ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

env:
  CARGO_TERM_COLOR: always

jobs:
  # -----------------------------------------------------------------------
  # Primary build & test (default features)
  # -----------------------------------------------------------------------
  test:
    name: Build & Test
    runs-on: ubuntu-latest
    env:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
    steps:
      - uses: actions/checkout@v4

      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y python3-dev

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Build
        run: cargo build --all-targets

      - name: Test
        run: cargo test

      - name: Install cargo-llvm-cov
        run: cargo install cargo-llvm-cov --locked

      - name: Generate coverage report
        run: cargo llvm-cov --all-features --lcov --output-path lcov.info

      - name: Upload coverage to Codecov
        if: env.CODECOV_TOKEN != ''
        uses: codecov/codecov-action@v5
        with:
          files: lcov.info

      - name: Gate (forbidden patterns + zero warnings)
        run: python3 verify_implementation.py

  # -----------------------------------------------------------------------
  # Release build — catches optimization-only errors
  # -----------------------------------------------------------------------
  release:
    name: Release Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y python3-dev

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Build (release)
        run: cargo build --release

      - name: Test (release)
        run: cargo test --release


  # -----------------------------------------------------------------------
  # Nula package-manager smoke test — scaffold a package and run `nula test`
  # -----------------------------------------------------------------------
  nula-test:
    name: Nula Package Test
    runs-on: ubuntu-latest
    needs: release
    steps:
      - uses: actions/checkout@v4

      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y python3-dev

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Build nulang (release)
        run: cargo build --release

      - name: Smoke test (eval)
        run: ./target/release/nulang --eval 'perform IO.print("hello")'

      - name: Scaffold test package
        run: ./target/release/nulang nula new test-pkg

      - name: Run nula test
        run: cd test-pkg && ../target/release/nulang nula test

      - name: Verify documentation examples
        run: NULANG_BIN=./target/release/nulang bash scripts/verify_doc_examples.sh
  # -----------------------------------------------------------------------
  # No-default-features build — proves zero PyO3/SQLite/LSP dependencies
  # -----------------------------------------------------------------------
  minimal-build:
    name: Build without optional features
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      # No python3-dev installed here on purpose: this job proves the
      # no-default-features build has zero PyO3/SQLite/LSP dependencies.
      - name: Build
        run: cargo build --all-targets --no-default-features

      - name: Test
        run: cargo test --no-default-features

      - name: Check zero warnings
        run: cargo check --tests --no-default-features

  # -----------------------------------------------------------------------
  # WASM backend
  # -----------------------------------------------------------------------
  wasm-backend:
    name: Build & Test (wasm-backend feature)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y python3-dev

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Build
        run: cargo build --all-targets --features wasm-backend

      - name: Test
        run: cargo test --features wasm-backend

  # -----------------------------------------------------------------------
  # Lint — format, clippy, audit, docs, all-features check
  # -----------------------------------------------------------------------
  lint:
    name: Format, Clippy & Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y python3-dev

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      # Format check is blocking — the codebase has been rustfmt'd.
      - name: Format check
        run: cargo fmt --check

      # Clippy with default features — correctness lints are blocking.
      - name: Clippy (default features)
        run: cargo clippy --all-targets -- -D clippy::correctness

      # Clippy with all features — catches wasm-backend code paths.
      - name: Clippy (all features)
        run: cargo clippy --all-targets --all-features -- -D clippy::correctness

      # Clippy with no default features — catches minimal-build code paths.
      - name: Clippy (no default features)
        run: cargo clippy --all-targets --no-default-features -- -D clippy::correctness

      # Zero compiler warnings on the main build path.
      - name: Check zero warnings (tests)
        run: cargo check --tests

      # Security audit of dependency tree.
      - name: Audit (cargo-audit)
        run: |
          cargo install cargo-audit --locked
          cargo audit

      # All-features compilation check.
      - name: Check all features
        run: cargo check --all-features

      # Documentation builds without errors.
      - name: Check docs
        run: cargo doc --no-deps

      # Documentation warnings are non-blocking but visible.
      - name: Doc warnings (info only)
        run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps 2>&1 || true

  # -----------------------------------------------------------------------
  # Lean formalization — verifies the formal specs compile
  # -----------------------------------------------------------------------
  lean:
    name: Lean Formalization
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install elan (Lean toolchain manager)
        run: |
          curl https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh -sSf | sh -s -- -y --default-toolchain leanprover/lean4:v4.16.0
          echo "$HOME/.elan/bin" >> $GITHUB_PATH

      - name: Build formal specs
        run: |
          cd spec/formal
          lake build

      - name: Sorry-count ratchet (no silent proof regressions)
        run: |
          cd spec/formal
          count=$(grep -rc '\bsorry\b' *.lean | awk -F: '{sum+=$2} END {print sum+0}')
          baseline=9
          echo "sorry count: $count (baseline: $baseline)"
          if [ "$count" -gt "$baseline" ]; then
            echo "::error::spec/formal/*.lean sorry count ($count) exceeds baseline ($baseline)."
            echo "::error::A PR must not silently regress a proved theorem to 'sorry'. If intentional"
            echo "::error::(e.g. a toolchain compat fix), lower this baseline AND document the"
            echo "::error::regression in spec/formal/README.md, SPEC2.md, CHANGELOG.md, and PLAN.md"
            echo "::error::(see the 2026-08-02 correction entries for the required disclosure"
            echo "::error::pattern this repeats: what regressed, which commit, why, and current"
            echo "::error::per-theorem status)."
            exit 1
          fi

  # -----------------------------------------------------------------------
  # Benchmarks — regression-gated against a rolling window of recent
  # main-branch history (see scripts/check_bench_regression.py and
  # benchmarks/README.md for the noise-aware methodology: each
  # benchmark's own historical spread sets its threshold, not a flat
  # percentage — GitHub Actions' shared runners commonly show 20-50%+
  # run-to-run noise, so a naive fixed threshold would fail PRs for
  # noise, not real regressions). Runs on push to main only (not every
  # PR) since a full criterion run of every group is slow; results are
  # committed back so PERFORMANCE_ANALYSIS.md can cite real numbers
  # instead of estimates. The gate needs >= 3 prior commits' worth of
  # history for a given benchmark before it will fail anything, so
  # early runs (and brand-new benchmarks) are informational only until
  # enough history accumulates.
  # -----------------------------------------------------------------------
  bench:
    name: Benchmarks (regression-gated)
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4

      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y python3-dev

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Run benchmarks
        run: cargo bench --bench bench_main

      - name: Collect results
        run: |
          python3 scripts/collect_bench_results.py \
            --criterion-dir target/criterion \
            --out "benchmarks/$(git rev-parse --short HEAD).json"

      - name: Check for regressions
        id: regression_check
        continue-on-error: true
        run: |
          python3 scripts/check_bench_regression.py \
            --latest "benchmarks/$(git rev-parse --short HEAD).json" \
            --history-dir benchmarks

      - name: Upload results as build artifact
        uses: actions/upload-artifact@v4
        with:
          name: bench-results-${{ github.sha }}
          path: benchmarks/*.json
          retention-days: 90

      - name: Commit results to benchmarks/
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add "benchmarks/$(git rev-parse --short HEAD).json"
          git diff --staged --quiet || git commit -m "bench: record results for $(git rev-parse --short HEAD) [skip ci]"
          git push

      # Separate from the check step itself so the commit above always
      # happens (preserving complete rolling-window history) even when
      # this commit's numbers regressed.
      - name: Fail the job if a regression was found
        if: steps.regression_check.outcome == 'failure'
        run: exit 1