ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
          fetch-depth: 0

      - uses: ./.github/actions/gradle-setup
        with:
          cache_read_only: ${{ github.event_name == 'pull_request' }}
          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}

      - name: Run spotlessCheck and detektAll
        run: ./gradlew spotlessCheck detektAll --stacktrace

  test-jvm:
    name: Test JVM
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
          fetch-depth: 0

      - uses: ./.github/actions/gradle-setup
        with:
          cache_read_only: ${{ github.event_name == 'pull_request' }}
          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}

      - name: Run JVM tests and verify coverage
        run: ./gradlew jvmTest koverVerify --stacktrace

      - name: Generate coverage report
        if: always()
        run: ./gradlew koverXmlReport --stacktrace

      - name: Upload coverage to Codecov
        if: always()
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          files: build/reports/kover/report.xml
          flags: jvm
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

  test-native-linux:
    name: Test Native Linux
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
          fetch-depth: 0

      - uses: ./.github/actions/gradle-setup
        with:
          cache_read_only: ${{ github.event_name == 'pull_request' }}
          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}

      - name: Run Linux native tests
        run: ./gradlew linuxX64Test --stacktrace

  test-native-macos:
    name: Test Native macOS
    runs-on: macos-26
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
          fetch-depth: 0

      - uses: ./.github/actions/gradle-setup
        with:
          cache_read_only: ${{ github.event_name == 'pull_request' }}
          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}

      - name: Run macOS and iOS simulator tests
        run: ./gradlew macosArm64Test iosSimulatorArm64Test --stacktrace

  test-wasm:
    name: Test wasmJs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
          fetch-depth: 0

      - uses: ./.github/actions/gradle-setup
        with:
          cache_read_only: ${{ github.event_name == 'pull_request' }}
          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}

      - name: Run wasmJs browser tests
        run: ./gradlew wasmJsBrowserTest --stacktrace

  test-windows:
    name: Test Windows
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
          fetch-depth: 0

      - uses: ./.github/actions/gradle-setup
        with:
          cache_read_only: ${{ github.event_name == 'pull_request' }}
          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}

      - name: Run Windows native tests
        shell: bash
        run: ./gradlew mingwX64Test --stacktrace

  api-check:
    name: API Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
          fetch-depth: 0

      - uses: ./.github/actions/gradle-setup
        with:
          cache_read_only: ${{ github.event_name == 'pull_request' }}
          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}

      # apiCheck now validates the klib/native ABI too, so it compiles native
      # klibs and needs the Kotlin/Native toolchain. Cache ~/.konan to avoid
      # re-downloading it every run.
      - name: Cache Konan (Kotlin/Native toolchain)
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.konan
          key: konan-${{ runner.os }}-${{ hashFiles('gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
          restore-keys: |
            konan-${{ runner.os }}-

      - name: Run API compatibility check
        run: ./gradlew apiCheck --stacktrace

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [lint, test-jvm, test-native-linux, test-native-macos, test-wasm, test-windows, api-check]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
          fetch-depth: 0

      - uses: ./.github/actions/gradle-setup
        with:
          cache_read_only: ${{ github.event_name == 'pull_request' }}
          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}

      - name: Build
        run: ./gradlew build --stacktrace

  publish-snapshot:
    name: Publish Snapshot
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs: [build]
    runs-on: macos-26
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
          fetch-depth: 0

      - uses: ./.github/actions/gradle-setup
        with:
          cache_read_only: 'false'
          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}

      - name: Compute snapshot version
        id: version
        run: |
          TAG_VERSION=$(git describe --tags --match 'v*' --abbrev=0 | sed 's/^v//')
          IFS='.' read -r major minor patch <<< "$TAG_VERSION"
          SNAPSHOT_VERSION="${major}.${minor}.$((patch + 1))-SNAPSHOT"
          echo "snapshot=$SNAPSHOT_VERSION" >> "$GITHUB_OUTPUT"
          echo "Publishing snapshot: $SNAPSHOT_VERSION"

      - name: Publish to Maven Central (snapshots)
        run: >-
          ./gradlew publishAllPublicationsToMavenCentralRepository
          -PVERSION_NAME=${{ steps.version.outputs.snapshot }}
          --stacktrace
        env:
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.OSSRH_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.OSSRH_PASSWORD }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.SIGNING_KEY_ID }}
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}