on:
  pull_request:
    branches:
      - 'master'
      - '*_release/*'
    types:
      - opened
      - reopened
      - synchronize
      - ready_for_review
  workflow_dispatch:
    inputs:
      runner_type:
        required: true
        type: choice
        options:
          - self_hosted
          - github_hosted
  workflow_call:

name: Warp CI

env:
  CARGO_TERM_COLOR: always
  NEXTEST_PROFILE: ci
  WORKSPACE_TEST_ARGS: --workspace --locked --exclude command-signatures-v2
  # Include only as much debug info as is necessary to see backtraces
  # in test failures.  This should speed up compilation somewhat and
  # reduces the size of built artifacts (which addresses issues with
  # running out of space on GitHub-hosted runners).
  RUSTFLAGS: -C debuginfo=line-tables-only --cfg=web_sys_unstable_apis
  # Ensure we open up real windows that render their contents via the GPU,
  # so that we can exercise the actual rendering logic.
  WARPUI_USE_REAL_DISPLAY_IN_INTEGRATION_TESTS: 1

concurrency:
  # Cancel any outstanding CI workflow runs against the same PR.
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  params:
    name: Compute workflow parameters
    timeout-minutes: 3
    runs-on: ubuntu-latest
    # Don't automatically run CI for draft PRs, to reduce GitHub Actions costs.
    #
    # Also, don't run CI for repo-sync PRs _unless_ there is a merge conflict - for those,
    # we'll want to make sure that the conflict resolution doesn't introduce any issues.
    if: >-
      github.event.pull_request.draft == false &&
      (!startsWith(github.event.pull_request.head.ref, 'repo-sync/') || contains(github.event.pull_request.labels.*.name, 'repo-sync:conflict'))
    outputs:
      affects-database-schema: ${{ github.ref == 'master' || steps.filter.outputs.affects-database-schema }}
      affects-rust-sources: ${{ github.ref == 'master' || steps.filter.outputs.affects-rust-sources }}
      macos-runner: ${{ steps.mac_runner_type.outputs.value }}
      wasm-runner: ${{ steps.wasm_runner_type.outputs.value }}
    steps:
      - name: Checkout sources
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check changed files
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        with:
          filters: |
            affects-database-schema:
              - 'crates/persistence/src/schema.rs'
              - 'crates/persistence/migrations/**'
            affects-rust-sources:
              - '**.rs'

      - name: Determine macOS runner type
        id: mac_runner_type
        run: |
          RUNNER_TYPE='["namespace-profile-mac-ci"]'
          echo "value=$RUNNER_TYPE" >> $GITHUB_OUTPUT

      - name: Determine wasm runner type
        id: wasm_runner_type
        run: |
          # Use a larger (16 core, 64GB ram) runner on Linux to speed up execution time.
          # https://github.com/warpdotdev/warp-internal/settings/actions/runners
          RUNNER_TYPE='["ubuntu-latest-large"]'
          echo "value=$RUNNER_TYPE" >> $GITHUB_OUTPUT

  tests:
    name: Run ${{ matrix.name }} tests
    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: "macos"
            name: "MacOS"
            runner: ${{ fromJSON(needs.params.outputs.macos-runner) }}
            is_self_hosted: ${{ contains(fromJSON(needs.params.outputs.macos-runner), 'self-hosted') }}
            extra_test_args: ""

          - os: "linux"
            name: "Linux"
            # Use a larger (16 core, 64GB ram) runner on Linux to speed up execution time.
            # https://github.com/warpdotdev/warp-internal/settings/actions/runners
            runner: ubuntu-latest-large
            # We don't (yet) have any self-hosted Linux runners.
            is_self_hosted: false
            extra_test_args: ""

          - os: "windows"
            name: "Windows"
            runner: windows-latest-large
            # We don't (yet) have any self-hosted Windows runners.
            is_self_hosted: false
            extra_test_args: "--exclude command-signatures-v2 --exclude warp_js"
    runs-on: ${{ matrix.runner }}
    needs: params
    # Make sure an ID token is created with the necessary permissions to use
    # GCP's Workload Identity Federation (for service account authentication).
    permissions:
      contents: 'read'
      id-token: 'write'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: ./.github/actions/prepare_environment
        with:
          target_os: ${{ matrix.os }}
          is_self_hosted: ${{ matrix.is_self_hosted }}
          install_test_deps: true

      - name: Install Shells
        uses: ConorMacBride/install-package@3e7ad059e07782ee54fa35f827df52aae0626f30 # v1
        if: ${{ matrix.is_self_hosted == false }}
        with:
          apt: zsh fish
          brew: fish bash

      - name: Echo Shells (UNIX)
        id: echo_shells_unix
        if: ${{ matrix.os != 'windows' }}
        shell: bash
        run: |
          if ${{ matrix.os == 'macos' }}; then
            LATEST_BASH_PATH="$(brew --prefix bash)/bin/bash"
            echo "latest_bash_path=$LATEST_BASH_PATH" >> $GITHUB_OUTPUT
            LATEST_BASH_VERSION="$($LATEST_BASH_PATH --version)"
            echo "::notice title=${{ matrix.name }} Tests - Latest Bash Version::$LATEST_BASH_VERSION"
          fi

          DEFAULT_BASH_PATH="$(command -pv bash)"
          DEFAULT_BASH_VERSION="$($DEFAULT_BASH_PATH --version)"
          echo "default_bash_path=$DEFAULT_BASH_PATH" >> $GITHUB_OUTPUT
          echo "::notice title=${{ matrix.name }} Tests - Default Bash Version::$DEFAULT_BASH_VERSION"

          FISH_PATH="$(which fish)"
          echo "fish_path=$FISH_PATH" >> $GITHUB_OUTPUT
          FISH_VERSION="$($FISH_PATH --version)"
          echo "::notice title=${{ matrix.name }} Tests - Fish Version::$FISH_VERSION"

          ZSH_VERSION="$(zsh --version)"
          ZSH_PATH="$(which zsh)"
          echo "zsh_path=$ZSH_PATH" >> $GITHUB_OUTPUT
          echo "::notice title=${{ matrix.name }} Tests - Zsh Version::$ZSH_VERSION"

          POWERSHELL_PATH="$(which pwsh)"
          POWERSHELL_VERSION=$(pwsh -version | awk '{print $2}')
          echo "powershell_path=$POWERSHELL_PATH" >> $GITHUB_OUTPUT
          echo "::notice title=${{ matrix.name }} Tests - Powershell Version::$POWERSHELL_VERSION"

      - name: Echo Shells (Windows)
        id: echo_shells_windows
        if: ${{ matrix.os == 'windows' }}
        shell: pwsh
        run: |
          $env:POWERSHELL_PATH = (Get-Command pwsh).Source
          $env:POWERSHELL_VERSION = (Get-Command pwsh).Version.Major
          Write-Output 'Powershell path:' $env:POWERSHELL_PATH
          Write-Output 'Powershell version:' $env:POWERSHELL_VERSION
          Write-Output "powershell_path=$env:POWERSHELL_PATH" >> $env:GITHUB_OUTPUT
          Write-Output "::notice title=${{ matrix.name }} Tests - Powershell Version::$env:POWERSHELL_VERSION"

      - name: Echo Default Shell
        id: echo_default_shell
        shell: bash
        run: |
          if ${{ matrix.os == 'windows' }}; then
            DEFAULT_SHELL="${{ steps.echo_shells_windows.outputs.powershell_path }}"
          else
            DEFAULT_SHELL="${{ steps.echo_shells_unix.outputs.zsh_path }}"
          fi
          echo "Using default shell '$DEFAULT_SHELL'"
          echo "default_shell_path=$DEFAULT_SHELL" >> $GITHUB_OUTPUT

      - name: Install cargo nextest
        if: ${{ matrix.is_self_hosted == false }}
        uses: taiki-e/install-action@9a29ce630c67077a359246f3e4f84941e05f28b5 # v1
        with:
          tool: nextest

      - name: Run ssh-agent for SSH tests
        if: ${{ matrix.os == 'linux' }}
        run: |
          # Create the .ssh dir.
          mkdir -p ~/.ssh

          # Run the agent.
          eval "$(ssh-agent -s)"

          # Persist the SSH_AUTH_SOCK and SSH_AGENT_PID for future steps
          echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> $GITHUB_ENV
          echo "SSH_AGENT_PID=$SSH_AGENT_PID" >> $GITHUB_ENV

      - name: Set up gcloud authentication for SSH tests
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          workload_identity_provider: projects/63595664881/locations/global/workloadIdentityPools/github-pool/providers/github-provider
          service_account: github-ci-workflow@warp-ssh-integration-testing.iam.gserviceaccount.com

      - name: Install gcloud CLI tool
        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
        with:
          version: '>= 397.0.0'

      - name: Install vim for richer alt-screen tests
        if: ${{ matrix.is_self_hosted == false }}
        uses: ConorMacBride/install-package@3e7ad059e07782ee54fa35f827df52aae0626f30 # v1
        with:
          brew: vim
          apt: vim

      - name: Compile tests
        run: cargo nextest run ${{ env.WORKSPACE_TEST_ARGS }} ${{ matrix.extra_test_args }} --no-run
        env:
          # Attach the GitHub auth token so that requests to the GitHub API
          # don't get rate limited during compilation (e.g.: retrieving
          # Sentry SDK binary releases).
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run unit tests
        # Unlike later test steps, only run this if previous steps succeed (so
        # that we don't bother running these first tests if test compilation
        # fails).
        if: success()
        run: cargo nextest run ${{ env.WORKSPACE_TEST_ARGS }} ${{ matrix.extra_test_args }} -E "not package(integration)"
        env:
          # Unit tests may end up spawning a shell, but shouldn't care which
          # shell it is.  We'll use zsh, as it has the shortest bootstrap times
          # and tends to be the most reliable.
          WARP_SHELL_PATH: ${{ steps.echo_default_shell.outputs.default_shell_path }}

      - name: Upload results of unit tests to trunk.io
        # Run this step even when the tests fail. Skip if the workflow is cancelled.
        if: ${{ !cancelled() }}
        continue-on-error: true
        uses: trunk-io/analytics-uploader@95a0fb8b29e45b6068304261fb518644b426a803 # v2.0.8
        with:
          junit-paths: target/nextest/ci/junit.xml
          cli-version: 0.12.5
          org-slug: warp
          token: ${{ secrets.TRUNK_API_TOKEN }}
          tags: type=unit
          variant: ${{ matrix.os }}
          use-cache: true

      - name: Run shell-agnostic integration tests
        # Run this step even if a previous test step fails
        if: matrix.os != 'windows' && (success() || failure())
        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1
        with:
          run: cargo nextest run ${{ env.WORKSPACE_TEST_ARGS }} ${{ matrix.extra_test_args }} -E "package(integration) and not test(shell_integration_tests)"
        env:
          # We run shell-agnostic tests against zsh, as it has the shortest
          # bootstrap times and tends to be the most reliable.
          WARP_SHELL_PATH: ${{ steps.echo_shells_unix.outputs.zsh_path }}

      - name: Upload results of shell-agnostic integration tests to trunk.io
        # Run this step even when the tests fail. Skip if the workflow is cancelled.
        if: ${{ matrix.os != 'windows' && !cancelled() }}
        continue-on-error: true
        uses: trunk-io/analytics-uploader@95a0fb8b29e45b6068304261fb518644b426a803 # v2.0.8
        with:
          junit-paths: target/nextest/ci/junit.xml
          cli-version: 0.12.5
          org-slug: warp
          token: ${{ secrets.TRUNK_API_TOKEN }}
          tags: type=integration,category=shell-agnostic
          variant: ${{ matrix.os }}
          use-cache: true

      - name: Run shell integration tests against default version of bash
        # Run this step even if a previous test step fails
        if: matrix.os != 'windows' && (success() || failure())
        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1
        with:
          run: cargo nextest run ${{ env.WORKSPACE_TEST_ARGS }} ${{ matrix.extra_test_args }} -E "package(integration) and test(shell_integration_tests)"
        env:
          WARP_SHELL_PATH: ${{ steps.echo_shells_unix.outputs.default_bash_path }}

      - name: Upload results of shell integration tests against default version of bash to trunk.io
        # Run this step even when the tests fail. Skip if the workflow is cancelled.
        if: ${{ matrix.os != 'windows' && !cancelled() }}
        continue-on-error: true
        uses: trunk-io/analytics-uploader@95a0fb8b29e45b6068304261fb518644b426a803 # v2.0.8
        with:
          junit-paths: target/nextest/ci/junit.xml
          cli-version: 0.12.5
          org-slug: warp
          token: ${{ secrets.TRUNK_API_TOKEN }}
          tags: type=integration,category=bash-default
          variant: ${{ matrix.os }}
          use-cache: true

      - name: Run shell integration tests against latest version of bash
        # Run this step even if a previous test step fails.
        # We only run this on MacOS since the default Bash version on Mac
        # was released in 2007. Most Linux distros ship with a relatively
        # new (version 5.0+) version of Bash.
        if: (success() || failure()) && runner.os == 'macos'
        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1
        with:
          run: cargo nextest run ${{ env.WORKSPACE_TEST_ARGS }} ${{ matrix.extra_test_args }} -E "package(integration) and test(shell_integration_tests)"
        env:
          WARP_SHELL_PATH: ${{ steps.echo_shells_unix.outputs.latest_bash_path }}

      - name: Upload results of shell integration tests against latest version of bash to trunk.io
        # Run this step even when the tests fail. Skip if the workflow is cancelled.
        if: ${{ matrix.os != 'windows' && !cancelled() }}
        continue-on-error: true
        uses: trunk-io/analytics-uploader@95a0fb8b29e45b6068304261fb518644b426a803 # v2.0.8
        with:
          junit-paths: target/nextest/ci/junit.xml
          cli-version: 0.12.5
          org-slug: warp
          token: ${{ secrets.TRUNK_API_TOKEN }}
          tags: type=integration,category=bash-latest
          variant: ${{ matrix.os }}
          use-cache: true

      - name: Run shell integration tests against fish
        # Run this step even if a previous test step fails
        if: matrix.os != 'windows' && (success() || failure())
        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1
        with:
          run: cargo nextest run ${{ env.WORKSPACE_TEST_ARGS }} ${{ matrix.extra_test_args }} -E "package(integration) and test(shell_integration_tests)"
        env:
          WARP_SHELL_PATH: ${{ steps.echo_shells_unix.outputs.fish_path }}

      - name: Upload results of shell integration tests against fish to trunk.io
        # Run this step even when the tests fail. Skip if the workflow is cancelled.
        if: ${{ matrix.os != 'windows' && !cancelled() }}
        continue-on-error: true
        uses: trunk-io/analytics-uploader@95a0fb8b29e45b6068304261fb518644b426a803 # v2.0.8
        with:
          junit-paths: target/nextest/ci/junit.xml
          cli-version: 0.12.5
          org-slug: warp
          token: ${{ secrets.TRUNK_API_TOKEN }}
          tags: type=integration,category=fish
          variant: ${{ matrix.os }}
          use-cache: true

      - name: Run shell integration tests against zsh
        # Run this step even if a previous test step fails
        if: matrix.os != 'windows' && (success() || failure())
        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1
        with:
          run: cargo nextest run ${{ env.WORKSPACE_TEST_ARGS }} ${{ matrix.extra_test_args }} -E "package(integration) and test(shell_integration_tests)"
        env:
          WARP_SHELL_PATH: ${{ steps.echo_shells_unix.outputs.zsh_path }}

      - name: Upload results of shell integration tests against zsh to trunk.io
        # Run this step even when the tests fail. Skip if the workflow is cancelled.
        if: ${{ matrix.os != 'windows' && !cancelled() }}
        continue-on-error: true
        uses: trunk-io/analytics-uploader@95a0fb8b29e45b6068304261fb518644b426a803 # v2.0.8
        with:
          junit-paths: target/nextest/ci/junit.xml
          cli-version: 0.12.5
          org-slug: warp
          token: ${{ secrets.TRUNK_API_TOKEN }}
          tags: type=integration,category=zsh
          variant: ${{ matrix.os }}
          use-cache: true

      - name: Run shell integration tests against powershell
        # Run this step even if a previous test step fails
        if: matrix.os != 'windows' && (success() || failure())
        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1
        with:
          run: cargo nextest run ${{ env.WORKSPACE_TEST_ARGS }} ${{ matrix.extra_test_args }} -E "package(integration) and test(shell_integration_tests)"
        env:
          WARP_SHELL_PATH: ${{ steps.echo_shells_unix.outputs.powershell_path }}

      - name: Upload results of shell integration tests against powershell to trunk.io
        # Run this step even when the tests fail. Skip if the workflow is cancelled.
        if: ${{ matrix.os != 'windows' && !cancelled() }}
        continue-on-error: true
        uses: trunk-io/analytics-uploader@95a0fb8b29e45b6068304261fb518644b426a803 # v2.0.8
        with:
          junit-paths: target/nextest/ci/junit.xml
          cli-version: 0.12.5
          org-slug: warp
          token: ${{ secrets.TRUNK_API_TOKEN }}
          tags: type=integration,category=powershell
          variant: ${{ matrix.os }}
          use-cache: true

      # Run doctests explicitly, as nextest doesn't yet support running them.
      # See: https://github.com/nextest-rs/nextest/issues/16
      - name: Run doc tests
        # Run this step even if a previous test step fails
        if: success() || failure()
        run: cargo test ${{ env.WORKSPACE_TEST_ARGS }} ${{ matrix.extra_test_args }} --doc

        # Run warp_completer tests with the "v2" (completions-on-js) flag enabled. We do this to
        # ensure that the v2 completions implementation doesn't regress/rot while it's development
        # is paused.
      - name: Run completions-on-js tests
        # Run this step even if a previous test step fails
        if: matrix.os != 'windows' && (success() || failure())
        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1
        with:
          run: cargo nextest run --locked -p warp_completer --features v2

    # This is longer than we like and temporary until we speed up integration tests
    # The maximum timeout for the entire job is 6 hours:
    # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepstimeout-minutes

  database-migration:
    name: Database Migration (Diesel)
    timeout-minutes: 5
    runs-on: ubuntu-latest
    needs: params
    if: ${{ needs.params.outputs.affects-database-schema == 'true' }}
    steps:
      - name: Checkout sources
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install cargo-binstall
        uses: cargo-bins/cargo-binstall@dc19f1e48450eefe5a29b8da6c6b00a87d730b37 # v1.18.1

      - name: Install diesel_cli
        run: |
          cargo binstall diesel_cli

      - name: Run all migrations on empty file
        run: |
          cp crates/persistence/src/schema.rs old-schema.rs
          diesel migration run --database-url="test.sqlite" --migration-dir="crates/persistence/migrations"

      - name: Regenerate schema and check if it is consistent with the schema at HEAD
        shell: bash
        run: |
          diff -u old-schema.rs <(diesel print-schema --database-url="test.sqlite")

  lints:
    name: Formatting + Clippy (${{ matrix.name }})
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: "macos"
            name: "MacOS"
            runner: ${{ fromJSON(needs.params.outputs.macos-runner) }}
            is_self_hosted: ${{ contains(fromJSON(needs.params.outputs.macos-runner), 'self-hosted') }}
            null_device: "/dev/null"
            clippy_excludes: "--exclude warp_completer"

          - os: "linux"
            name: "Linux"
            # Use a larger (16 core, 64GB ram) runner on Linux to speed up execution time.
            # https://github.com/warpdotdev/warp-internal/settings/actions/runners
            runner: ubuntu-latest-large
            # We don't (yet) have any self-hosted Linux runners.
            is_self_hosted: false
            null_device: "/dev/null"
            clippy_excludes: "--exclude warp_completer"

          - os: "windows"
            name: "Windows"
            runner: windows-latest-large
            # We don't (yet) have any self-hosted Windows runners.
            is_self_hosted: false
            null_device: "NUL"
            clippy_excludes: "--exclude warp_js --exclude command-signatures-v2"
    runs-on: ${{ matrix.runner }}
    needs: params
    #    if: ${{ needs.params.outputs.affects-rust-sources == 'true' }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: ./.github/actions/prepare_environment
        with:
          target_os: ${{ matrix.os }}
          is_self_hosted: ${{ matrix.is_self_hosted }}

      - name: Ensure cargo.lock is up-to-date
        run:
          cargo metadata --locked --format-version=1 > ${{ matrix.null_device }} || (echo "::error::Cargo.lock is out-of-date with Cargo.toml. Run 'cargo check' to update." && exit 1)

      - name: Run cargo fmt
        run: cargo fmt --check

      - name: Run cargo clippy
        shell: bash
        run: |
          set -e
          # On Windows, omit --all-features because pprof and related profiling features don't compile.
          if [ "${{ matrix.os }}" = "windows" ]; then
            cargo clippy --locked --workspace ${{ matrix.clippy_excludes }} --all-targets --tests -- -D warnings
          else
            # TODO(vorporeal): Re-enable the `all-features` flag once we've fixed things.
            cargo clippy --locked --workspace ${{ matrix.clippy_excludes }} --all-targets --tests -- -D warnings
            # Run clippy on warp_completer with default, rather than all features enabled, because there is
            # feature-gated logic for the WIP completions-on-js implementation.
            cargo clippy --locked -p warp_completer --all-targets --tests -- -D warnings
          fi
        env:
          # Attach the GitHub auth token so that requests to the GitHub API
          # don't get rate limited during compilation (e.g.: retrieving
          # Sentry SDK binary releases).
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run clang-format
        if: ${{ matrix.os == 'macos' }}
        run: |
          if [[ ! -d $(brew --prefix clang-format) ]]; then
            brew install clang-format
          fi
          ./script/run-clang-format.py -r --extensions 'c,h,cpp,m' ./crates/warpui/src/ ./app/src/

  general-lint:
    name: Miscellaneous checks
    timeout-minutes: 10
    strategy:
      fail-fast: false
    runs-on: ubuntu-latest
    needs: params
    steps:
      - name: Checkout sources
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          # Only cache runs on the master branch (caches on feature branches
          # are not reusable).
          save-if: ${{ github.ref == 'refs/heads/master' }}

      - name: Install cargo-binstall
        uses: cargo-bins/cargo-binstall@dc19f1e48450eefe5a29b8da6c6b00a87d730b37 # v1.18.1

      - name: Check licenses for dependencies
        run: |
          cargo binstall --force -y cargo-deny
          # Make sure all of our dependencies use licenses that are compatible with
          # our usage.
          cargo deny -L error check licenses

      - name: Check deny.toml / about.toml license sync
        run: ./script/check_license_config_sync

      - name: Run WGSL formatter
        run: |
          # note: this matches the version used in script/install_cargo_test_deps...
          # if changing here, probably a good idea to change there too to keep dev tools on local ~= CI
          cargo install --git https://github.com/wgsl-analyzer/wgsl-analyzer --tag "2025-06-28" wgslfmt && \
          find . -name "*.wgsl" -exec wgslfmt --check {} +

      - name: Run PSScriptAnalyzer (PowerShell Lint)
        run: ./script/lint_powershell -ci
        shell: pwsh

      - name: Validate repo-sync markers
        uses: warpdotdev/repo-sync/actions/validate-markers@main

  wasm-lint:
    name: Formatting + Clippy (wasm)
    timeout-minutes: 20
    strategy:
      fail-fast: false
    runs-on: ${{ fromJSON(needs.params.outputs.wasm-runner) }}
    needs: params
    steps:
      - name: Compute IS_SELF_HOSTED
        id: is_self_hosted
        run: |
          IS_SELF_HOSTED="${{ contains(fromJSON(needs.params.outputs.wasm-runner), 'self-hosted') }}"
          echo "value=$IS_SELF_HOSTED" >> $GITHUB_OUTPUT

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: ./.github/actions/prepare_environment
        with:
          target_os: wasm
          is_self_hosted: ${{ steps.is_self_hosted.outputs.value }}

      - name: Ensure cargo.lock is up-to-date
        run:
          cargo metadata --locked --format-version=1 >/dev/null || (echo "::error::Cargo.lock is out-of-date with Cargo.toml. Run 'cargo check' to update." && exit 1)

      - name: Run cargo fmt
        run: cargo fmt --check

      - name: Run cargo clippy
        run: |
          cargo clippy --locked --target wasm32-unknown-unknown --profile release-wasm-debug_assertions -- -D warnings

  check-release-compilation:
    name: Verify compilation with release flags (${{ matrix.name }})
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: "macos"
            name: "MacOS"
            runner: ${{ fromJSON(needs.params.outputs.macos-runner) }}
            is_self_hosted: ${{ contains(fromJSON(needs.params.outputs.macos-runner), 'self-hosted') }}
            null_device: "/dev/null"

          - os: "linux"
            name: "Linux"
            # Use a larger (16 core, 64GB ram) runner on Linux to speed up execution time.
            # https://github.com/warpdotdev/warp-internal/settings/actions/runners
            runner: ubuntu-latest-large
            # We don't (yet) have any self-hosted Linux runners.
            is_self_hosted: false
            null_device: "/dev/null"

          - os: "windows"
            name: "Windows"
            runner: windows-latest-large
            # We don't (yet) have any self-hosted Windows runners.
            is_self_hosted: false
            null_device: "NUL"

          - os: "wasm"
            name: "wasm"
            runner: ${{ fromJSON(needs.params.outputs.wasm-runner) }}
            is_self_hosted: ${{ contains(fromJSON(needs.params.outputs.wasm-runner), 'self-hosted') }}
            null_device: "/dev/null"
    runs-on: ${{ matrix.runner }}
    needs: params
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: ./.github/actions/prepare_environment
        with:
          target_os: ${{ matrix.os }}
          is_self_hosted: ${{ matrix.is_self_hosted }}

      - name: Verify compilation with release flags
        shell: bash
        run: |
          if ${{ matrix.os == 'wasm' }}; then
            ./script/wasm/bundle --channel oss --nouniversal --check-only
          else
            ./script/bundle --channel oss --nouniversal --check-only
          fi
        env:
          # Attach the GitHub auth token so that requests to the GitHub API
          # don't get rate limited during compilation (e.g.: retrieving
          # Sentry SDK binary releases).
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # A final job that collects the results of all of the parallel CI jobs and
  # makes sure that all of them pass.
  #
  # This allows us to tell GitHub that the only required check is this "gather"
  # job, simplifying the process of adding and removing jobs to the CI
  # workflow.
  ci-result:
    name: Check CI results
    timeout-minutes: 3
    runs-on: ubuntu-latest
    # Always run this job, as it needs to check the results of all of the other
    # jobs. If we skipped CI checks (e.g. on a draft PR), also skip this one.
    if: ${{ !cancelled() && needs.params.result != 'skipped' }}
    needs:
      - params
      - database-migration
      - tests
      - lints
      - wasm-lint
      - general-lint
      - check-release-compilation
    steps:
      - name: Check CI results
        run: |
          # Convert needs context to JSON and check required jobs
          echo '${{ toJSON(needs) }}' | jq -r '
            # Get all jobs except database-migration
            to_entries | 
            map(select(.key != "database-migration")) |
            .[] |
            if .value.result != "success" then
              "::error::Required job \(.key) failed or was skipped (status: \(.value.result))"
            else
              empty
            end
          ' | {
            if read -r error; then
              echo "$error"
              exit 1
            fi
          }
        
          # Special handling for conditional database-migration job.
          affects_schema="${{ needs.params.outputs.affects-database-schema }}"
          migration_result="${{ needs.database-migration.result }}"
          
          if [[ "$affects_schema" == "true" && "$migration_result" != "success" ]]; then
            echo "::error::Database migration job failed or was skipped when it should have run (status: $migration_result)"
            exit 1
          elif [[ "$affects_schema" != "true" && "$migration_result" != "skipped" ]]; then
            echo "::error::Database migration job should have been skipped but wasn't (status: $migration_result)"
            exit 1
          fi
        
          echo "All jobs completed successfully!"