is not clean after CI steps:"
            printf '%s\n' "$status"
            exit 1
          fi