name: ci

# Deliberately not triggered by pull_request.
#
# The forge this runs on is public and takes pull requests from strangers, and a
# runner executes whatever the workflow checks out. Triggering on pull_request
# would mean a stranger's first contribution runs code on the runner host before
# anyone has read it. Triggering only on push means the runner only ever executes
# code that someone with push rights put there.
on:
  push:
    branches: ['**']
  workflow_dispatch:

jobs:
  check:
    # `docker`, not `ubuntu-latest`. The runner registers both labels but only
    # serves this one; a job asking for the other is never claimed at all, and
    # shows up as a run that failed in sixty seconds with an empty log.
    runs-on: docker
    # Pinned, not floating: `cargo fmt --check` is part of the gate and
    # rustfmt's output moves between releases, so a moving image would fail on
    # formatting nobody touched. CI is the authority on which release that is.
    container:
      image: rust:1.98-bookworm

    steps:
      # Not actions/checkout. That is a JavaScript action: the runner executes
      # it with `node` inside this container, and a Rust image carries no node,
      # so the job dies at the first step with "node: executable file not found
      # in $PATH". actions/cache is the same. Cloning by hand costs four lines
      # and keeps the lean image.
      - name: Checkout
        run: |
          git init -q .
          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"
          git fetch -q --depth 1 origin "$GITHUB_SHA"
          git checkout -q FETCH_HEAD

      # check.sh runs the link checker when python3 is there and says it
      # skipped when it is not. In CI it should run.
      - name: Tools the gate uses
        run: |
          apt-get update -qq
          apt-get install -qq -y --no-install-recommends python3 >/dev/null
          rustup component add rustfmt clippy

      - name: Check
        run: ./check.sh