name: qa

# ── The qa gate: "is this production worth?" ────────────────────────────────
#
# dev -> qa -> main.
#
# `dev` is for committing often. ci.yml answers "is it green" in minutes with
# fmt, clippy and the unit suite, so a mistake surfaces while it is still cheap
# to fix. `qa` is the release-candidate branch, and THIS workflow is the claim
# that a commit is production worth: everything expensive that can run without
# physical media. `main` only ever receives a qa that went green here.
#
# Sibling repos are checked out at `qa`, NOT `dev`. A qa run that resolved its
# dependencies from dev tips would be validating a combination that is not the
# one being released, which is the exact failure this branch exists to prevent.
#
# What this gate CANNOT cover: `disc://` and real `iso://` need physical media,
# and no hosted runner has an optical drive or the image hoard. Those run on a
# self-hosted runner (see the media job at the end) and are the one leg that
# stays on hardware.
on:
  push:
    branches: [qa]
  workflow_dispatch:

jobs:
  # The debug suite runs on every dev push. Release is a DIFFERENT build:
  # overflow checks are off, debug_assert! is compiled out, and inlining
  # changes what the optimiser can prove. A test that only passes in debug is
  # a test that never guarded the binary anyone actually ships.
  release-tests:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
        with:
          path: libfreemkv
      - uses: actions/checkout@v5
        with:
          repository: freemkv/freemkv-unlock
          ref: qa
          path: freemkv-unlock
      - uses: dtolnay/rust-toolchain@1.97.0
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: libfreemkv
      - run: cargo test --release --tests
        working-directory: libfreemkv

  # clippy's output is target-dependent: cfg-gated code only gets linted on
  # the target it compiles for. Linting solely on the dev machine's host
  # target is how a lint that CI rejects reaches a push.
  cross-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          path: libfreemkv
      - uses: actions/checkout@v5
        with:
          repository: freemkv/freemkv-unlock
          ref: qa
          path: freemkv-unlock
      - uses: dtolnay/rust-toolchain@1.97.0
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: libfreemkv
      - run: rustup target add x86_64-unknown-linux-gnu
      - run: cargo clippy --all-targets --target x86_64-unknown-linux-gnu -- -D warnings
        working-directory: libfreemkv