ci.yml

name: CI

# Deck is a cargo-generate TEMPLATE: its tracked source contains {{ }} Liquid tokens
# (see cargo-generate.toml `include`) and so does NOT build directly. Every job below
# therefore GENERATES a throwaway project from the template first, then builds / lints /
# tests THAT. Editing the template? Read the "cargo-generate template" note in CLAUDE.md.
#
# COST: free. Standard GitHub-hosted runners (macos-latest, ubuntu-latest) are free +
# unlimited on PUBLIC repos — the macOS 10x multiplier only burns quota on PRIVATE repos.
# If you ever make this repo private, gate the `macos` job to tags to avoid eating minutes:
#     if: github.event_name == 'pull_request' || startsWith(github.ref, 'refs/tags/v')
# (Don't switch to "*-large" runners — those are billed even on public repos.)

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

# Least-privilege GITHUB_TOKEN: this workflow only checks out, generates, builds, lints,
# tests, and runs cargo-deny — it needs read access to repo contents and nothing else.
permissions:
  contents: read

# Cancel a still-running CI for a branch when a newer commit is pushed (faster feedback,
# fewer minutes — the generated project's first git-gpui build is slow).
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  macos:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # Prebuilt cargo-generate (fast, deterministic — no compile). SHA-pinned;
      # Dependabot (github-actions) keeps it current.
      - uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2.81.10
        with:
          tool: cargo-generate
      # Render the template into a sibling dir (NOT inside the repo — a nested cargo
      # project confuses cargo, see rust-lang/cargo#9922). --silent uses the placeholder
      # defaults (bundle_qualifier=com, bundle_org=example).
      - name: Generate a project from the template
        run: |
          mkdir -p "$RUNNER_TEMP/gen"
          cargo generate --path . --name deck-ci --silent --vcs none --destination "$RUNNER_TEMP/gen"
      # No toolchain pin here: rust-toolchain.toml (copied into the generated project) is
      # the single source of truth; rustup auto-installs it on the first cargo call.
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          workspaces: ${{ runner.temp }}/gen/deck-ci
      # No --locked: the generated Cargo.lock's root entry is renamed at generate time, so
      # cargo refreshes just that on first build (the git-gpui deps stay pinned).
      - name: Build, lint, and test the generated project
        working-directory: ${{ runner.temp }}/gen/deck-ci
        run: |
          cargo build
          cargo build --features tray
          cargo clippy --all-targets -- -D warnings
          cargo clippy --all-targets --features tray -- -D warnings
          cargo clippy --all-targets --features overlay -- -D warnings
          cargo clippy --all-targets --features tray,overlay -- -D warnings
          cargo test
          cargo test --features overlay

  linux:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # System libraries GPUI needs on Linux (X11 + Wayland + Vulkan + fonts), plus
      # GTK/appindicator for the optional tray feature.
      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential pkg-config \
            libxcb1-dev libxkbcommon-dev libxkbcommon-x11-dev \
            libwayland-dev \
            libvulkan-dev \
            libfontconfig1-dev libfreetype6-dev \
            libssl-dev \
            libgtk-3-dev libayatana-appindicator3-dev libxdo-dev
      - uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2.81.10
        with:
          tool: cargo-generate
      - name: Generate a project from the template
        run: |
          mkdir -p "$RUNNER_TEMP/gen"
          cargo generate --path . --name deck-ci --silent --vcs none --destination "$RUNNER_TEMP/gen"
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          workspaces: ${{ runner.temp }}/gen/deck-ci
      # Formatting is OS-independent, so gate `cargo fmt --check` once on the cheaper
      # Linux runner. The overlay feature is a compile-only no-op on Linux (no LayerShell).
      - name: Format-check, build, lint, and test the generated project
        working-directory: ${{ runner.temp }}/gen/deck-ci
        run: |
          cargo fmt --all --check
          cargo build
          cargo build --features tray
          cargo clippy --all-targets -- -D warnings
          cargo clippy --all-targets --features tray -- -D warnings
          cargo clippy --all-targets --features overlay -- -D warnings
          cargo test
          cargo test --features overlay

  # Supply-chain gate (advisories / bans / sources / licenses) via cargo-deny, run against
  # the GENERATED project (the raw template Cargo.toml has tokens and won't parse). REQUIRED:
  # a deny.toml violation fails the build.
  cargo-deny:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2.81.10
        with:
          tool: cargo-generate,cargo-deny
      - name: Generate a project from the template
        run: |
          mkdir -p "$RUNNER_TEMP/gen"
          cargo generate --path . --name deck-ci --silent --vcs none --destination "$RUNNER_TEMP/gen"
      - name: cargo-deny check
        working-directory: ${{ runner.temp }}/gen/deck-ci
        run: cargo deny check advisories bans sources licenses