name: First release candidate

on:
  push:
    paths:
      - ".gitea/workflows/release-candidate.yml"
      - "ci/release-candidate-policy.json"
      - "ci/evidence/**"
      - "docs/release-candidate.md"
      - "CHANGELOG.md"
      - "release/**"
      - "api/**"
      - "programs/**"
      - "tests/**"
      - "tools/**"
      - "crates/**"
      - "Cargo.toml"
      - "Cargo.lock"
  pull_request:
    paths:
      - ".gitea/workflows/release-candidate.yml"
      - "ci/release-candidate-policy.json"
      - "ci/evidence/**"
      - "docs/release-candidate.md"
      - "CHANGELOG.md"
      - "release/**"
      - "api/**"
      - "programs/**"
      - "tests/**"
      - "tools/**"
      - "crates/**"
      - "Cargo.toml"
      - "Cargo.lock"
  workflow_dispatch:

env:
  CARGO_BUILD_JOBS: 1
  CARGO_INCREMENTAL: 0
  CARGO_PROFILE_DEV_DEBUG: 0
  CARGO_PROFILE_TEST_DEBUG: 0
  FORCE_SKIA_BINARIES_DOWNLOAD: 1
  OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-release-candidate
  PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-release-candidate/lib/pkgconfig
  LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-release-candidate/lib
  RUSTDOCFLAGS: -D warnings

jobs:
  non-fuzz-release-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: 1.97.1
          components: rustfmt, clippy
      - name: Install every Linux release prerequisite
        run: |
          sudo apt-get update
          sudo apt-get install --yes build-essential clang cmake curl ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev libasound2-dev
          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
      - name: Record source identity without a shipped helper
        run: echo "METACRATE_RUST_COMMIT=$(git rev-parse --verify HEAD)" >>"$GITHUB_ENV"
      - name: Verify generated surfaces, mappings, parity, and milestone inventories
        run: |
          python3 tools/generate_rust_mapping.py --check
          python3 tools/generate_api_shims.py --check
          python3 tools/check_api_coverage.py
          python3 tools/check_test_parity.py
          python3 tools/generate_lsl_tables.py --check
          python3 tools/check_milestone_09.py
          python3 tools/check_milestone_10.py
      - name: Format, compile, test, lint, and document the complete workspace
        run: |
          cargo fmt --all -- --check
          cargo check --workspace --all-targets --all-features --locked -j 1
          cargo test --workspace --all-features --locked -j 1
          cargo clippy --workspace --all-targets --all-features --locked -j 1 -- -D warnings
          cargo doc --workspace --all-features --no-deps --locked -j 1
      - name: Compile downstream and SemVer consumers
        run: |
          cargo check --locked --manifest-path tests/api-compile/Cargo.toml
          cargo run --locked --manifest-path tests/semver-port/Cargo.toml
      - name: Exercise all offline program and fake-grid behavior
        run: |
          cargo test --locked -p libremetaverse-programs --tests -j 1
          cargo run --locked -p libremetaverse-programs --bin live-grid-smoke -- --audit-only
          cargo run --locked -p libremetaverse-programs --bin live-grid-smoke -- --fake --evidence artifacts/release-candidate/fake-grid-smoke.jsonl
      - name: Revalidate all checked-in audits and checksums
        run: |
          cargo run --locked -p metacrate-ci-matrix -- audit
          cargo run --locked -p metacrate-ci-matrix -- documentation-audit --evidence artifacts/release-candidate/documentation.json
          cargo run --locked -p metacrate-ci-matrix -- dependency-audit --evidence artifacts/release-candidate/dependency.json
          cargo run --locked -p metacrate-ci-matrix -- provenance-audit --evidence artifacts/release-candidate/provenance.json
          sha256sum --check release/SHA256SUMS
      - name: Enforce the aggregate non-fuzz release-candidate decision
        run: cargo run --locked -p metacrate-ci-matrix -- release-candidate-audit --evidence artifacts/release-candidate/status.json
      - name: Upload release-candidate evidence, including failures
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: metacrate-0.0.1-release-candidate
          path: artifacts/release-candidate/
          if-no-files-found: error