# Continuous integration — type-check, lint, test, and build on every push
# and pull request. Cloudflare deploy is NOT performed here; that runs via
# Cloudflare's GitHub integration (Workers & Pages → Connect to Git) on
# every push to `main`, which guarantees CF deploys exactly what's in the
# repo at HEAD. This workflow is the gate that protects `main` from broken
# builds.

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Cancel an in-flight run when a new commit is pushed to the same branch —
# saves Actions minutes on rapid pushes. github.workflow / github.ref are
# repo-controlled values, not user input, so safe to interpolate here.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Least-privilege baseline for a public repo: this workflow only reads the
# repo to lint / test / build. It writes nothing back. Explicit permissions
# override the org default which may grant read-write.
permissions:
  contents: read

jobs:
  verify:
    name: Verify (format + lint + type-check + test + build)
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node from .nvmrc
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Format check
        run: npm run format:check

      - name: Lint
        run: npm run lint

      - name: Type-check (Worker + SPA)
        run: npm run type-check

      - name: Run tests
        run: npm test

      - name: Build production bundle
        run: npm run build