ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

# The token gets read access and nothing else. Nothing here pushes, comments
# or publishes, so nothing here should be able to.
permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      # Actions are pinned to a commit, not a tag. A tag can be moved to point
      # at anything, and moving one is exactly how tj-actions/changed-files was
      # turned against every workflow that referenced it by tag in March 2025.
      # The comment after each pin is the tag it was taken from.
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      # No `version:` here — package.json's `packageManager` field already
      # pins pnpm, and specifying both makes the action refuse to run.
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          # The board runs .ts unbuilt through type stripping, which needs 24.
          node-version: 24
          cache: pnpm

      # --ignore-scripts because nothing here needs a postinstall, and a
      # dependency that suddenly wants one should fail review, not CI.
      - run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Typecheck
        run: pnpm typecheck

      - name: Test
        run: pnpm test

      - name: Boot the board and check it serves
        run: |
          node packages/db/src/seed.ts
          node apps/server/src/index.ts &
          for i in $(seq 1 40); do
            curl -sf -o /dev/null http://localhost:3000/healthz && break
            sleep 0.5
          done
          curl -sf http://localhost:3000/healthz
          curl -sf -o /dev/null -w '%{http_code}\n' http://localhost:3000/
        env:
          TSBB_DATABASE_URL: file:./data/ci.db
          TSBB_SESSION_SECRET: ci-only-not-a-real-secret
          TSBB_BASE_URL: http://localhost:3000