name: CI

on:
  push:
    branches: [ "main", "ci-test" ]
  pull_request:
    branches: [ "main" ]

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: ubuntu:26.04
      options: --privileged --cap-add SYS_ADMIN --security-opt apparmor:unconfined
    steps:
    - name: Set up container image
      run: |
        apt-get update
        apt-get install -y nodejs sudo curl wget ca-certificates build-essential
    - uses: actions/checkout@v6
    - uses: dtolnay/rust-toolchain@stable
      with:
        components: rustfmt, clippy
    - name: Check format
      run: cargo fmt --check
    - name: Install build dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y pkg-config libssl-dev libgpg-error-dev libgpgme-dev
    - name: Restore cargo/target cache
      uses: actions/cache@v4
      with:
        path: |
          ~/.cargo/registry
          ~/.cargo/git
          target
        key: ci-build-${{ github.sha }}
        restore-keys: |
          ci-build-
    - name: Build
      run: cargo build
      env:
        RUSTFLAGS: -Dwarnings
    - name: Lint
      run: cargo clippy --all-targets --all-features
      env:
        RUSTFLAGS: -Dwarnings

  test:
    # Disabled: test suite is too heavy for current CI infra (CPU/RAM exhaustion).
    # Re-enable by removing the `if: false` line below.
    if: false
    needs: build
    runs-on: ubuntu-latest
    container:
      image: ubuntu:26.04
      options: --privileged --cap-add SYS_ADMIN --security-opt apparmor:unconfined
    steps:
    - name: Set up container image
      run: |
        apt-get update
        apt-get install -y nodejs sudo curl wget ca-certificates build-essential
    - uses: actions/checkout@v6
    - uses: dtolnay/rust-toolchain@stable
    - name: Restore cargo/target cache
      uses: actions/cache@v4
      with:
        path: |
          ~/.cargo/registry
          ~/.cargo/git
          target
        key: ci-build-${{ github.sha }}
        restore-keys: |
          ci-build-
    - name: Install build dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y pkg-config libssl-dev libgpg-error-dev libgpgme-dev
    - name: Install runtime system dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y git pristine-tar mmdebstrap util-linux dpkg-dev
    - name: Setup subuid/subgid
      run: |
        usermod --add-subuids 100000-200000 --add-subgids 100000-200000 ${USER:-root}
    - name: Run tests with verbose logging (timeout 30min)
      env:
        RUST_LOG: debug
      run: timeout 30m cargo test -- --nocapture

  snap:
    needs: build
    runs-on: ubuntu-latest
    outputs:
      snap-file: ${{ steps.build-snap.outputs.snap }}
    steps:
      - uses: actions/checkout@v6
      # The runner image does not ship a running snapd (and package scripts
      # don't autostart it), while snapcore/action-build expects a live
      # snapd.socket to install snapcraft and LXD. Bootstrap it explicitly.
      - name: Bootstrap snapd
        run: |
          sudo apt-get update -q
          sudo apt-get install -qy snapd
          sudo systemctl start snapd.socket
          sudo snap wait system seed.loaded
      - uses: snapcore/action-build@v1
        id: build-snap
      - uses: actions/upload-artifact@v4
        with:
          name: snap
          path: ${{ steps.build-snap.outputs.snap }}