name: Lint

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  zizmor:
    name: zizmor
    permissions:
      actions: read
      contents: read
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
        with:
          advanced-security: false
          annotations: true
          version: v1.24.1

  fmt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Rust (nightly)
        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
        with:
          toolchain: nightly
          components: rustfmt

      - name: Check with Rustfmt
        run: cargo fmt --all -- --check

  clippy:
    permissions:
      contents: read
      checks: write # to add clippy checks to PR diffs

    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Rust
        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
        with:
          components: clippy

      - name: Check with Clippy
        uses: giraffate/clippy-action@13b9d32482f25d29ead141b79e7e04e7900281e0 # v1.0.1
        with:
          reporter: github-pr-check
          github_token: ${{ secrets.GITHUB_TOKEN }}
          clippy_flags: >-
            --workspace --all-features --tests --examples --bins --
            -A unknown_lints -D clippy::todo -D clippy::dbg_macro

  lint-docs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Rust (nightly)
        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
        with:
          toolchain: nightly
          components: rust-docs

      - name: Check for broken intra-doc links
        env:
          RUSTDOCFLAGS: -D warnings
        run: cargo +nightly doc --no-deps --workspace --all-features

  check-external-types:
    if: false # rustdoc mismatch currently
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Rust (${{ vars.RUST_VERSION_EXTERNAL_TYPES }})
        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
        with:
          toolchain: ${{ vars.RUST_VERSION_EXTERNAL_TYPES }}

      - name: Install just
        uses: taiki-e/install-action@d9be7d8cda89035c9c843f78bd44d4f72d8403d4 # v2.79.7
        with:
          tool: just

      - name: Install cargo-check-external-types
        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
        with:
          tool: cargo-check-external-types

      - name: check external types
        run: just check-external-types-all +"${RUST_VERSION_EXTERNAL_TYPES}"
        env:
          RUST_VERSION_EXTERNAL_TYPES: ${{ vars.RUST_VERSION_EXTERNAL_TYPES }}