ci.yml

# Example caller. Drop this in a consuming repo at `.github/workflows/ci.yml`.
#
# The caller owns the triggers (push/pull_request/schedule/dispatch) and passes
# repo-specific configuration into the reusable workflow. The defaults cover a
# single public crate end to end, including a publish dry run on every PR and
# a tag-gated crates.io publish; only override what your repo actually needs.
name: CI

on:
  pull_request:
  # For repos using a merge queue; harmless otherwise. Merge-queue runs take
  # the comprehensive path (longer fuzz, miri) as the final gate before merge.
  merge_group:
  push:
    branches: [main]
    tags: ['v*']
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
    inputs:
      enable-comprehensive-tests:
        description: 'Run comprehensive test suites (longer fuzz, miri)'
        required: false
        default: false
        type: boolean

# The caller owns the concurrency policy; the reusable workflow defines none
# of its own (a called workflow's concurrency group would deadlock against
# this one).
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  ci:
    uses: luminartech/rust_workflow/.github/workflows/rust-ci.yml@v1
    # Test jobs downscope themselves to read; this grant is only usable by the
    # release path (GitHub release creation).
    permissions:
      contents: write
      # Additionally required when enabling use-release-plz below:
      # pull-requests: write
    secrets:
      cargo-registry-token: ${{ secrets.CARGO_CI_TOKEN }}
      # Optional PAT so release-plz's release PRs trigger CI (PRs opened with
      # the default github.token do not).
      # release-plz-token: ${{ secrets.RELEASE_PLZ_TOKEN }}
    with:
      # Restrict publishing to the canonical repo so forks never publish.
      publish-repository: my-org/my_crate
      # Wire the manual dispatch toggle through to the comprehensive path.
      comprehensive-tests: ${{ inputs.enable-comprehensive-tests || false }}
      # Hand versioning, changelogs, tags, and publishing to release-plz
      # instead of the tag-gated release job:
      # use-release-plz: true