ci.yml

name: CI

on:
  push:
    branches: [dev, main]
  pull_request:

env:
  CARGO_TERM_COLOR: always

permissions:
  contents: read

jobs:
  package-versions:
    name: Package versions
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 26
      - name: Test release automation
        run: node --test scripts/prepare-release.test.ts scripts/publish-release.test.ts
      - name: Verify application package versions agree
        run: |
          node <<'NODE'
          const fs = require('node:fs');

          const cargo = fs.readFileSync('Cargo.toml', 'utf8');
          const cargoVersion = cargo.match(/^version\s*=\s*"([^"]+)"$/m)?.[1];
          const packageJson = JSON.parse(fs.readFileSync('viewer-ui/package.json', 'utf8'));
          const packageLock = JSON.parse(fs.readFileSync('viewer-ui/package-lock.json', 'utf8'));
          const versions = {
            'Cargo.toml': cargoVersion,
            'viewer-ui/package.json': packageJson.version,
            'viewer-ui/package-lock.json': packageLock.version,
          };

          if (!cargoVersion || Object.values(versions).some((version) => version !== cargoVersion)) {
            console.error('Application package versions must match:');
            for (const [file, version] of Object.entries(versions)) console.error(`  ${file}: ${version ?? 'missing'}`);
            process.exit(1);
          }
          NODE
      - name: Verify release policy
        run: node scripts/prepare-release.ts check
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
      - name: Verify Cargo lockfile
        run: cargo metadata --locked --format-version 1 > /dev/null
      - name: Verify npm lockfile
        run: npm ci --ignore-scripts
        working-directory: viewer-ui

  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      # One OS failing should not hide another's results. Past "macOS 2 +
      # Ubuntu 3" miscounts came from not having this.
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
      - run: cargo build --locked --workspace
      - run: cargo test --locked --workspace
      - run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings

  fmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          components: rustfmt
      - run: cargo fmt --all --check

  viewer-ui:
    name: Viewer frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 26
          cache: npm
          cache-dependency-path: viewer-ui/package-lock.json
      - run: npm ci
        working-directory: viewer-ui
      - run: npm run lint
        working-directory: viewer-ui
      # Before the build, so a failing helper is reported as a failing helper
      # rather than as whatever the bundle does with it.
      - run: npm test
        working-directory: viewer-ui
      - run: npm run build
        working-directory: viewer-ui
      # dist/ is committed so `cargo install` needs no Node. If a rebuild here
      # differs, the checked-in bundle is stale and the binary would ship a
      # frontend that does not match the source.
      - name: Check the committed bundle is up to date
        run: |
          if ! git diff --quiet -- viewer-ui/dist; then
            echo "viewer-ui/dist is stale — run 'npm --prefix viewer-ui run build' and commit"
            git diff --stat -- viewer-ui/dist
            exit 1
          fi
      - name: Run visual regressions in the pinned Linux browser runtime
        run: npm run test:visual
        working-directory: viewer-ui
      - name: Verify the visual runtime kept the committed bundle current
        run: |
          if ! git diff --quiet -- viewer-ui/dist; then
            echo "viewer-ui/dist is stale — run the viewer build and commit its output"
            git diff --stat -- viewer-ui/dist
            exit 1
          fi
      - name: Upload visual failure artifacts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: visual-test-results
          path: |
            viewer-ui/test-results/
            viewer-ui/playwright-report/
          if-no-files-found: warn