name: Axolotl desktop CI

on:
  push:
    branches: [main]
    paths-ignore:
      - 'apps/telemetry-dashboard/**'
      - 'apps/telemetry-worker/**'
  pull_request:
    paths-ignore:
      - 'apps/telemetry-dashboard/**'
      - 'apps/telemetry-worker/**'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  guardrails:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Check immutable database migrations
        env:
          MIGRATION_BASE_REF: ${{ github.event.pull_request.base.sha || github.event.before }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          node scripts/axolotl/check-migrations.mjs --base "${MIGRATION_BASE_REF:-HEAD^}"
          node scripts/axolotl/check-migrations.mjs --release
      - run: node scripts/axolotl/brand-guard.mjs
      - run: node scripts/axolotl/i18n-check.mjs
      - run: cargo fmt --all --check

  desktop:
    needs: guardrails
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, macos-latest, ubuntu-latest]
    runs-on: ${{ matrix.os }}
    env:
      SQLX_OFFLINE: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
      - uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: pnpm
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      - name: Restore Rust dependencies
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          shared-key: desktop-${{ runner.os }}-${{ runner.arch }}
      - name: Set up Rust compiler cache
        id: sccache-setup
        continue-on-error: true
        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
        with:
          version: v0.18.0
      - name: Check Rust compiler cache availability
        id: sccache
        if: steps.sccache-setup.outcome == 'success'
        continue-on-error: true
        shell: bash
        env:
          SCCACHE_GHA_ENABLED: 'true'
        run: '"${SCCACHE_PATH}" "$(rustup which rustc)" -vV'
      - name: Enable Rust compiler cache
        if: steps.sccache.outcome == 'success'
        shell: bash
        run: |
          echo 'RUSTC_WRAPPER=sccache' >> "$GITHUB_ENV"
          echo 'SCCACHE_GHA_ENABLED=true' >> "$GITHUB_ENV"
      - name: Report unavailable Rust compiler cache
        if: steps.sccache-setup.outcome == 'failure' || steps.sccache.outcome == 'failure'
        shell: bash
        run: echo '::warning::Rust compiler cache is unavailable; this build will continue without compiler caching.'
      - if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
      - run: pnpm install --frozen-lockfile
      - name: Install Blockbench skin editor dependencies
        run: npm ci
        working-directory: third-party/blockbench
      - uses: ./.github/actions/replace-gradle-mirror
      - run: pnpm --filter @modrinth/app-frontend build
      - name: Test version metadata writes
        run: cargo test --package theseus writing_version_info_creates_missing_parent_directory
      - run: cargo check --package theseus_gui --features updater
      - name: Build modern Windows installer
        if: runner.os == 'Windows'
        run: pnpm --filter @modrinth/app tauri build --config tauri-release.conf.json --config tauri-modern.conf.json
      - name: Verify modern Windows installer
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $installers = @(Get-ChildItem target/release/bundle/nsis -Filter '*-setup.exe' -File)
          if ($installers.Count -ne 1) {
            throw "Expected one modern NSIS installer, found $($installers.Count)"
          }
          Write-Output "Built modern installer: $($installers[0].Name)"
      - name: Build native NSIS Windows installer
        if: runner.os == 'Windows'
        run: pnpm --filter @modrinth/app tauri build
      - name: Verify native NSIS Windows installer
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $installers = @(Get-ChildItem target/release/bundle/nsis -Filter '*-setup.exe' -File)
          if ($installers.Count -ne 1) {
            throw "Expected one native NSIS installer, found $($installers.Count)"
          }
          Write-Output "Built native NSIS installer: $($installers[0].Name)"
      - name: Show Rust compiler cache statistics
        if: always() && steps.sccache.outcome == 'success'
        continue-on-error: true
        shell: bash
        run: '"${SCCACHE_PATH}" --show-stats'

  website:
    needs: guardrails
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm --filter @axolotl/website build