default:
  image: rust:1.97
  cache:
    key:
      files:
        - Cargo.lock
    paths:
      # no .cargo/bin here: the audit job runs what is in it, and this cache is
      # shared by every branch and merge request, so a pipeline could otherwise
      # leave behind the binary a later scheduled audit executes
      - .cargo/registry
      - target

variables:
  # keep the registry inside the project so it lands in the cache
  CARGO_HOME: $CI_PROJECT_DIR/.cargo
  CARGO_TERM_COLOR: always
  # pinned, rather than whatever version exists on the night this runs
  CARGO_AUDIT_VERSION: "0.21.2"

# without this a push to a branch with an open merge request runs twice
workflow:
  rules:
    # first, because a scheduled pipeline sets CI_COMMIT_BRANCH as well and so
    # would be matched by the branch rule below, or vetoed by the one above it
    - if: $CI_PIPELINE_SOURCE == "schedule"
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
      when: never
    - if: $CI_COMMIT_BRANCH

check:
  script:
    - rustup component add rustfmt clippy
    - cargo fmt --check
    # --locked on the first cargo invocation too: without it clippy resolves the
    # dependencies and rewrites a Cargo.lock that has drifted from Cargo.toml,
    # and the --locked commands after it then pass against what it just wrote
    - cargo clippy --locked --all-targets -- -D warnings
    - cargo test --locked
    - cargo build --release --locked
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: never
    - when: always

# runs only from a pipeline schedule, so set one up in the project settings
audit:
  script:
    - cargo install cargo-audit --version $CARGO_AUDIT_VERSION --locked
    - cargo audit
    # reports dependencies that have drifted behind, without changing the lockfile
    - cargo update --dry-run
  # its own cache, so the audit tool is not rebuilt on every schedule while
  # still being written only by this schedule-only job. the pinned version is
  # part of the key, so a bump fetches rather than reusing the old binary
  cache:
    key: audit-tools-$CARGO_AUDIT_VERSION
    paths:
      - .cargo/bin
      - .cargo/registry
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"

# the msrv declared in Cargo.toml, so it fails when something needs a newer rustc
msrv:
  image: rust:1.85
  script:
    - cargo build --locked
  # its own key: artifacts built by another rustc are of no use to this job, and
  # sharing one only has the two toolchains taking turns overwriting it
  cache:
    key: msrv-$CI_COMMIT_REF_SLUG
    paths:
      - .cargo/registry
      - target
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: never
    - when: always