name: PR

on:
  # Every PR, whatever it targets: a stacked PR based on another branch needs
  # the same gate as one based on master.
  pull_request:

# Cancel superseded runs on the same PR.
concurrency:
  group: pr-${{ github.ref }}
  cancel-in-progress: true

jobs:
  gate:
    runs-on: ubuntu-latest
    env:
      # Build in module mode; never use a vendor/ dir.
      GOFLAGS: -mod=mod

    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.24"

      - name: Set up Nim
        uses: jiro4989/setup-nim-action@v2
        with:
          nim-version: "2.2.4"
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Cache the built library
        # Keyed on the .nimble, which carries the logos-delivery pin. Only the
        # artifact is cached: a run that fails mid-resolve leaves a partial
        # ~/.nimble/pkgcache, and restoring that makes every later run fail with
        # "unable to read tree".
        uses: actions/cache@v4
        with:
          path: build
          key: liblogosdelivery-${{ runner.os }}-${{ hashFiles('logos_delivery_go_bindings.nimble') }}

      - name: Resolve Nim dependencies
        run: make deps

      - name: Build liblogosdelivery
        # Via the Nimble package: the same path a consumer uses.
        run: make liblogosdelivery

      - name: Export cgo flags
        run: |
          dir=$(nimble path logos_delivery | tail -1)
          echo "CGO_CFLAGS=-I$dir/library" >> "$GITHUB_ENV"
          echo "CGO_LDFLAGS=-L$PWD/build -llogosdelivery -Wl,-rpath,$PWD/build" >> "$GITHUB_ENV"

      - name: go build
        run: go build ./...

      - name: go vet
        run: go vet ./...

      - name: go mod tidy is clean
        # `go mod tidy` must be a no-op on a well-maintained module. If it
        # changes go.mod/go.sum the PR left them out of sync — fail and show
        # the diff so the author can commit the tidied result.
        run: |
          go mod tidy
          git diff --exit-code go.mod go.sum

      - name: Ensure base ref is available for lint
        # golangci-lint's new-from-merge-base needs origin/master present.
        run: git fetch --no-tags origin master

      - name: golangci-lint
        # v7 is required for golangci-lint v2.
        uses: golangci/golangci-lint-action@v7
        with:
          version: v2.4.0
          # `config verify` fetches its JSON schema from golangci-lint.run on
          # every run and fails the job when that request times out. An invalid
          # config still fails the lint run itself, so skip the pre-check.
          verify: false

      - name: go test unit (run)
        # Fast, network-free unit tests: the Messaging API, its ffi bridge, and
        # the wire decoders in pkg/kernel/common.
        run: go test ./pkg/messaging/... ./pkg/kernel/common/... ./internal/ffi/...

      - name: go test messaging integration (compile)
        # The integration suite needs outbound connectivity, so it is behind a
        # build tag. Compile it here so it cannot rot unnoticed.
        run: go test -tags integration -run '^$' ./pkg/messaging/...

      - name: go test kernel argument shaping (run)
        # Named explicitly: the rest of the kernel suite needs a live node.
        run: go test -run 'TestPeerAddr|TestContextTimeout' ./pkg/kernel/

      - name: go test kernel (compile)
        # The kernel suite is heavy integration (runs nightly in CI.yml), so
        # only compile its test binaries here.
        run: go test -run '^$' ./pkg/kernel/...