ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

# Least privilege: CI only needs to read the repository.
permissions:
  contents: read

# Newer pushes to the same ref supersede in-flight runs.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Core suite across operating systems. The Go version is read from go.mod so
  # the toolchain stays a single source of truth. Differential tests that shell
  # out to ffmpeg/ffprobe skip cleanly here when the tools are absent (see the
  # dedicated `differential` job below for the guaranteed-present gate).
  #
  # Windows runs the full suite, not just a compile: the filesystem semantics the
  # write path depends on (rename over an open handle, directory fsync, the
  # read-only attribute, broken-pipe errnos) differ there in ways only running the
  # tests catches. The race detector needs cgo, and the windows runners ship
  # mingw-w64 gcc, so CGO_ENABLED is pinned rather than left to the default.
  test:
    name: test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    env:
      CGO_ENABLED: 1
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          check-latest: true
      - name: Build
        run: go build ./...
      - name: Vet
        run: go vet ./...
      # release.yml ships a windows/arm64 zip. Nothing else in CI compiles that
      # target, so cross-build it once here; it costs seconds and closes the gap
      # between what is tested and what is released. Ahead of the test step on
      # purpose: as a compile gate it must still report when a test fails, or a
      # broken arm64 build ships behind an unrelated red test.
      - name: Cross-build windows/arm64
        if: matrix.os == 'ubuntu-latest'
        env:
          GOOS: windows
          GOARCH: arm64
          CGO_ENABLED: 0
        run: go build ./...
      - name: Test (race)
        run: go test ./... -race
      # The suite must stay green on 32-bit targets; linux/386 is the cheapest one.
      # CGO_ENABLED=0 avoids needing a 32-bit C toolchain, and the race detector
      # does not support 386, so this is the plain suite. Placed after the race run
      # so the primary suite reports first.
      - name: Test (linux/386)
        if: matrix.os == 'ubuntu-latest'
        env:
          GOARCH: "386"
          CGO_ENABLED: 0
        run: go test ./...

  # The write-side differential is the real proof of interoperability: with
  # ffmpeg/ffprobe guaranteed present, the per-format differential tests run
  # (instead of skipping) and gate the build, so each format's differential is
  # enforced as it ships rather than discovered at v1.0. The differential tests
  # are gated by runtime tool-presence checks (exec.LookPath), matching the
  # committed test pattern; installing ffmpeg here is what flips them on.
  differential:
    name: differential (ffmpeg)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          check-latest: true
      - name: Install ffmpeg
        run: |
          sudo apt-get update
          sudo apt-get install -y ffmpeg
      - name: Verify ffmpeg present
        run: |
          ffmpeg -version
          ffprobe -version
      - name: Test (race, differential suite)
        # Make a missing binary a hard failure here (not a skip), so a broken
        # ffmpeg install can't let the differential gate pass silently green.
        env:
          WAXLABEL_REQUIRE_FFMPEG: "1"
        run: go test ./... -race