ci.yml

name: PR checks

on:
  pull_request:

permissions:
  contents: read

concurrency:
  group: pr-checks-${{ github.event.pull_request.number }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"
  RUSTDOCFLAGS: "-D warnings"

jobs:
  planner:
    name: Change planner
    runs-on: ubuntu-latest
    outputs:
      rust: ${{ steps.plan.outputs.rust }}
      docs: ${{ steps.plan.outputs.docs }}
      cuda: ${{ steps.plan.outputs.cuda }}
      metal: ${{ steps.plan.outputs.metal }}
      metal_compile: ${{ steps.plan.outputs.metal_compile }}
      expectations: ${{ steps.plan.outputs.expectations }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: "1.96"
      - id: plan
        name: Classify changed paths and dependency impact
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: python3 scripts/ci_plan.py plan --base "${BASE_SHA}" --head "${HEAD_SHA}"

  github-actions-verifier:
    name: GitHub Actions verifier tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - run: python3 -m unittest discover -s scripts/tests -p 'test_*.py' -v

  diff-check:
    name: Diff check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Reject whitespace errors in the submitted delta
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: git diff --check "${BASE_SHA}...${HEAD_SHA}"

  secret-scan:
    name: Secret scan
    uses: ./.github/workflows/secret-scan.yml

  rust-quality:
    name: Rust quality
    needs: [planner]
    if: ${{ needs.planner.outputs.rust == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: "1.96"
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: pr-host-${{ runner.os }}-${{ runner.arch }}-1.96
          cache-bin: false
          save-if: false
      - name: Run fast hosted Rust gates
        run: |
          cargo xtask fmt
          cargo xtask clippy
          cargo xtask clippy-strict
          cargo xtask test
          cargo xtask release-integrity
          cargo xtask repo-lint

  docs:
    name: Documentation
    needs: [planner]
    if: ${{ needs.planner.outputs.docs == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: "1.96"
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: pr-docs-${{ runner.os }}-${{ runner.arch }}-1.96
          cache-bin: false
          save-if: false
      - run: cargo xtask doc

  metal-compile:
    name: Metal compile and pure tests
    needs: [planner]
    if: ${{ needs.planner.outputs.metal_compile == 'true' }}
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: "1.96"
          components: clippy
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: pr-metal-compile-${{ runner.os }}-${{ runner.arch }}-1.96
          cache-bin: false
          save-if: false
      - run: cargo xtask metal-compile

  gpu-evidence:
    name: GPU evidence policy
    needs: [planner]
    if: ${{ always() && needs.planner.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - name: Require exact-SHA quick GPU validation for affected lanes
        env:
          CUDA_REQUIRED: ${{ needs.planner.outputs.cuda }}
          GH_TOKEN: ${{ github.token }}
          GITHUB_API_URL: ${{ github.api_url }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          METAL_REQUIRED: ${{ needs.planner.outputs.metal }}
          REPOSITORY: ${{ github.repository }}
        run: |
          if [ "${CUDA_REQUIRED}" = true ] && [ "${METAL_REQUIRED}" = true ]; then
            python3 scripts/github_actions_verify.py verify-workflow \
              --repository "${REPOSITORY}" --workflow gpu-validation.yml \
              --sha "${HEAD_SHA}" --event workflow_dispatch \
              --required-job "CUDA quick validation" \
              --required-job "Metal quick validation"
          elif [ "${CUDA_REQUIRED}" = true ]; then
            python3 scripts/github_actions_verify.py verify-workflow \
              --repository "${REPOSITORY}" --workflow gpu-validation.yml \
              --sha "${HEAD_SHA}" --event workflow_dispatch \
              --required-job "CUDA quick validation"
          elif [ "${METAL_REQUIRED}" = true ]; then
            python3 scripts/github_actions_verify.py verify-workflow \
              --repository "${REPOSITORY}" --workflow gpu-validation.yml \
              --sha "${HEAD_SHA}" --event workflow_dispatch \
              --required-job "Metal quick validation"
          else
            echo "No GPU evidence is required for this pull request."
          fi

  pr-required-checks:
    name: PR required checks
    if: ${{ always() }}
    needs:
      - planner
      - github-actions-verifier
      - diff-check
      - secret-scan
      - rust-quality
      - docs
      - metal-compile
      - gpu-evidence
    runs-on: ubuntu-latest
    env:
      EXPECTATIONS: ${{ needs.planner.outputs.expectations }}
      REQUIRED_RESULTS: ${{ toJSON(needs) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - name: Require planned gates and reject unexpected skips
        run: |
          python3 scripts/ci_plan.py aggregate \
            --expectations-json "${EXPECTATIONS}" \
            --needs-json "${REQUIRED_RESULTS}" \
            --always-required planner \
            --always-required github-actions-verifier \
            --always-required diff-check \
            --always-required secret-scan \
            --always-required gpu-evidence