name: CI

on:
  push:
    branches: [ "main", "ci-test" ]
  pull_request:
    branches: [ "main" ]

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: ubuntu:26.04
      options: --privileged --cap-add SYS_ADMIN --security-opt apparmor:unconfined
    steps:
    - name: Set up container image
      run: |
        apt-get update
        apt-get install -y nodejs sudo curl wget ca-certificates build-essential
    - uses: actions/checkout@v6
    - uses: dtolnay/rust-toolchain@stable
      with:
        components: rustfmt, clippy
    - name: Check format
      run: cargo fmt --check
    - name: Install build dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y pkg-config libssl-dev libgpg-error-dev libgpgme-dev
    - name: Restore cargo/target cache
      uses: actions/cache@v4
      with:
        path: |
          ~/.cargo/registry
          ~/.cargo/git
          target
        key: ci-build-${{ github.sha }}
        restore-keys: |
          ci-build-
    - name: Build
      run: cargo build
      env:
        RUSTFLAGS: -Dwarnings
    - name: Lint
      run: cargo clippy --all-targets --all-features
      env:
        RUSTFLAGS: -Dwarnings

  test:
    # Disabled: test suite is too heavy for current CI infra (CPU/RAM exhaustion).
    # Re-enable by removing the `if: false` line below.
    if: false
    needs: build
    runs-on: ubuntu-latest
    container:
      image: ubuntu:26.04
      options: --privileged --cap-add SYS_ADMIN --security-opt apparmor:unconfined
    steps:
    - name: Set up container image
      run: |
        apt-get update
        apt-get install -y nodejs sudo curl wget ca-certificates build-essential
    - uses: actions/checkout@v6
    - uses: dtolnay/rust-toolchain@stable
    - name: Restore cargo/target cache
      uses: actions/cache@v4
      with:
        path: |
          ~/.cargo/registry
          ~/.cargo/git
          target
        key: ci-build-${{ github.sha }}
        restore-keys: |
          ci-build-
    - name: Install build dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y pkg-config libssl-dev libgpg-error-dev libgpgme-dev
    - name: Install runtime system dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y git pristine-tar mmdebstrap util-linux dpkg-dev
    - name: Setup subuid/subgid
      run: |
        usermod --add-subuids 100000-200000 --add-subgids 100000-200000 ${USER:-root}
    - name: Run tests with verbose logging (timeout 30min)
      env:
        RUST_LOG: debug
      run: timeout 30m cargo test -- --nocapture

  snap:
    needs: build
    runs-on: ubuntu-latest
    container:
      # Official snapcraft image: an Ubuntu userland matching the snap base,
      # with snapcraft preinstalled (no snapd/systemd/LXD required).
      image: ghcr.io/canonical/snapcraft:8_core24
    steps:
      - name: Install build prerequisites
        run: |
          apt-get update -q
          apt-get install -y -q --no-install-recommends git curl
      - uses: actions/checkout@v6
      - name: Build snap
        run: |
          # GitHub Actions overrides the image entrypoint (pebble), which is
          # what normally puts craftctl on PATH; restore it, allow git to run
          # in the checked-out tree, and provide rustup for the rust plugin.
          git config --global --add safe.directory '*'
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
          export PATH="/usr/libexec/snapcraft:$HOME/.cargo/bin:$PATH"
          snapcraft pack --destructive-mode
      - name: Upload snap artifact
        uses: actions/upload-artifact@v4
        with:
          name: snap
          path: ./*.snap
          if-no-files-found: error