ci.yml

# Copyright 2026 Phillip Cloud
# Licensed under the Apache License, Version 2.0

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

env:
  CGO_ENABLED: "0"
  TZ: UTC

jobs:
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      go: ${{ steps.detect.outputs.go }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          sparse-checkout: .github/detect-go-changes.bash
          sparse-checkout-cone-mode: false
          persist-credentials: false

      - name: Check for Go-related changes
        id: detect
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          go=$(bash .github/detect-go-changes.bash \
            "${{ github.event_name }}" \
            "${{ github.event.pull_request.number }}" \
            "${{ github.event.before }}" \
            "${{ github.sha }}")
          echo "go=$go" >> "$GITHUB_OUTPUT"

  test:
    name: Build & Test (${{ matrix.os }})
    needs: changes
    if: needs.changes.outputs.go == 'true'
    runs-on: ${{ matrix.os }}
    concurrency:
      group: ci-test-${{ matrix.os }}-${{ github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    strategy:
      fail-fast: ${{ github.event_name == 'pull_request' }}
      matrix:
        os:
          - ubuntu-latest
          - ubuntu-24.04-arm
          - macos-latest
          - windows-latest
          - windows-11-arm
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version: "1.25"

      - name: Install extraction tools (Linux)
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y poppler-utils tesseract-ocr imagemagick

      - name: Symlink magick to convert (Linux)
        if: runner.os == 'Linux'
        run: command -v magick || sudo ln -s "$(command -v convert)" /usr/local/bin/magick

      - name: Install extraction tools (macOS)
        if: runner.os == 'macOS'
        run: brew install poppler tesseract imagemagick-full ghostscript

      - name: Add imagemagick-full to PATH (macOS)
        if: runner.os == 'macOS'
        run: echo "$(brew --prefix imagemagick-full)/bin" >> "$GITHUB_PATH"

      # Microsoft.DesktopAppInstaller_8wekyb3d8bbwe is the package family
      # name for winget in the Windows Store.
      - name: Configure winget (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $settingsDir = "$env:LOCALAPPDATA\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState"
          New-Item -ItemType Directory -Path $settingsDir -Force | Out-Null
          Copy-Item .github\winget-settings.json "$settingsDir\settings.json"

      - name: Install extraction tools (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $flags = @('--accept-source-agreements', '--accept-package-agreements', '--disable-interactivity', '--silent', '--force')
          winget install --id oschwartz10612.Poppler @flags
          winget install --id tesseract-ocr.tesseract @flags
          winget install --id ImageMagick.ImageMagick @flags

      - name: Add extraction tools to PATH (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          Add-Content $env:GITHUB_PATH "$env:LOCALAPPDATA\Microsoft\WinGet\Links"
          Get-ChildItem "$env:LOCALAPPDATA\Microsoft\WinGet\Packages\oschwartz10612.Poppler_*\poppler-*\Library\bin" |
            Select-Object -First 1 -ExpandProperty FullName |
            Add-Content $env:GITHUB_PATH
          Add-Content $env:GITHUB_PATH "$env:ProgramFiles\Tesseract-OCR"
          Get-ChildItem "$env:ProgramFiles\ImageMagick-*" -Directory |
            Select-Object -First 1 -ExpandProperty FullName |
            Add-Content $env:GITHUB_PATH

      - name: Generate sample PDF fixture
        shell: bash
        run: bash internal/extract/gen-sample-pdf.bash

      - name: Generate invoice PNG fixture
        shell: bash
        run: bash internal/extract/gen-invoice-png.bash

      - name: Generate sample text PNG fixture
        shell: bash
        run: bash internal/extract/gen-sample-text-png.bash

      - name: Generate scanned PDF fixture
        shell: bash
        run: bash internal/extract/gen-scanned-pdf.bash

      - name: Generate mixed PDF fixture
        shell: bash
        run: bash internal/extract/gen-mixed-pdf.bash

      - name: Build
        run: go build ./cmd/micasa

      - name: Test
        if: runner.os != 'Windows' || runner.arch != 'ARM64'
        env:
          CGO_ENABLED: "1"
          MICASA_TEST_SEED: ${{ github.run_id }}
        run: go test -race -shuffle on -timeout 5m -coverprofile coverage.txt ./...

      - name: Test (no race)
        if: runner.os == 'Windows' && runner.arch == 'ARM64'
        env:
          MICASA_TEST_SEED: ${{ github.run_id }}
        run: go test -shuffle on -timeout 5m -coverprofile coverage.txt ./...

      - name: Upload coverage
        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
        with:
          files: coverage.txt
          token: ${{ secrets.CODECOV_TOKEN }}

  benchmarks:
    name: Benchmarks (smoke)
    needs: changes
    if: needs.changes.outputs.go == 'true'
    runs-on: ubuntu-latest
    concurrency:
      group: ci-benchmarks-${{ github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version: "1.25"

      - name: Run smoke benchmarks
        run: go test -bench . -benchtime 1x -timeout 5m -run '^$' ./...

  nix-build:
    name: Nix Build
    needs: changes
    if: needs.changes.outputs.go == 'true'
    runs-on: ubuntu-latest
    concurrency:
      group: ci-nix-build-${{ github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version: "1.25"

      - name: Check go mod tidy
        run: |
          go mod tidy
          git diff --exit-code go.mod go.sum

      - uses: cachix/install-nix-action@19effe9fe722874e6d46dd7182e4b8b7a43c4a99 # v31.10.0

      - name: Build with Nix
        run: nix build '.#micasa'

  docs:
    name: Docs Build
    runs-on: ubuntu-latest
    concurrency:
      group: ci-docs-${{ github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: cachix/install-nix-action@19effe9fe722874e6d46dd7182e4b8b7a43c4a99 # v31.10.0

      - name: Build docs
        run: nix run '.#docs'

  # ---------------------------------------------------------------------------
  # Semantic Release (dry-run on PRs, publish on main push)
  # ---------------------------------------------------------------------------

  semantic-release:
    name: Semantic Release
    needs: [changes, test, nix-build, docs]
    if: >-
      always()
      && !contains(needs.*.result, 'failure')
      && !contains(needs.*.result, 'cancelled')
      && (needs.changes.outputs.go != 'true' || (needs.test.result == 'success' && needs.nix-build.result == 'success'))
    runs-on: ubuntu-latest
    concurrency:
      group: semantic-release-${{ github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    permissions:
      contents: write
    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: lts/*

      - name: Install semantic-release
        run: npm install -g semantic-release@25.0.3 @semantic-release/exec@7.1.0 @semantic-release/git@10.0.1

      - name: Run semantic-release
        run: npx semantic-release ${{ github.event_name == 'pull_request' && '--dry-run' || '' }}
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

  # ---------------------------------------------------------------------------
  # Gate: single required check that rolls up all jobs above.
  # After merging, update the repo ruleset to require only "CI / Result".
  # ---------------------------------------------------------------------------

  result:
    name: CI / Result
    if: always()
    needs: [changes, test, benchmarks, nix-build, docs, semantic-release]
    runs-on: ubuntu-latest
    steps:
      - run: exit 1
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')