ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:
  # Weekly cold bootstrap: apt, rustup, crates.io and release URLs drift with
  # no commit here, and path-gated PR runs would never notice.
  schedule:
    - cron: "0 9 * * 1"

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0

      # install/versions.sh holds NAME=value lines, which is exactly the format
      # $GITHUB_ENV takes -- so the pins transfer with a grep, no parsing and no
      # second copy of the versions in this file.
      - name: Load pinned tool versions
        run: grep -E '^[A-Z0-9_]+_VERSION=' install/versions.sh >> "$GITHUB_ENV"

      - name: Install ruff and prek
        run: |
          uv tool install "ruff==${RUFF_VERSION}"
          uv tool install "prek==${PREK_VERSION}"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      # embed-command shells out to `just` (see .pre-commit-config.yaml), so
      # the lint job needs it on PATH too, not just local machines.
      - name: Install just
        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
        with:
          just-version: ${{ env.JUST_VERSION }} # zizmor: ignore[unpinned-tools]

      - name: Cache prek hook environments
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ~/.cache/prek
          key: prek-${{ hashFiles('.pre-commit-config.yaml', 'install/versions.sh') }}

      # no-commit-to-branch guards local commits, and a push to main checks
      # out branch main here, so it would always fail. The pytest hook is
      # pre-push only, so the `test` job below is its sole CI run.
      - name: Run prek hooks
        run: prek run --all-files
        env:
          SKIP: no-commit-to-branch

  changes:
    runs-on: ubuntu-latest
    outputs:
      bootstrap: ${{ steps.decide.outputs.bootstrap }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Decide whether bootstrap needs to run
        id: decide
        run: |
          case "${EVENT_NAME}" in
              schedule | workflow_dispatch) bootstrap=true ;;
              *) bootstrap="$(bash scripts/ci_needs_bootstrap.sh "${BASE_SHA}" "${HEAD_SHA}")" ;;
          esac
          echo "bootstrap=${bootstrap}" >> "$GITHUB_OUTPUT"
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}

  # A required check, so it's gated with a job-level `if:` -- see
  # scripts/ci_needs_bootstrap.sh for why not a workflow `paths:` filter.
  bootstrap:
    needs: changes
    if: needs.changes.outputs.bootstrap == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Syntax-check all install scripts
        run: |
          failed=0
          for f in install/*.sh; do
              if ! bash -n "$f"; then
                  echo "FAIL: $f" >&2
                  failed=1
              fi
          done
          exit "$failed"

      # Through the README's curl | bash entrypoint rather than setup-just, so
      # CI proves a machine with no `just` can get one. DOTFILES_DIR points it
      # at this checkout instead of cloning main.
      - name: Bootstrap via bootstrap.sh (safe subset)
        run: bash bootstrap.sh
        env:
          DOTFILES_DIR: ${{ github.workspace }}
          DOTFILES_BOOTSTRAP_RECIPE: _ci

      - name: Idempotency — re-run the same entrypoint
        run: bash bootstrap.sh
        env:
          DOTFILES_DIR: ${{ github.workspace }}
          DOTFILES_BOOTSTRAP_RECIPE: _ci

      # Local median is ~40ms; the slack is for runner noise, so a failure
      # means something eager landed in .bashrc, not a slow runner.
      - name: Shell startup within budget
        run: bash scripts/bench-shell.sh 10
        env:
          DOTFILES_DIR: ${{ github.workspace }}
          SHELL_BUDGET_MS: 250

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0

      - name: Run scripts tests
        run: uv run pytest --cov=scripts --cov-report=term-missing scripts/