ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:
    inputs:
      run_full_phpt:
        description: "Run the full PHPT regression gate"
        required: false
        default: "false"
        type: choice
        options:
          - "false"
          - "true"
      run_quality:
        description: "Run additive Rust quality tooling gates"
        required: false
        default: "false"
        type: choice
        options:
          - "false"
          - "true"
      run_wordpress_performance:
        description: "Run strict WordPress Phrust vs PHP-FPM/OPcache gate"
        required: false
        default: "false"
        type: choice
        options:
          - "false"
          - "true"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  rust:
    name: rust workspace
    runs-on: mayflower-k8s-runners
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Nix
        uses: ./.github/actions/setup-nix

      - name: Format
        run: nix develop -c just fmt

      - name: Source integrity
        run: nix develop -c just source-integrity

      - name: Clippy
        run: nix develop -c cargo clippy --workspace --all-targets -- -D warnings

      - name: Test
        run: nix develop -c cargo test --workspace

  quality-fast:
    name: fast quality gate
    runs-on: mayflower-k8s-runners
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Nix
        uses: ./.github/actions/setup-nix

      - name: Run fast quality gate
        run: nix develop -c just quality-fast

  domain-gates:
    name: ${{ matrix.gate }}
    runs-on: mayflower-k8s-runners
    strategy:
      fail-fast: false
      matrix:
        gate:
          - verify-frontend
          - verify-runtime
          - verify-stdlib
          - verify-server
          - verify-performance
          - verify-performance-extended
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Nix
        uses: ./.github/actions/setup-nix

      - name: Build pinned reference PHP
        if: matrix.gate == 'verify-runtime'
        run: |
          nix develop -c just bootstrap-ref
          nix develop -c just build-ref-php

      - name: Run gate
        run: |
          if [[ "${{ matrix.gate }}" == "verify-runtime" ]]; then
            REFERENCE_PHP="$PWD/third_party/php-src/sapi/cli/php" nix develop -c just verify-runtime
          else
            nix develop -c just ${{ matrix.gate }}
          fi

      - name: Upload gate reports
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.gate }}-reports
          if-no-files-found: ignore
          path: |
            target/**/*.json
            target/**/*.md
            target/**/*.txt
            target/frontend-snapshots/**
            target/runtime-diff/**

  phpt-smoke:
    name: phpt smoke
    runs-on: mayflower-k8s-runners
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Nix
        uses: ./.github/actions/setup-nix

      - name: Test PHPT tooling
        run: nix develop -c just ci-phpt-smoke

      - name: Upload PHPT smoke reports
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: phpt-smoke-reports
          if-no-files-found: ignore
          path: target/phpt-work/ci/**

  sonarqube:
    name: sonarqube
    needs:
      - rust
      - quality-fast
      - domain-gates
      - phpt-smoke
    if: ${{ always() }}
    uses: ./.github/workflows/reusable-sonar.yml
    with:
      run_coverage: true
    secrets: inherit

  quality:
    name: rust quality
    runs-on: mayflower-k8s-runners
    if: github.event_name == 'workflow_dispatch' && inputs.run_quality == 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Nix
        uses: ./.github/actions/setup-nix

      - name: Run quality gates
        run: nix develop -c just quality

  full-phpt:
    name: full phpt regression
    runs-on: mayflower-k8s-runners
    if: github.event_name == 'workflow_dispatch' && inputs.run_full_phpt == 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Nix
        uses: ./.github/actions/setup-nix

      - name: Bootstrap pinned php-src
        run: nix develop -c just bootstrap-ref

      - name: Build VM CLI
        run: nix develop -c cargo build -p php_vm_cli --bin php-vm

      - name: Run full PHPT regression
        run: PHPT_RUN_FULL=1 nix develop -c just phpt-full-regression

      - name: Upload full PHPT reports
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: full-phpt-reports
          if-no-files-found: ignore
          path: |
            target/phpt-work/full-runs/**
            docs/phpt/reports/full-baseline.md

  wordpress-performance:
    name: WordPress Phrust vs PHP-FPM performance
    runs-on: mayflower-k8s-runners
    if: github.event_name == 'workflow_dispatch' && inputs.run_wordpress_performance == 'true'
    env:
      PHRUST_WORDPRESS_DIR: ${{ vars.PHRUST_WORDPRESS_DIR }}
      PHRUST_WORDPRESS_DB_IDENTITY: ${{ vars.PHRUST_WORDPRESS_DB_IDENTITY }}
      PHRUST_WORDPRESS_HOST_HEADER: ${{ vars.PHRUST_WORDPRESS_HOST_HEADER }}
      PHRUST_WORDPRESS_ROOT_BASELINE_JSON: ${{ vars.PHRUST_WORDPRESS_ROOT_BASELINE_JSON }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Nix
        uses: ./.github/actions/setup-nix

      - name: Build pinned PHP-FPM reference image
        run: nix develop -c just wordpress-reference-image

      - name: Run strict clean gate
        run: nix develop -c just wordpress-root-regression-gate

      - name: Upload WordPress performance report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: wordpress-performance
          if-no-files-found: error
          path: target/performance/wordpress-root/**