name: CI

on:
  pull_request:
    branches: ["**"]

jobs:
  check:
    name: nix flake check
    runs-on: [hive-ci]
    # Bound the job so a wedged build fails in minutes instead of
    # hanging until the runner's 3h cap (or, when the runner itself
    # deadlocks, never). 30 min is well above a cold-cache rebuild
    # (~15 min observed) and well under the 3h hard cap — tune if a
    # legit cold build ever trips it.
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v3
      - name: check
        # Runs all flake checks: formatting (treefmt+rustfmt), cargo test,
        # cargo clippy, and module evaluation. No --no-build: the checks
        # derivations are the canonical source of truth.
        run: nix flake check

  tracker-tags:
    name: tracker-tag lint
    runs-on: [hive-ci]
    # Pure git+grep — seconds normally; a few minutes is already a hang.
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v3
      - name: lint
        # Flags hash-number tracker tags in source (hive convention is
        # prose, not tags — /knowledge/hive-rules.md). Runs as its own
        # job, kept out of the required checks while the legacy backlog
        # is cleaned up: a hit fails this check (red) without blocking
        # merge. Promote to a required check once the tree is clean.
        # See scripts/check-issue-refs.sh.
        run: sh scripts/check-issue-refs.sh