ci.yml

# CI — every PR. Fast gate: each job runs a Makefile target through the
# shared make-target action, so the same commands run locally. Format runs
# inside `analyze` (resolve-first, diff-fails-under-CI). Runner-agnostic —
# all jobs run on one configurable runner (default ubuntu).
name: CI

on:
  pull_request:
    branches: [prod, dev]
  workflow_dispatch:
    inputs:
      runner:
        description: "Runner for all jobs"
        type: choice
        options: [ubuntu-24.04, macos-14, windows-2025-vs2026]
        default: ubuntu-24.04

permissions: {}

concurrency:
  group: ci-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

env:
  DEFAULT_RUNNER: ubuntu-24.04

jobs:
  inputs:
    name: Resolve inputs
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions: {}
    outputs:
      runner: ${{ steps.resolve.outputs.runner }}
    steps:
      - id: resolve
        shell: bash
        env:
          OVERRIDE: ${{ inputs.runner }}
          DEFAULT: ${{ env.DEFAULT_RUNNER }}
        run: echo "runner=${OVERRIDE:-$DEFAULT}" >> "$GITHUB_OUTPUT"

  changes:
    name: Detect changes
    needs: inputs
    runs-on: ${{ needs.inputs.outputs.runner }}
    timeout-minutes: 5
    permissions:
      contents: read  # checkout + paths-filter, read-only
    outputs:
      code: ${{ steps.filter.outputs.code }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        id: filter
        with:
          filters: |
            code:
              - 'lib/**'
              - 'test/**'
              - 'example/**'
              - 'tool/**'
              - 'pubspec.yaml'
              - 'analysis_options.yaml'
              - 'Makefile'
              - '.github/**'

  analyze:
    name: Analyze
    needs: [inputs, changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: ${{ needs.inputs.outputs.runner }}
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: whuppi/ci/actions/make-target@v2.0.5
        with:
          make-target: analyze

  analyze-floor:
    name: Analyze (floor deps)
    needs: [inputs, changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: ${{ needs.inputs.outputs.runner }}
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: whuppi/ci/actions/make-target@v2.0.5
        with:
          make-target: analyze-floor

  platforms:
    name: Platform support
    needs: [inputs, changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: ${{ needs.inputs.outputs.runner }}
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: whuppi/ci/actions/make-target@v2.0.5
        with:
          make-target: platforms

  test:
    name: Widget tests (host VM)
    needs: [inputs, changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: ${{ needs.inputs.outputs.runner }}
    timeout-minutes: 25
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: whuppi/ci/actions/make-target@v2.0.5
        with:
          make-target: test

  test-example:
    name: Example journeys (host VM)
    needs: [inputs, changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: ${{ needs.inputs.outputs.runner }}
    timeout-minutes: 25
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: whuppi/ci/actions/make-target@v2.0.5
        with:
          make-target: test-example

  gate:
    name: CI Gate
    if: always()
    needs: [inputs, changes, analyze, analyze-floor, platforms, test, test-example]
    runs-on: ${{ needs.inputs.outputs.runner }}
    timeout-minutes: 5
    permissions: {}
    steps:
      - name: Evaluate
        shell: bash
        env:
          CHANGES: ${{ needs.changes.result }}
          CODE: ${{ needs.changes.outputs.code }}
          ANALYZE: ${{ needs.analyze.result }}
          ANALYZE_FLOOR: ${{ needs.analyze-floor.result }}
          PLATFORMS: ${{ needs.platforms.result }}
          TEST: ${{ needs.test.result }}
          TEST_EXAMPLE: ${{ needs.test-example.result }}
        run: |
          # A failed (not skipped) changes job clears its outputs, so CODE
          # arrives empty — which must NOT read as "doc-only". Gate on the job
          # result before trusting its output.
          if [[ "$CHANGES" != "success" ]]; then
            echo "FAILED: change detection did not succeed (changes=$CHANGES)"
            exit 1
          fi
          if [[ "$CODE" != "true" ]]; then
            echo "Doc-only PR — CI gate passes"
            exit 0
          fi
          if [[ "$ANALYZE" != "success" ]] || [[ "$ANALYZE_FLOOR" != "success" ]] || [[ "$PLATFORMS" != "success" ]] || [[ "$TEST" != "success" ]] || [[ "$TEST_EXAMPLE" != "success" ]]; then
            echo "FAILED: analyze=$ANALYZE analyze-floor=$ANALYZE_FLOOR platforms=$PLATFORMS test=$TEST test-example=$TEST_EXAMPLE"
            exit 1
          fi
          echo "All CI checks passed"