stages:
  - lint
  - security
  - test
  - build
  - release

variables:
  CARGO_HOME: "$CI_PROJECT_DIR/.cargo"
  CARGO_INCREMENTAL: "0"
  CARGO_TERM_COLOR: "always"
  RUST_BACKTRACE: "short"
  RUSTFLAGS: "-D warnings"
  SCCACHE_DIR: "$CI_PROJECT_DIR/.sccache"

default:
  image: rust:slim
  before_script:
    - apt-get update -qq && apt-get install -y -qq --no-install-recommends
        pkg-config libssl-dev clang cmake protobuf-compiler git curl ca-certificates
    - rustup show  # installs channel from rust-toolchain.toml (1.88.0)
    - rustup target add wasm32-unknown-unknown
    - cargo --version && rustc --version
  cache:
    key:
      files:
        - Cargo.lock
        - rust-toolchain.toml
    paths:
      - .cargo/registry/
      - .cargo/git/
      - target/
    policy: pull-push
  interruptible: true
  timeout: 3h

# ─── LINT ────────────────────────────────────────────────────────────────────

fmt:
  stage: lint
  script:
    - cargo fmt --all -- --check
  allow_failure: false

check:
  stage: lint
  script:
    - cargo check --workspace --locked
  allow_failure: false

clippy:
  stage: lint
  script:
    - cargo clippy --workspace --locked -- -D warnings
  allow_failure: false

# ─── SECURITY ────────────────────────────────────────────────────────────────

cargo-audit:
  stage: security
  script:
    - cargo install cargo-audit --quiet
    - cargo audit
  allow_failure: true  # advisory-only; does not block merge

cargo-deny:
  stage: security
  script:
    - cargo install cargo-deny --quiet
    - cargo deny check --config deny.toml
  allow_failure: false

license-check:
  stage: security
  script:
    - |
      echo "Checking Apache-2.0 license headers..."
      if [ ! -f LICENSE-APACHE ]; then
        echo "ERROR: LICENSE-APACHE missing" && exit 1
      fi
      if [ ! -f NOTICE ]; then
        echo "ERROR: NOTICE file missing" && exit 1
      fi
      echo "✅ License files present"
  allow_failure: false

# ─── TEST ────────────────────────────────────────────────────────────────────

unit-tests:
  stage: test
  script:
    - cargo test --workspace --lib --locked 2>&1 | tee test-results.txt
  artifacts:
    when: always
    paths:
      - test-results.txt
    expire_in: 7 days
  allow_failure: false

wasm-check:
  stage: test
  script:
    - cargo check -p pezkuwichain-runtime --locked --target wasm32-unknown-unknown
  allow_failure: false

# ─── BUILD ───────────────────────────────────────────────────────────────────

build:
  stage: build
  script:
    - cargo build --release -p pezkuwi --locked 2>&1 | tee build.log
    - ls -lh target/release/pezkuwi target/release/pezkuwi-execute-worker target/release/pezkuwi-prepare-worker
  artifacts:
    paths:
      - target/release/pezkuwi
      - target/release/pezkuwi-execute-worker
      - target/release/pezkuwi-prepare-worker
    expire_in: 1 day
    when: on_success
  only:
    - main
    - tags

# ─── RELEASE ─────────────────────────────────────────────────────────────────

release:
  stage: release
  image: registry.gitlab.com/gitlab-org/release-cli:latest
  before_script: []  # override default before_script — no Rust needed
  needs:
    - build
  script:
    - echo "Creating release $CI_COMMIT_TAG"
  release:
    tag_name: "$CI_COMMIT_TAG"
    name: "Pezkuwi SDK $CI_COMMIT_TAG"
    description: |
      ## Pezkuwi SDK $CI_COMMIT_TAG

      Binary artifacts built from this release are attached.

      **Install:**
      ```bash
      curl -LO https://gitlab.com/pezkuwichain/pezkuwi-sdk/-/releases/$CI_COMMIT_TAG/downloads/pezkuwi
      chmod +x pezkuwi
      ```
  only:
    - /^v\d+\.\d+\.\d+$/
  except:
    - branches