# GENERATED — do not hand-edit. Source: mgf-standard/templates/woodpecker/
# (base-zig.yml), rendered by `mgf-fed` (mgf.fed._woodpecker).
#
# Codeberg / Woodpecker CI for an MGF-family Zig library. Federation CI shape
# (WORKFLOWS.md WF-*), Zig variant: build + run the inline `test {}` blocks,
# check formatting, scan for secrets. Runs on PRs + default-branch pushes. The
# Zig toolchain is vendored by the `ziglang` PyPI package (no system `zig`), so
# the steps run in plain python:slim.

# The PR pipeline is the required check and runs for every pull request. The
# push pipeline runs ONLY on the default branch (post-merge verification) — NOT
# on feature branches, where it would run concurrently with the PR pipeline on
# the same commit: redundant, and the shared-workspace / container-exec
# contention can kill a step (exit 126 — sooth-proven; PAPER-108/114,
# sooth-standard docs/recipes/ci-onboarding.md).
when:
  - event: push
    branch: main  # the fleet default branch (a repo on another default is a generator param, not a hand-edit — WF-13)
  - event: pull_request
  - event: manual

# Full (non-partial) clone (WF-09 — image pinned). Woodpecker's default treeless
# partial clone (`git fetch --filter=tree:0`) intermittently hits a Codeberg
# HTTP 504 on the lazy promisor tree-fetch, failing the `clone` step before any
# real step runs. A single full fetch has no promisor round-trip.
clone:
  - name: clone
    image: woodpeckerci/plugin-git:2.9.2
    settings:
      partial: false

steps:
  # Build + run the Zig test suite (the `test` step in build.zig).
  - name: zig-build-and-test
    image: python:3.13-slim
    environment:
      CODEBERG_CLONE_TOKEN:
        from_secret: codeberg_clone_token
    commands:
      # PIN↔LOCK coherence (PAPER-108/114; sooth verify_ci check #10, the VAL-08/DET-04
      # analogue): when the repo commits a toolchain.lock, its "version" MUST equal the
      # ziglang pin below — CI must never silently build on a different compiler than the
      # lock pins. The check reads the pin from this pipeline itself (no duplicated
      # literal). No lock committed → noted, not fatal (commit one to bind the pin);
      # mismatch → red.
      - 'if [ -f toolchain.lock ]; then CI_PIN=$(grep -om1 "ziglang==[0-9][0-9.]*" .woodpecker.yml | cut -d= -f3); LOCK_PIN=$(python3 -c "import json; print(json.load(open(\"toolchain.lock\")).get(\"version\"))"); if [ "$CI_PIN" != "$LOCK_PIN" ]; then echo "CI pins ziglang==$CI_PIN but toolchain.lock pins $LOCK_PIN -- the lock is the source of truth (PAPER-108/114)"; exit 1; fi; echo "[ci] ziglang pin $CI_PIN matches toolchain.lock"; else echo "[ci] no toolchain.lock committed -- pin-to-lock coherence unchecked (PAPER-108/114)"; fi'
      - pip install --quiet --retries 8 --timeout 60 "ziglang==0.16.0" || (sleep 10 && pip install --quiet --retries 8 --timeout 60 "ziglang==0.16.0")
      # Private mgf-* Zig deps (build.zig.zon `git+https`) are fetched by `zig build`
      # from the private Codeberg org. Provide a repo-READ token via netrc — the token
      # is a Woodpecker org secret (SC-01: never in the tree), and `git`/ca-certs are
      # the transport zig uses for git+https. All no-ops for leaf repos (no deps).
      - apt-get update -qq && apt-get install -y -qq --no-install-recommends git ca-certificates
      - 'printf "machine codeberg.org\n  login magogi-admin\n  password %s\n" "$CODEBERG_CLONE_TOKEN" > "$HOME/.netrc"'
      - chmod 600 "$HOME/.netrc"
      - python -m ziglang build test --summary all

  # Formatting gate — `zig fmt --check` (rule WF-02 analogue).
  - name: zig-fmt
    image: python:3.13-slim
    commands:
      - pip install --quiet --retries 8 --timeout 60 "ziglang==0.16.0" || (sleep 10 && pip install --quiet --retries 8 --timeout 60 "ziglang==0.16.0")
      - python -m ziglang fmt --check .

  # OPT-IN validator lane (PAPER-108; the sooth VAL-01 analogue — "the definition of
  # done runs in CI, not only locally"). No mgf Zig repo ships a bundle/gate validator
  # today, so the lane ships commented. Enabling it is a template/generator event
  # (WF-13 — never hand-edit a rendered .woodpecker.yml): uncomment here + add a
  # zig-side opt-in gate in mgf.fed._woodpecker when the first validator lands.
  # - name: validate-bundle
  #   image: python:3.13-slim
  #   commands:
  #     - python3 tools/verify_bundle.py .

  # Secret scan (rule SC-01) — gitleaks over the working tree + history.
  - name: secret-scan
    image: zricethezav/gitleaks:v8.30.1
    commands:
      - gitleaks detect --source . --config .gitleaks.toml --no-banner --redact
