ironclaw/.github/workflows/code_style.yml

name: Code Style
on:
  pull_request:

permissions:
  contents: read

jobs:
  format:
    name: Formatting
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
        persist-credentials: false
    - name: Install Rust
      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      with:
        components: rustfmt
    - name: Check formatting
      run: cargo fmt --all -- --check

  gateway-js-syntax:
    name: Gateway JS syntax
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
        persist-credentials: false
    - name: Install Node.js
      uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4
      with:
        node-version: "22"
    - name: Check gateway app.js syntax
      run: node --check crates/ironclaw_gateway/static/app.js

  deny-check:
    name: cargo-deny
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
        persist-credentials: false
    - name: Run cargo deny
      uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2

  clippy:
    name: Clippy (${{ matrix.name }})
    # Push events only run the all-features leg. That leg builds a superset
    # of artifacts, so it deterministically wins the shared cache slot on
    # main/staging refreshes and PR legs always restore from a useful
    # starting point. PRs still run all three to enforce lint coverage.
    if: github.event_name == 'pull_request' || matrix.name == 'all-features'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: all-features
            flags: "--all-features"
          - name: default
            flags: ""
          - name: libsql-only
            flags: "--no-default-features --features libsql"
    steps:
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
        persist-credentials: false
    - name: Install Rust
      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      with:
        components: clippy
    - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      with:
        # Share a single cache across the clippy matrix. `target/` built for
        # --all-features is a superset of the other two legs, so restoring
        # from whichever variant saved last is still faster than a cold build
        # and avoids storing three near-duplicate copies in the GHA cache.
        shared-key: clippy
    - name: Check lints
      run: cargo clippy --all --benches --tests --examples ${{ matrix.flags }} -- -D warnings

  clippy-windows:
    name: Clippy Windows (${{ matrix.name }})
    if: github.base_ref == 'main'
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: all-features
            flags: "--all-features"
          - name: default
            flags: ""
          - name: libsql-only
            flags: "--no-default-features --features libsql"
    steps:
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
        persist-credentials: false
    - name: Install Rust
      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      with:
        components: clippy
    - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      with:
        shared-key: clippy-windows
    - name: Check lints
      run: cargo clippy --all --benches --tests --examples ${{ matrix.flags }} -- -D warnings

  no-panics:
    name: No panics in production code
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
        fetch-depth: 0
        persist-credentials: false
    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
      with:
        python-version: "3.12"
    - name: Check for .unwrap(), .expect(), assert!() in production code
      run: |
        BASE="${{ github.event.pull_request.base.sha }}"
        python3 scripts/check_no_panics.py --base "$BASE" --head HEAD

  # Roll-up job for branch protection
  code-style:
    name: Code Style (fmt + gateway-js-syntax + clippy + deny)
    runs-on: ubuntu-latest
    if: always()
    needs: [format, gateway-js-syntax, clippy, clippy-windows, deny-check, no-panics]
    steps:
      - run: |
          if [[ "${{ needs.format.result }}" != "success" || "${{ needs.gateway-js-syntax.result }}" != "success" || "${{ needs.clippy.result }}" != "success" || "${{ needs.deny-check.result }}" != "success" || "${{ needs.no-panics.result }}" != "success" ]]; then
            echo "One or more jobs failed"
            exit 1
          fi
          # clippy-windows only runs on main PRs, so skipped is acceptable but failure is not
          if [[ "${{ needs.clippy-windows.result }}" != "success" && "${{ needs.clippy-windows.result }}" != "skipped" ]]; then
            echo "Windows clippy failed: ${{ needs.clippy-windows.result }}"
            exit 1
          fi