ci.yml

name: CI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

env:
  CARGO_TERM_COLOR: always

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  fmt:
    name: rustfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  clippy:
    name: clippy (-D warnings)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --workspace --all-targets -- -D warnings

  test:
    name: cargo test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --workspace --all-targets
      - run: cargo test --workspace --doc

  install-matrix:
    name: release installer (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            shell: bash
            script: install.sh
          - os: macos-latest
            shell: bash
            script: install.sh
          - os: windows-latest
            shell: pwsh
            script: install.ps1
    steps:
      - name: Install from latest release (Unix)
        if: matrix.shell == 'bash'
        shell: bash
        run: |
          set -euo pipefail
          bin_dir="${RUNNER_TEMP}/plsql-install-bin"
          curl -fsSL "https://github.com/MuhDur/plsql-intelligence/releases/latest/download/${{ matrix.script }}?${{ github.run_id }}" \
            | bash -s -- --bin-dir "$bin_dir" --force --no-gum
          "$bin_dir/plsql" --version
          "$bin_dir/plsql-depgraph" --version
      - name: Install from latest release (Windows)
        if: matrix.shell == 'pwsh'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $binDir = Join-Path $env:RUNNER_TEMP "plsql-install-bin"
          $installer = Join-Path $env:RUNNER_TEMP "install.ps1"
          Invoke-WebRequest `
            -Uri "https://github.com/MuhDur/plsql-intelligence/releases/latest/download/${{ matrix.script }}?${{ github.run_id }}" `
            -OutFile $installer `
            -UseBasicParsing
          & $installer -BinDir $binDir -Force
          & (Join-Path $binDir "plsql.exe") --version
          & (Join-Path $binDir "plsql-depgraph.exe") --version

  antlr-generated-drift:
    name: ANTLR generated drift check
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: antlr-generated-drift
      - name: Regenerate ANTLR source into temp dir
        env:
          CARGO_TARGET_DIR: ${{ runner.temp }}/antlr-generated-drift-target
          PLSQL_ANTLR_REGEN: "1"
          PLSQL_ANTLR_REGEN_DIR: ${{ runner.temp }}/plsql-parser-antlr-generated
        run: cargo +stable build -p plsql-parser-antlr --features antlr-codegen
      - name: Compare generated source with committed copy
        run: diff -ru crates/plsql-parser-antlr/src/generated "${RUNNER_TEMP}/plsql-parser-antlr-generated"

  # Keep the offline PL/SQL engine from reaching into Oracle drivers, MCP
  # adapters, or async/server runtimes directly.
  offline-boundary-lint:
    name: offline boundary lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Run forbidden dependency boundary lint
        run: scripts/offline_boundary_lint.sh
      - name: Prove planted violation fails
        run: scripts/offline_boundary_lint.sh --self-test

  # Keep release-visible docs, package metadata, source docs, and workflow text
  # from drifting back into stale runtime or server framing.
  offline-honesty-grep:
    name: offline honesty grep
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run honesty-grep gate
        run: scripts/offline_honesty_grep.sh
      - name: Prove planted forbidden string fails
        run: scripts/offline_honesty_grep.sh --self-test

  # Supply-chain gates for the offline engine workspace.
  supply-chain:
    name: cargo deny + audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: cargo deny (advisories, licenses, bans, sources)
        run: |
          cargo install --locked cargo-deny || true
          cargo deny check
      - name: cargo audit (RUSTSEC advisories)
        run: |
          cargo install --locked cargo-audit || true
          cargo audit || true

  bench-no-run:
    name: cargo bench --no-run
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo bench --workspace --no-run

  corpus-license-check:
    name: corpus license check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo run -p corpus-license-check

  # Surrogate for `PLSQL-PARSE-012` — once the parse-corpus harness lands it
  # will replace this job with structured parse-quality metrics (clean rate,
  # recovered rate, skipped-token ratio, top-level recognition).
  parse-success:
    name: parse-success (parser tests)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test -p plsql-parser -p plsql-parser-antlr

  # `PLSQL-LAB-010` — lab-as-release-gate. PR-blocking CI for drift
  # in `corpus/lab/expected/*.json` goldens. Fails if any golden is
  # invalid JSON, or if the lineage tests that consume the goldens
  # regress. Cheap (no Oracle, no docker); runs on every PR.
  lab-gate:
    name: lab-gate (corpus/lab goldens, PR-blocking)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: make lab-gate

  # `PLSQL-LAB-003` — sanity-check the L1 hero diff golden artifact
  # via `make demo-no-db-verify`. Cheap (no Oracle, no docker) so it
  # runs on every PR; it asserts the parse_change_file pipeline
  # consumes the diff and the golden JSON is present.
  demo-no-db:
    name: demo-no-db (hero-diff golden gate)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: make demo-no-db-verify

  # `PLSQL-PLAN-002` — run plan-lint on every push/PR. Now a blocking
  # gate (PLSQL-PLAN-003 closed all known error-severity drift); warnings
  # still surface but don't fail the build.
  plan-lint:
    name: plan-lint (structural integrity)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Run plan-lint (human report)
        run: cargo run -p plan-lint -- --doctor
      - name: Run plan-lint (JSON report)
        run: cargo run -p plan-lint -- --robot-json > plan-lint-report.json
      - name: Upload JSON report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: plan-lint-report
          path: plan-lint-report.json
          if-no-files-found: ignore