name: Development CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: rawmark-development
  cancel-in-progress: false

jobs:
  check-and-package:
    runs-on: ubuntu-latest
    timeout-minutes: 55
    env:
      CGO_ENABLED: '0'
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: https://github.com/actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Install frontend dependencies
        run: |
          corepack enable
          corepack prepare pnpm@12.11.2 --activate
          pnpm -C web install --frozen-lockfile --registry=https://registry.npmjs.org
      - name: Check and build frontend
        run: |
          pnpm -C web lint:check
          pnpm -C web typecheck
          pnpm -C web test
          pnpm -C web build
          pnpm -C web build:demo
      - name: Check backend
        run: |
          go vet -tags dev ./...
          go test ./internal/...
          go test -tags dev ./web ./cmd/rawmark
          go vet ./...
          go test ./web ./cmd/rawmark
      - name: Test filesystem permissions as an unprivileged user
        run: |
          for package in vault watch; do
            go test -c -o "/tmp/rawmark-$package.test" "./internal/$package"
            (cd "internal/$package" && runuser -u node -- "/tmp/rawmark-$package.test" -test.v)
          done
      - name: Build platform packages and smoke-test Linux amd64
        run: |
          mkdir -p package/licenses downloads
          cp LICENSE package/
          cp web/LICENSE package/licenses/vue3-starter-MIT.txt
          cp web/src/common/appearance/fonts/*-OFL.txt package/licenses/
          cp web/src/common/appearance/fonts/maple/LICENSE.txt package/licenses/Maple-Mono-OFL.txt
          for target in linux/amd64 linux/arm64 windows/amd64 darwin/arm64 darwin/amd64; do
            export GOOS="${target%/*}" GOARCH="${target#*/}"
            extension=''
            if [ "$GOOS" = windows ]; then extension='.exe'; fi
            rm -f package/rawmark package/rawmark.exe
            go vet ./...
            go build -trimpath -ldflags="-s -w -X main.releaseVersion=$(cat VERSION)" -o "package/rawmark$extension" ./cmd/rawmark
            if [ "$target" = linux/amd64 ]; then
              python3 scripts/smoke-release.py package/rawmark
            fi
            python3 scripts/package-release.py "$GOOS" "$GOARCH"
          done
      - name: Check upload sizes and generate checksums
        run: |
          python3 - <<'PY'
          import hashlib
          from pathlib import Path

          archives = sorted(Path('downloads').glob('rawmark_*'))
          if len(archives) != 5:
              raise SystemExit(f'Expected five platform packages, found {len(archives)}')
          checksums = []
          for archive in archives:
              size = archive.stat().st_size
              print(f'{archive.name}: {size:,} bytes')
              if size >= 90_000_000:
                  raise SystemExit(f'{archive.name} exceeds the 90 MB upload budget (Cloudflare limit: 100 MB)')
              checksums.append(f'{hashlib.file_digest(archive.open("rb"), "sha256").hexdigest()}  {archive.name}\n')
          Path('downloads/SHA256SUMS').write_text(''.join(checksums))
          PY
      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-amd64
          path: downloads/*_linux_amd64.tar.gz
          compression-level: 0
          if-no-files-found: error
          retention-days: 7
      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-arm64
          path: downloads/*_linux_arm64.tar.gz
          compression-level: 0
          if-no-files-found: error
          retention-days: 7
      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: windows-amd64
          path: downloads/*_windows_amd64.zip
          compression-level: 0
          if-no-files-found: error
          retention-days: 7
      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: darwin-arm64
          path: downloads/*_darwin_arm64.tar.gz
          compression-level: 0
          if-no-files-found: error
          retention-days: 7
      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: darwin-amd64
          path: downloads/*_darwin_amd64.tar.gz
          compression-level: 0
          if-no-files-found: error
          retention-days: 7
      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: checksums
          path: downloads/SHA256SUMS
          if-no-files-found: error
          retention-days: 7