_lint.yml

name: Lint

on:
  workflow_call:
    inputs:
      source-sha:
        required: false
        type: string
        default: ""
      runs-on:
        required: true
        type: string

jobs:
  lint:
    runs-on: ${{ inputs.runs-on }}
    timeout-minutes: 30
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.source-sha || github.sha }}
      - name: Verify checkout SHA
        env:
          EXPECTED_SHA: ${{ inputs.source-sha || github.sha }}
        run: |
          [[ "$EXPECTED_SHA" =~ ^[0-9a-f]{40}$ ]]
          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
            test "$EXPECTED_SHA" = "$GITHUB_SHA"
          fi
          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"

      - uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true
          python-version: "3.11.9"

      - name: Install Python
        run: uv python install "$UV_PYTHON"

      # Must run before setup-soldr: its soldr-cook step builds glib-sys /
      # gobject-sys, which resolve GTK/WebKit through pkg-config. Cooking first
      # fails with exit 101 and every run then compiles those deps cold (#262).
      - name: Install system dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev

      - uses: zackees/setup-soldr@v0.9.62
        id: soldr
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          # No soldr version pin: keep in lockstep with _build.yml so all jobs
          # resolve the same soldr/zccache version and share warm caches
          # (see the pin rationale comment in _build.yml and #158).
          # cache-preset: foundation expands to build-cache: true +
          # target-cache: false + cargo-registry-cache: false +
          # prebuild-deps: soldr-cook (setup-soldr v0.9.17+, #251).
          cache-preset: foundation
          # "-native" matches _build.yml's native-target suffix so lint, test,
          # and native build jobs on the same runner share one cache namespace.
          cache-key-suffix: ${{ inputs.runs-on }}-native
          linker: platform-default
          toolchain-file: rust-toolchain.toml
          # `./lint` runs `soldr cargo clippy --workspace --all-targets`
          # (dev/debug profile). Cook in debug so its prebuilt deps share the
          # compile-cache key with the clippy compile; the default `--release`
          # cook is zero-reuse here and only bloats the build-cache
          # (setup-soldr#235).
          prebuild-deps-flags: ""
          # Native dylint caching: caches cargo-dylint/dylint-link binaries and
          # the dylint driver dir, exposing dylint-cache-hit so we can skip the
          # expensive cargo installs below (#170).
          dylint-cache: true
          dylint-toolchain: nightly-2026-03-26
          cargo-dylint-version: "6.0.3"
          dylint-link-version: "6.0.3"

      - name: Sync Python deps
        run: uv sync --group dev

      # The dylint nightly toolchain must land in the job's RUSTUP_HOME
      # (setup-soldr exports a managed rustup home to all later steps), so use
      # bare rustup here. Routing this through `soldr rustup` installs into
      # soldr's private toolchain home instead, and the dylint driver build
      # then fails with E0463 (can't find crate rustc_driver) because the
      # rustc-dev components are invisible (#170 regression from #172).
      # Unconditional: the nightly is not part of the dylint cache paths.
      - name: Install Dylint nightly toolchain
        run: rustup toolchain install nightly-2026-03-26 --profile minimal --component llvm-tools-preview,rust-src,rustc-dev

      # Building cargo-dylint / dylint-link from source is the dominant fixed
      # cost of every lint job (10+ min per platform). A restored cache should
      # expose both binaries, but verify the commands themselves: a cache hit
      # without a PATH-visible binary must not make the lint job fail.
      - name: Install Dylint tools
        run: |
          DYLINT_VERSION="6.0.3"
          if ! uv run python ci/lint_python/dylint_version_checker.py cargo-dylint "$DYLINT_VERSION"; then
            soldr cargo install cargo-dylint --version "$DYLINT_VERSION" --locked --force
          fi
          if ! command -v dylint-link >/dev/null 2>&1; then
            soldr cargo install dylint-link --version "$DYLINT_VERSION" --locked --force
          fi
          uv run python ci/lint_python/dylint_version_checker.py cargo-dylint "$DYLINT_VERSION"

      - name: Lint
        run: ./lint

      - name: Upload failure logs
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: failure-logs-lint-${{ inputs.runs-on }}
          path: logs/*
          if-no-files-found: warn