ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  # ------------------------------------------------------------------
  # README/CHANGELOG/CONTRIBUTING/SECURITY (all three languages) are
  # generated by @ktav-lang/polydoc from the root-docs/ unit trees. This
  # job fails when a committed artifact drifts from its source — which is
  # what a hand-edit of the artifact looks like. Fix the source and
  # re-run the generator; never patch the artifact.
  # ------------------------------------------------------------------
  docs:
    name: Docs (generated markdown)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '24'
          cache: 'npm'

      - name: Install Node dependencies
        run: npm ci

      - name: Generated docs are byte-identical to their source units
        run: node scripts/build-docs.mjs --check

  # ------------------------------------------------------------------
  # Build native library + run Java tests in one job per OS. The test
  # suite hardcodes both paths (cabi at `target/release/...`, spec at
  # `spec/versions/0.8/tests`) — no env wiring needed.
  # ------------------------------------------------------------------
  test:
    name: ${{ matrix.os }} / JDK ${{ matrix.jdk }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        jdk: ["17", "21"]

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: ${{ matrix.jdk }}

      - uses: gradle/actions/setup-gradle@v4

      - name: Build native library
        run: cargo build --release -p ktav-cabi

      - name: Gradle test
        run: ./gradlew :lib:test --no-daemon --stacktrace

      - name: Upload test reports
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: test-reports-${{ matrix.os }}-jdk${{ matrix.jdk }}
          path: lib/build/reports/tests/test
          retention-days: 7

  lint-rust:
    name: rust clippy + fmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo fmt --all --check
      - run: cargo clippy --release -p ktav-cabi -- -D warnings

  build-jar:
    name: build library JAR (no native)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"
      - uses: gradle/actions/setup-gradle@v4
      # vanniktech maven-publish renames javadocJar → mavenPlainJavadocJar.
      - run: ./gradlew :lib:jar :lib:sourcesJar :lib:mavenPlainJavadocJar --no-daemon
      - name: Upload JARs
        uses: actions/upload-artifact@v4
        with:
          name: ktav-jars
          path: |
            lib/build/libs/*.jar
          retention-days: 14

  # ------------------------------------------------------------------
  # Pure-Java backend: full corpus + API/negative/regression tests run
  # with NO cargo build step at all — proving lang.ktav.pure never
  # loads or downloads the native library. Gradle fails when a --tests
  # filter matches nothing, so a missing pure suite is RED here, not
  # skipped. CrossBackendTest deliberately stays out: it needs the
  # built cabi and runs in the `test` job.
  # ------------------------------------------------------------------
  test-pure:
    name: pure backend (no native build)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - uses: gradle/actions/setup-gradle@v4

      - name: Pure-backend tests (no cargo)
        run: >
          ./gradlew :lib:test --no-daemon --stacktrace
          --tests "lang.ktav.PureConformanceTest"
          --tests "lang.ktav.PureApiTest"
          --tests "lang.ktav.PureNegativeTest"
          --tests "lang.ktav.PureRegressionTest"
          --tests "lang.ktav.PureNoNativeTest"
          --tests "lang.ktav.CorpusGuardMutationTest"
          --tests "lang.ktav.PureWhitespaceTest"

      - name: Upload test reports
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: test-reports-pure
          path: lib/build/reports/tests/test
          retention-days: 7

  # Packaged pure backend: build the library and checker jars, then run
  # without Jackson, JNA, JUnit, or loose main-output directories.
  packaged-pure:
    name: packaged jar pure smoke (no native/dependency classpath)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"
      - uses: gradle/actions/setup-gradle@v4
      - name: Build jars and run packaged pure smoke
        run: ./gradlew :lib:jar :lib:pureCheckJar :lib:pureJarTest --no-daemon --stacktrace
      - name: Direct Java run with explicit jars
        env:
          KTAV_LIB_PATH: /nonexistent/ktav-native-guard
        run: java -cp "lib/build/libs/ktav-0.8.1.jar:lib/build/libs/ktav-0.8.1-pure-check.jar" lang.ktav.PureSmokeMain

  # ------------------------------------------------------------------
  # CI-only verification of the GENERATED POM and Gradle Module
  # Metadata — no publish, no signing, no secrets. Gradle's own dependency
  # resolution of build tooling uses the network as normal; the guarantee is
  # only: no publish, no secrets, zero external pure runtime deps.
  #
  # Task-name contract (source-verified at 0.30.0): vanniktech maven-publish
  # hardcodes the publication name as
  # `private const val PUBLICATION_NAME = "maven"`
  # (plugin/src/main/kotlin/com/vanniktech/maven/publish/Platform.kt), so
  # Gradle's standard maven-publish task names apply:
  # :lib:generatePomFileForMavenPublication and
  # :lib:generateMetadataFileForMavenPublication writing to
  # lib/build/publications/maven/. If a task name ever changes, this job
  # goes RED; verify with `./gradlew :lib:tasks --all` and adjust the job.
  # ------------------------------------------------------------------
  metadata:
    name: generated POM/module metadata (no publish)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"
      - uses: gradle/actions/setup-gradle@v4
      - name: Generate POM + module metadata and build jars
        run: >
          ./gradlew :lib:generatePomFileForMavenPublication
          :lib:generateMetadataFileForMavenPublication
          :lib:jar :lib:pureJarTest --no-daemon --stacktrace
      - name: Check generated metadata (no publish)
        run: |
          # 1) self-test: negative controls against scripts/metadata-fixtures/
          python3 scripts/check_publish_metadata.py --self-test
          # 2) the actual gate on generated artifacts
          bash scripts/check-publish-metadata.sh
      - name: Upload generated publication metadata
        uses: actions/upload-artifact@v4
        with:
          name: generated-publication-metadata
          path: lib/build/publications/maven/
          retention-days: 14

  # ------------------------------------------------------------------
  # DEBUG-cabi empty-input ABI check. Rust debug builds assert slice
  # pointer validity, so a Pointer.NULL empty source fails here while
  # release builds silently hide it. We build WITHOUT --release (that
  # IS the debug artifact at target/debug/libktav_cabi.so) and pin it
  # via KTAV_LIB_PATH — no cache/release fallback is possible because
  # the file did not exist before this build produced it.
  # ------------------------------------------------------------------
  native-debug-empty-abi:
    name: debug cabi / empty-input ABI
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - uses: gradle/actions/setup-gradle@v4

      - name: Build DEBUG native library
        run: cargo build -p ktav-cabi

      - name: Empty-input tests against the real debug artifact
        env:
          KTAV_LIB_PATH: ${{ github.workspace }}/target/debug/libktav_cabi.so
          KTAV_DEBUG_CABI: debug
        run: >
          ./gradlew :lib:test --no-daemon --stacktrace
          --tests "lang.ktav.NativeEmptyInputTest"
          --tests "lang.ktav.NativeByteInputTest"

      - name: Upload test reports
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: test-reports-native-debug-empty-abi
          path: lib/build/reports/tests/test
          retention-days: 7