name: check

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"

jobs:
  # Compliance is cheap and must always hold.
  compliance:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Ensure license & attribution files present
        run: |
          set -e
          test -f NOTICE
          test -f LICENSE-APACHE
          test -f LICENSE-GPL3
          echo "compliance files present"

  fmt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: rustfmt
        run: |
          rustup component add rustfmt
          cargo fmt --all --check

  # Build the runtimes (the on-chain deliverable). This is the gating job.
  # Heavy zombienet / emulated integration suites are intentionally NOT run here;
  # they are available in-tree and run on demand, not on every push.
  runtimes:
    # Self-hosted runner (dedicated, isolated box). For security on a public repo,
    # this heavy job runs ONLY on push to a branch in this repo or on PRs that
    # originate from this repo — never on pull requests from forks, so untrusted
    # code cannot execute on the runner.
    if: >-
      github.event_name == 'push' ||
      github.event.pull_request.head.repo.full_name == github.repository
    runs-on: [self-hosted, substrate-build]
    steps:
      - uses: actions/checkout@v7
      - name: Toolchain & targets
        run: |
          rustup show
          rustup component add rust-src
          rustup target add wasm32v1-none wasm32-unknown-unknown
      - name: Build runtime WASM (check)
        run: |
          cargo check --locked \
            -p pezkuwichain-runtime \
            -p zagros-runtime \
            -p asset-hub-pezkuwichain-runtime \
            -p asset-hub-zagros-runtime \
            -p people-pezkuwichain-runtime \
            -p people-zagros-runtime

  # The runtimes must also build with the try-runtime feature — this is what makes
  # safe storage migrations possible, a fund-critical gate before any upgrade. It is
  # light (-p runtimes only), so it stays on the every-push fast path. The heavy
  # full-workspace suites (tests, clippy, benches, doc-tests) run nightly in test.yml.
  check-try-runtime:
    if: >-
      github.event_name == 'push' ||
      github.event.pull_request.head.repo.full_name == github.repository
    runs-on: [self-hosted, substrate-build]
    steps:
      - uses: actions/checkout@v7
      - run: |
          cargo check --locked --features try-runtime \
            -p pezkuwichain-runtime -p zagros-runtime \
            -p asset-hub-pezkuwichain-runtime -p asset-hub-zagros-runtime \
            -p people-pezkuwichain-runtime -p people-zagros-runtime