name: CI

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  workflow_dispatch:
    inputs:
      fuzz:
        description: "Run the fuzz job"
        type: boolean
        default: false
      fuzz_seconds:
        description: "Seconds per fuzz target"
        default: "600"

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  # No test or fuzz run may print a page: the engine refuses to spool, and if something ever
  # bypasses that, lp fails loudly on a printer that does not exist.
  PHOTOCRAFT_NO_PRINT: "1"
  LPDEST: photocraft-no-such-printer
  # Debug and test builds keep line tables (file:line in panic backtraces) but drop the rest of the
  # debug info: faster codegen and links, and a smaller target dir (the Linux test job ran out of
  # disk with full debug info). The Windows test legs drop debuginfo entirely (see the test job).
  CARGO_PROFILE_DEV_DEBUG: line-tables-only

# A newer push to a PR branch cancels its older run. Runs on main are never cancelled: a merge
# that lands while main's run is in progress waits for it, so every main state that gets a run is
# checked to the end. (Cancelling here left main unverified whenever merges came close together.)
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # Which OSes the test job runs on. main, manual runs and PRs labelled `full-ci` get Linux and
  # Windows. Other PRs get Linux, plus Windows when they touch code whose behaviour differs by
  # platform: the app shell, UI, text and fonts, GPU, pen input, build scripts or the lockfile.
  # macOS is tested only by release.yml.
  platforms:
    timeout-minutes: 10
    name: select platforms
    runs-on: ubuntu-latest
    outputs:
      legs: ${{ steps.pick.outputs.legs }}
      web: ${{ steps.pick.outputs.web }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - id: pick
        env:
          EVENT: ${{ github.event_name }}
          BASE: ${{ github.event.pull_request.base.sha }}
          FULL: ${{ contains(github.event.pull_request.labels.*.name, 'full-ci') }}
        run: |
          # No macOS on PRs or main: the org's 5 macOS slots are kept for release builds, and
          # release.yml builds and tests macOS (a failing release is fixed and rebuilt).
          # Windows tests run as two legs in parallel: the unit tests and the integration tests. As
          # one job they took ~28 min on the Windows runner; the legs take ~13 and ~15. Splitting
          # the integration tests over a third runner (nextest --partition) saved ~2 min of wall
          # time but cost ~7 runner-minutes and one more Windows slot per PR.
          linux='{"os":"ubuntu-latest","part":"all"}'
          win() { printf '{"os":"windows-latest","part":"%s"}' "$1"; }
          all="[$linux,$(win unit),$(win integration)]"
          if [ "$EVENT" != pull_request ] || [ "$FULL" = true ]; then
            echo "legs=$all" >> "$GITHUB_OUTPUT"
            echo "web=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          # The browser build (a fat-LTO wasm build) runs only when something it compiles or
          # packages changed: the web app and its packaging, crate sources and manifests (the web
          # build compiles nearly every crate), the workspace manifests and this workflow.
          if git diff --name-only "$BASE" HEAD | grep -Eq '^(apps/photocraft-web(-boot)?/|packaging/web/|packaging/env\.sh$|crates/[^/]+/(src/|Cargo\.toml$|build\.rs$)|Cargo\.(toml|lock)$|rust-toolchain(\.toml)?$|\.github/workflows/ci\.yml$)'; then
            echo "web=true" >> "$GITHUB_OUTPUT"
          else
            echo "web=false" >> "$GITHUB_OUTPUT"
          fi
          if git diff --name-only "$BASE" HEAD | grep -Eq '^(apps/|crates/(ui-egui|text|gpu|tablet|heif)/|Cargo\.lock$|(.*/)?build\.rs$|\.github/workflows/ci\.yml$)'; then
            echo "legs=$all" >> "$GITHUB_OUTPUT"
          else
            echo "legs=[$linux]" >> "$GITHUB_OUTPUT"
          fi

  test:
    timeout-minutes: 100
    name: test (${{ matrix.os }}${{ matrix.part != 'all' && format(', {0}', matrix.part) || '' }})
    needs: platforms
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.platforms.outputs.legs) }}
    env:
      # No debuginfo on Windows: writing PDBs for ~200 test binaries cost 2.2 of ~21 build minutes.
      # A panic still names its file and line; only backtrace frames lose theirs (Linux keeps
      # line-tables-only, so a backtrace with lines is one OS away).
      CARGO_PROFILE_DEV_DEBUG: ${{ startsWith(matrix.os, 'windows') && '0' || 'line-tables-only' }}
    steps:
      - uses: actions/checkout@v4

      # Unused toolchains in the image (Android SDK, .NET, GHC, CodeQL) are deleted in the
      # background: the space is free before the craft-fonts build needs it, and nothing waits.
      - name: Install Linux system dependencies (egui/winit/rfd)
        if: runner.os == 'Linux'
        run: |
          nohup sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup \
            /opt/hostedtoolcache/CodeQL </dev/null >/dev/null 2>&1 &
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
            libgl1-mesa-dev libgtk-3-dev

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt

      # Only main saves caches; PRs restore main's. Every PR used to save its own set (up to
      # 3.8 GB), usable by that PR only, so the repo's 10 GB cache budget kept evicting main's.
      # A failing test still saves: the cache holds compiled dependencies, not test results.
      # The Windows legs share one key (same dependencies); the integration leg saves it,
      # because it also runs Clippy and so leaves Clippy's dependency metadata in it.
      - uses: Swatinem/rust-cache@v2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' && (matrix.part == 'all' || matrix.part == 'integration') }}
          cache-on-failure: true

      # sccache caches the workspace crates' compiled libraries, which rust-cache leaves out:
      # warm, each Windows leg built 4.5 min faster. Like rust-cache, only main writes (PRs read
      # main's entries); a full set is ~90 MB, so it barely touches the 10 GB budget (#2688).
      # Test executables can't be cached, so a PR still links its tests.
      - name: Install sccache (Windows)
        if: runner.os == 'Windows'
        uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
        with:
          version: v0.18.0

      - name: Use sccache (Windows)
        if: runner.os == 'Windows'
        env:
          MAIN: ${{ github.ref == 'refs/heads/main' }}
        run: |
          echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
          echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
          if [ "$MAIN" != true ]; then echo "SCCACHE_GHA_RW_MODE=READ_ONLY" >> "$GITHUB_ENV"; fi
        shell: bash

      - name: Format
        if: runner.os == 'Linux'
        run: cargo fmt --all -- --check

      # Keep formatting, strict Clippy, layering and scorecard checks ahead of tests.
      - name: Clippy
        if: matrix.part == 'all' || matrix.part == 'integration'
        run: cargo clippy --workspace --all-targets --locked --features heif -- -D warnings

      - name: Dependency layering
        if: matrix.part == 'all' || matrix.part == 'integration'
        run: cargo xtask layers

      # docs/scorecard.md must match its sources (checklists, budgets, baseline, corpus floors,
      # prefs audit). Static: it reads committed files only, no benchmarks run here.
      - name: Scorecard up to date
        if: runner.os == 'Linux'
        run: cargo xtask scorecard --check

      # nextest runs the test binaries in parallel (cargo test runs them one at a time), with the
      # GPU tests capped by the `gpu` group in .config/nextest.toml (#2204).
      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
        with:
          tool: cargo-nextest@0.9.146

      # `--features heif`: official builds open HEIC photos via the optional photocraft-heif crate.
      # `--lib --bins --tests` leaves out the examples, which cargo test would build and link but
      # never run (Clippy's `--all-targets` still checks they compile). nextest skips doctests, so
      # they get their own step.
      #
      # On Windows the unit leg runs `--lib --bins` and the integration leg `--test '*'` (every
      # integration-test target); the feature selection stays the same, so both legs share the
      # dependency cache. The `ci` profile fails fast and terminates hung tests
      # (.config/nextest.toml); assertion failures are not retried.
      - name: Test
        env:
          PART: ${{ matrix.part }}
        run: |
          case "$PART" in
            unit) targets=(--lib --bins) ;;
            integration) targets=(--test '*') ;;
            *) targets=(--lib --bins --tests) ;;
          esac
          cargo nextest run --profile ci --workspace --locked --features heif "${targets[@]}"
        shell: bash

      # Every command against adversarial params must return Err, never panic or hang (AGENTS.md
      # Rule 9). It is `#[ignore]`d (slow), so Test skips it. Same packages, features and targets as
      # Test, so nothing rebuilds: `--test panic_hunt` would drop the other crates' dev-dependency
      # features and recompile the whole graph. The `ci` profile terminates it if it hangs.
      - name: Panic hunt
        if: runner.os == 'Linux'
        run: >-
          cargo nextest run --profile ci --workspace --locked --features heif --lib --bins --tests
          --run-ignored only -E 'binary_id(photocraft-engine::panic_hunt)'

      - name: Doctests
        if: matrix.part == 'all' || matrix.part == 'unit'
        run: cargo test --workspace --locked --features heif --doc

  # The Windows tests used to be one job named `test (windows-latest)`; they're now legs named
  # `test (windows-latest, unit)` and `test (windows-latest, integration)`. This job keeps the old
  # name reporting, so a required status check on it (none today) would keep working. It fails
  # unless the whole test matrix and both Linux variants passed. `needs` reports one result
  # for all matrix legs; when a PR runs no Windows legs it still checks every Linux result.
  windows-gate:
    timeout-minutes: 5
    name: test (windows-latest)
    needs: [platforms, test, test-variants]
    if: ${{ !cancelled() }}
    runs-on: ubuntu-latest
    steps:
      - env:
          PLATFORMS: ${{ needs.platforms.result }}
          TEST: ${{ needs.test.result }}
          VARIANTS: ${{ needs.test-variants.result }}
        run: |
          echo "platforms: $PLATFORMS, test: $TEST, variants: $VARIANTS"
          [ "$PLATFORMS" = success ] && [ "$TEST" = success ] && [ "$VARIANTS" = success ]

  # The two other builds of the Linux tests, in parallel with the test job instead of after it (they
  # added ~10 min to its critical path). Each restores the test job's cache (`shared-key: test` is
  # that job's key) and saves none: the dependencies are the same, and the 10 GB cache budget is
  # tight (#2688).
  test-variants:
    timeout-minutes: 100
    name: test (${{ matrix.variant }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        variant: [without heif, with craft-fonts]
    steps:
      - uses: actions/checkout@v4

      - name: Install Linux system dependencies (egui/winit/rfd)
        run: |
          nohup sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup \
            /opt/hostedtoolcache/CodeQL </dev/null >/dev/null 2>&1 &
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
            libgl1-mesa-dev libgtk-3-dev

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: test
          save-if: false

      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
        with:
          tool: cargo-nextest@0.9.146

      # The same codecs without the optional decoder: HEIC must stay a clear "not in this build"
      # error for distributors who leave it out.
      - name: Test without heif
        if: matrix.variant == 'without heif'
        run: cargo nextest run -p photocraft-heif -p photocraft-codecs -p photocraft-io --locked --profile ci

      # The tests built with the optional craft-fonts input (crates/text/build.rs), so the Japanese
      # font tests that skip without it run. Keep the test job's exact `--workspace --features heif
      # --lib --bins --tests`, so the restored dependencies match and only the workspace rebuilds.
      # Filter execution to the three crates that read the optional font input (#6127).
      - name: Check out craft-fonts
        if: matrix.variant == 'with craft-fonts'
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          repository: storytold/craft-fonts
          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
          path: craft-fonts

      - name: Test with craft-fonts
        if: matrix.variant == 'with craft-fonts'
        env:
          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
          CRAFT_FONTS_REQUIRED: "1"
        run: >-
          cargo nextest run --profile ci --workspace --locked --features heif --lib --bins --tests
          -E 'package(photocraft-text) | package(photocraft-io) | package(photocraft-ui-egui)'

  corpus:
    timeout-minutes: 30
    # Real-file corpus tests (cargo feature `corpus`), on every PR and on main. The corpora are
    # pinned in xtask/src/corpus_pins.rs and sha256-verified (xtask/*.sha256) after both a cache
    # restore and a download; a missing corpus fails the tests. The cache key changes only when a
    # pin or manifest does, so normally this restores in seconds (fork PRs read the base cache).
    name: corpus tests
    runs-on: ubuntu-latest
    env:
      # test-corpus builds with --release, but here without the release profile's thin LTO and
      # single codegen unit: they ran LTO over the dependency graph for each of the ~95 corpus test
      # binaries, so building took 23.5 of the job's 37 minutes while the tests ran for 1.5.
      # Turning them off builds 2.7x faster; the code under test is the same.
      CARGO_PROFILE_RELEASE_LTO: "false"
      CARGO_PROFILE_RELEASE_CODEGEN_UNITS: "16"
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: corpus
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-on-failure: true
      - name: Restore test corpora
        uses: actions/cache@v4
        with:
          path: corpus/
          key: corpus-${{ hashFiles('xtask/src/corpus_pins.rs', 'xtask/*.sha256') }}
      - name: Fetch and verify corpora
        run: cargo xtask corpus --all
      - name: Corpus tests
        run: cargo xtask test-corpus

  wasm:
    timeout-minutes: 30
    name: wasm32 check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown
      - uses: Swatinem/rust-cache@v2
        with:
          key: wasm32
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-on-failure: true
      - name: Check wasm-safe crates
        run: cargo xtask wasm

  web:
    timeout-minutes: 60
    name: web build and wasm size gate
    # PRs run it only when web-relevant files change (see `platforms`); main always does.
    needs: platforms
    if: needs.platforms.outputs.web == 'true'
    runs-on: ubuntu-latest
    env:
      # Match release.yml so PR results reflect what would actually ship.
      TRUNK_VERSION: 0.21.14
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown
      - uses: Swatinem/rust-cache@v2
        with:
          key: ci-web
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-on-failure: true
      - name: Install trunk
        run: |
          curl --proto '=https' -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
            | tar -xz -C "$HOME/.cargo/bin" trunk
          trunk --version
      # package.sh runs Trunk's release builds, validates relative URLs, cuts the wasm into
      # parts, checks the 24 MiB per-file limit and exercises the packaging step release.yml uses.
      - name: Build and verify browser release
        run: packaging/web/package.sh
      - name: Report wasm size
        if: success()
        run: |
          {
            echo "### Browser WebAssembly size"
            echo
            echo "| File | Bytes | MiB | Limit |"
            echo "| --- | ---: | ---: | ---: |"
            row() { echo "| $1 | $2 | $(awk -v n="$2" 'BEGIN { printf "%.2f", n / 1048576 }') | $3 |"; }
            # The app's wasm as built; it ships gzipped in parts, so only the download grows with it.
            for wasm in dist/web/*.wasm; do
              [ -f "$wasm" ] || continue
              row "$(basename "$wasm")" "$(wc -c < "$wasm" | tr -d ' ')" "none"
            done
            # What a host sees: the largest file of the packaged site.
            largest=$(find target/web-package -type f -printf '%s %f\n' | sort -n | tail -1)
            row "largest file in the site: ${largest#* }" "${largest%% *}" "24 MiB"
          } >> "$GITHUB_STEP_SUMMARY"

  fuzz:
    timeout-minutes: 60
    name: fuzz (${{ matrix.target.crate }}/${{ matrix.target.name }})
    # Placeholder: manual trigger only until a nightly schedule is enabled.
    if: github.event_name == 'workflow_dispatch' && inputs.fuzz
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target:
          - { crate: psd, name: parse }
          - { crate: psd, name: descriptor }
          - { crate: psd, name: image_source_data }
          - { crate: psd, name: grd }
          - { crate: psd, name: ase }
          - { crate: psd, name: aco }
          - { crate: psd, name: patterns }
          - { crate: psd, name: filter_effects }
          - { crate: psd, name: metadata }
          - { crate: psd, name: tagged }
          - { crate: psd, name: resources }
          - { crate: codecs, name: decode_any }
          - { crate: codecs, name: decode_png }
          - { crate: codecs, name: decode_jpeg }
          - { crate: codecs, name: decode_tiff }
          - { crate: codecs, name: decode_exr }
          - { crate: codecs, name: decode_heif }
          - { crate: affinity, name: preview }
          - { crate: affinity, name: import_preview, args: "--features io" }
          - { crate: format, name: load }
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: crates/${{ matrix.target.crate }}/fuzz
      - name: Install cargo-fuzz
        run: cargo install cargo-fuzz --locked
      - name: Fuzz
        working-directory: crates/${{ matrix.target.crate }}
        run: cargo fuzz run ${{ matrix.target.name }} ${{ matrix.target.args }} -- -max_total_time=${{ inputs.fuzz_seconds }}
      - name: Upload crash artifacts
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: fuzz-${{ matrix.target.crate }}-${{ matrix.target.name }}
          path: crates/${{ matrix.target.crate }}/fuzz/artifacts