name: CI

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  fast-gates:
    name: Fast Gates
    runs-on: ubuntu-latest
    timeout-minutes: 75
    env:
      CARGO_TERM_COLOR: always
      CARGO_BUILD_JOBS: "2"
      CARGO_TARGET_DIR: target/ci
      CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
      CARGO_HTTP_TIMEOUT: "60"
      CARGO_HTTP_MULTIPLEXING: "false"
      CARGO_NET_RETRY: "2"
    steps:
      - name: Checkout
        timeout-minutes: 5
        env:
          GITEA_ACTIONS_TOKEN: ${{ secrets.GITEA_TOKEN }}
          GITEA_INTERNAL_URL: http://gitea:3000
        run: |
          set -euo pipefail

          repository="${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
          sha="${GITHUB_SHA:?GITHUB_SHA is required}"
          workspace="${GITHUB_WORKSPACE:?GITHUB_WORKSPACE is required}"
          token="${GITEA_ACTIONS_TOKEN:-}"
          server_url="${GITEA_INTERNAL_URL%/}"
          remote_url="${server_url}/${repository}"
          git_fetch() {
            if [ -n "${token}" ]; then
              auth="$(printf 'x-access-token:%s' "${token}" | base64 | tr -d '\n')"
              extra_header="AUTHORIZATION: basic ${auth}"
              git -c "http.${server_url}/.extraheader=${extra_header}" fetch "$@"
            else
              git fetch "$@"
            fi
          }

          mkdir -p "${workspace}"
          cd "${workspace}"
          git init .
          if git remote get-url origin >/dev/null 2>&1; then
            git remote set-url origin "${remote_url}"
          else
            git remote add origin "${remote_url}"
          fi
          git_fetch --prune --no-recurse-submodules origin \
            +refs/heads/*:refs/remotes/origin/* \
            +refs/tags/*:refs/tags/*
          if ! git cat-file -e "${sha}^{commit}" 2>/dev/null; then
            git_fetch --no-recurse-submodules origin "${sha}"
          fi
          git clean -ffdx
          git checkout --force "${sha}"
          git clean -ffdx
          git log -1 --format=%H

      - name: Validate repository conventions
        timeout-minutes: 5
        run: |
          set -euo pipefail
          ./scripts/ci/check-conventional-commits.sh v1.0.0

      - name: Install Linux dependencies
        timeout-minutes: 10
        run: ./scripts/ci/install-linux-deps.sh

      - name: Bootstrap Rust toolchains
        timeout-minutes: 25
        run: ./scripts/ci/bootstrap-rust.sh 1.88.0 none

      - name: Install Cargo tools
        timeout-minutes: 10
        run: ./scripts/ci/install-cargo-tools.sh fast

      - name: Validate git-cliff configuration
        timeout-minutes: 5
        run: git-cliff --config cliff.toml --unreleased > /dev/null

      - name: Run fast quality gates
        timeout-minutes: 45
        run: ./scripts/ci/run-fast-gates.sh