name: CI

on:
  push:
    branches:
      - main
    paths-ignore:
      - 'release/version.yaml'
      - 'release/notes.md'
  pull_request:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

jobs:
  changes:
    runs-on: ubuntu-26.04
    timeout-minutes: 5
    permissions:
      contents: read
      pull-requests: read
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
      container: ${{ steps.filter.outputs.container }}
      source_container: ${{ steps.filter.outputs.source_container }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0

      - name: Detect affected checks
        id: filter
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        with:
          # 目录规则取并集，再统一排除说明文档，保留隐藏配置
          predicate-quantifier: some-with-excludes
          filters: |
            backend:
              - '.github/scripts/toolchains.rb'
              - 'deploy/Dockerfile'
              - 'backend/**'
              - 'release/version.yaml'
              - '.github/workflows/ci.yml'
              - '.github/workflows/_quality.yml'
              - '!**/*.md'
            frontend:
              - '.github/scripts/toolchains.rb'
              - 'backend/rust-toolchain.toml'
              - 'deploy/Dockerfile'
              - 'frontend/**'
              - '.github/actions/build-frontend/**'
              - '.github/workflows/ci.yml'
              - '.github/workflows/_quality.yml'
              - '!**/*.md'
            container:
              - 'backend/**'
              - 'frontend/**'
              - 'deploy/**'
              - '.dockerignore'
              - 'release/version.yaml'
              - '.github/actions/verify-container/**'
              - '.github/actions/build-binary/**'
              - '.github/actions/build-frontend/**'
              - '.github/scripts/toolchains.rb'
              - '.github/scripts/package-release.rb'
              - '.github/scripts/release-metadata.rb'
              - '.github/workflows/_container.yml'
              - '.github/workflows/ci.yml'
              - '!**/*.md'
            source_container:
              - 'deploy/Dockerfile'
              - 'deploy/Dockerfile.dockerignore'
              - '.dockerignore'
              - 'backend/**/Cargo.toml'
              - 'backend/Cargo.lock'
              - 'backend/rust-toolchain.toml'
              - 'backend/**/build.rs'
              - 'backend/.cargo/**'
              - 'frontend/package.json'
              - 'frontend/pnpm-lock.yaml'
              - 'frontend/pnpm-workspace.yaml'
              - 'frontend/.npmrc'
              - 'frontend/patches/**'
              - '.github/workflows/_container.yml'
              - '.github/workflows/ci.yml'

  quality:
    needs: changes
    uses: ./.github/workflows/_quality.yml
    with:
      ref: ${{ github.event.pull_request.head.sha || github.sha }}
      run_backend: ${{ needs.changes.outputs.backend == 'true' }}
      # 预构建容器复用同一次前端检查产物，源码 Docker 构建仍独立验证
      run_frontend: ${{ needs.changes.outputs.frontend == 'true' && (needs.changes.outputs.container != 'true' || needs.changes.outputs.source_container == 'true') }}

  container:
    needs: changes
    if: needs.changes.outputs.container == 'true'
    permissions:
      contents: read
      security-events: write
    uses: ./.github/workflows/_container.yml
    with:
      ref: ${{ github.event.pull_request.head.sha || github.sha }}
      source_build: ${{ needs.changes.outputs.source_container == 'true' }}