ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  actions: read
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run ESLint
        run: npm run lint

      - name: Check Prettier formatting
        run: npm run format

  typecheck:
    name: TypeCheck
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run TypeScript type checking
        run: npm run typecheck

  qlty:
    name: Qlty Check
    runs-on: ubuntu-latest
    timeout-minutes: 3

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Install qlty
        uses: qltysh/qlty-action/install@141b881236146435192435eb7b0e06ea0b70b4d9

      - name: Run qlty check
        run: qlty check

      - name: Run qlty code smells analysis
        run: qlty smells

  build:
    name: Build & Test
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: |
          npm ci --prefer-offline --no-audit
          # Verify Tailwind CSS native modules are installed for Linux (npm optional deps bug)
          # See: https://github.com/npm/cli/issues/4828
          node -e "try { require('lightningcss'); } catch { process.exit(1); }" 2>/dev/null || npm install lightningcss-linux-x64-gnu
          node -e "try { require('@tailwindcss/oxide'); } catch { process.exit(1); }" 2>/dev/null || npm install @tailwindcss/oxide-linux-x64-gnu

      - name: Compile TypeScript
        run: npm run compile

      - name: Run tests
        run: npm test
        env:
          VSC_JUPYTER_INSTRUMENT_CODE_FOR_COVERAGE: true

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v5
        with:
          use_oidc: true
          files: coverage/lcov.info
          fail_ci_if_error: true

      - name: Upload test results to Codecov
        if: '!cancelled()'
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v5
        with:
          use_oidc: true
          files: test-results.xml
          fail_ci_if_error: true
          report_type: test_results

      - name: Check dependencies
        run: npm run checkDependencies
        continue-on-error: true

      - name: Check licenses
        run: npm run check-licenses

  check_licenses:
    name: Check Licenses
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci

      - name: Check Licenses
        run: npm run check-licenses

  spell-check:
    name: Spell Check
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run spell check
        run: npm run spell-check

  package-lock-drift-check:
    name: Package Lock Drift Check
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm install

      - name: Check package lock drift
        run: |
          git diff --exit-code HEAD

  audit-prod:
    name: Audit - Production
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run audit for production dependencies
        # Uses better-npm-audit with .nsprc exceptions file
        run: npx better-npm-audit audit --production

  audit-all:
    name: Audit - All
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run audit for all dependencies
        # Uses better-npm-audit with .nsprc exceptions file
        run: npx better-npm-audit audit