ci.yml

name: CI

# Runs on GitHub Actions.
on:
  push:
  pull_request:

# Least privilege: this workflow only reads the repo to type-check, test, and build it.
permissions:
  contents: read

jobs:
  build:
    # Skip the redundant re-run for same-repo PRs. A branch push already ran this
    # exact commit through CI, and branch-protection reads status per head SHA
    # regardless of the triggering event - so a develop->main release PR (or a
    # Dependabot PR into develop) is already validated by its branch's push run.
    # Fork PRs are the exception: a fork branch never fires `push` here, so they
    # still need the pull_request run.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
    # Type-check, test, and build are OS-independent, so a single Linux runner is
    # enough. Pinned to Node 26 (Current release line, Active LTS from October
    # 2026), matching the local toolchain and engines (>=26).
    strategy:
      fail-fast: false
      matrix:
        node: [26]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Node ${{ matrix.node }}
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ matrix.node }}
          cache: npm
      - name: Install dependencies
        run: npm ci
      - name: Type-check
        run: npm run typecheck
      - name: Test
        run: npm test
      - name: Build (multi-file + single-file)
        run: npm run build

  # Stable required-status gate. Branch protection requires only this job, so a
  # Node-matrix bump or a rename of `build` never invalidates the required check.
  ci-success:
    needs: [build]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Verify the build job succeeded
        run: |
          # 'skipped' means a same-repo PR whose head commit the branch push
          # already validated (see the build job's if:) - treat it as a pass so
          # the required ci-success gate still reports green without re-building.
          result="${{ needs.build.result }}"
          if [ "$result" != "success" ] && [ "$result" != "skipped" ]; then
            echo "::error::build job did not succeed (result: $result)"
            exit 1
          fi