# Steps run in file order, in one container, sharing /ci/build.
# Alpine, so the published binary is the same static musl build the
# Containerfile ships.

image = "docker.io/rust:1.98-alpine3.24"
work_dir = "/ci/build"
clone_project_to = "/ci/build/project"

# busybox ash, which does support `set -o pipefail`.
shell = ["/bin/sh", "-c"]

# CARGO_TARGET_DIR must stay outside clone_project_to: the checkout is
# extracted over that directory, so a cache inside it would be overwritten.
shell_setup = """
set -euo pipefail
export CARGO_TARGET_DIR=/ci/cache/target
"""

timeout = 5400
memory_limit = "6g"

# Caps are a safety valve against unbounded growth, not a budget: hitting one
# costs a full rebuild. Sized roughly twice the working set. A local target
# holding all three profiles measures 26G, of which debug is 22G.
cache = [
  { path = "/ci/cache/target", max_size = "20g" },
  { path = "/usr/local/cargo/registry", max_size = "4g" },
  { path = "/root/.bun/install/cache", max_size = "2g" },
]

[on]
push = ["master"]
tag = true

# bun publishes no musl installer, so take the binary from the official image.
# This mirrors the Containerfile's COPY --from. The -alpine tag is required:
# the glibc build will not run here. bun also needs libstdc++, which setup
# installs before anything executes it.
[[copy]]
image = "docker.io/oven/bun:1.4.2-alpine"
from = "/usr/local/bin/bun"
to = "/usr/local/bin"

[variables]

  [variables.TRUNK_VERSION]
  default = "0.21.14"
  description = "Trunk release that builds the wasm frontend. Matches the Containerfile."

# ── toolchain ────────────────────────────────────────────────────────────────
# binaryen supplies wasm-opt. Without it trunk downloads a glibc build that
# cannot run on musl. just comes from apk here, so no install script.
[[steps]]
name = "setup"
timeout = 900
run_sh = """
# openssl-dev + openssl-libs-static: webauthn-rs links OpenSSL, and this is
# a static musl build. make builds jemalloc. Mirrors the Containerfile's
# build stage.
apk add --no-cache musl-dev binaryen just curl libstdc++ make \
  openssl-dev openssl-libs-static pkgconfig

# The official rust images use rustup's minimal profile, so rustfmt and
# clippy are absent. `just lint` needs both.
rustup component add rustfmt clippy
rustup target add wasm32-unknown-unknown

url="https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-musl.tar.gz"
curl -fsSL -o /tmp/trunk.tar.gz "$url"
curl -fsSL "$url.sha256" | awk '{print $1 "  /tmp/trunk.tar.gz"}' | sha256sum -c -
tar xzf /tmp/trunk.tar.gz -C /usr/local/bin
rm -f /tmp/trunk.tar.gz

just --version && bun --version && trunk --version
cargo fmt --version && cargo clippy --version
"""

# ── checks ───────────────────────────────────────────────────────────────────
# Formatting and clippy findings are reported, not gated. The pinned CI
# toolchain can lag local machines, and clippy disagrees across versions.
[[steps]]
name = "lint"
run_sh = "cd project && just lint"
warn_on_fail = true

[[steps]]
name = "test"
run_sh = "cd project && just test"

# ── build ────────────────────────────────────────────────────────────────────
[[steps]]
name = "build"
timeout = 2400
run_sh = "cd project && just build"
publish_file = ["/ci/cache/target/release/dovenest"]

# `just e2e` would rebuild the frontend. The build step already staged
# server/dist, so run the embedded suite against it directly.
[[steps]]
name = "e2e"
run_sh = "cd project && cargo test -p server --features embedded --test api embedded"

# ── release ──────────────────────────────────────────────────────────────────
[[steps]]
name = "release"
run_if = 'test -n "${CI_COMMIT_TAG}"'
run_sh = """
cd project
install -Dm755 "${CARGO_TARGET_DIR}/release/dovenest" \
  "dist/dovenest-${CI_COMMIT_TAG}-x86_64-linux-musl"
"""
publish_gzip = ["/ci/build/project/dist/"]

# ── image ────────────────────────────────────────────────────────────────────
# Packages the binary the build step made, so the image ships exactly what
# e2e tested. The Containerfile's build stage is skipped via BIN_STAGE.
# build_image builds it in a VM on the server and pushes it to this repo's
# registry. A branch run pushes the short sha and "edge". A tag run pushes
# the short sha, the tag and "latest". Tags cannot depend on the trigger, so
# run_if picks one of two image steps.
[[steps]]
name = "image-files"
run_sh = """
cd project
mkdir -p ci-bin
cp "${CARGO_TARGET_DIR}/release/dovenest" ci-bin/dovenest
"""

[[steps]]
name = "image"
run_if = 'test -z "${CI_COMMIT_TAG}"'
timeout = 900
[steps.build_image]
args = { BIN_STAGE = "prebuilt" }
tags = ["$CI_COMMIT_SHORT_SHA", "edge"]

[[steps]]
name = "image-release"
run_if = 'test -n "${CI_COMMIT_TAG}"'
timeout = 900
[steps.build_image]
args = { BIN_STAGE = "prebuilt" }
tags = ["$CI_COMMIT_SHORT_SHA", "$CI_COMMIT_TAG", "latest"]