name: CI

on:
  push:
    branches: [main]
  pull_request:

# Cancel superseded runs of the same branch/PR.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  DOTNET_NOLOGO: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true

jobs:
  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 10.0.x

      # Build/test only the test project and what it references (Core, Fuzz, ServerProbe):
      # the Android head needs a workload and SDK that CI does not provision.
      - name: Restore
        run: dotnet restore tests/PalladiumWallet.Tests

      - name: Build
        run: dotnet build tests/PalladiumWallet.Tests --no-restore -c Release

      # Offline and deterministic: unit, property-based (CsCheck), fuzz-corpus replay and the
      # in-process FakeElectrumServer tests. LiveServerTests is a no-op without
      # PALLADIUM_TEST_SERVERS, so no third-party server is contacted.
      - name: Test
        run: >
          dotnet test tests/PalladiumWallet.Tests --no-build -c Release
          --settings tests/coverage.runsettings
          --logger "trx;LogFileName=test-results.trx"
          --collect:"XPlat Code Coverage"
          --results-directory TestResults
          --blame-hang-timeout 5m --blame-hang-dump-type none

      # Coverage gate (Ubuntu only, one report is enough): fails the job if Core drops below the
      # thresholds. App and Cli are reported but not gated yet.
      - name: Coverage gate
        if: matrix.os == 'ubuntu-latest'
        shell: bash
        run: |
          report=$(ls TestResults/*/coverage.cobertura.xml | head -1)
          python3 tests/check-coverage.py "$report" PalladiumWallet.Core:95:88 PalladiumWallet.App PalladiumWallet.Cli

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results-${{ matrix.os }}
          path: TestResults
          retention-days: 14

  fuzz-smoke:
    name: Fuzz smoke (${{ matrix.target }})
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        target: [header, merkle, slip132, bip39, address, coinamount, walletdoc, encfile, peers]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 10.0.x
      # Random-input smoke run of each untrusted-input parser; any escaping exception fails the job.
      # The coverage-guided campaign (afl++) stays a manual step, see tests/PalladiumWallet.Fuzz/fuzz.sh.
      - name: Fuzz ${{ matrix.target }}
        run: dotnet run -c Release --project tests/PalladiumWallet.Fuzz -- ${{ matrix.target }} --random 20000

  docs:
    name: Docs checks
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - name: Check docs
        run: ./docs/check-docs.sh