ci.yml

name: CI

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main]

# Least-privilege permissions — satisfies CodeQL actions/missing-workflow-permissions (alert #5).
# The job only needs to read the repository contents and upload artifacts;
# no write access is required.
permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  test:
    name: Lint · Typecheck · Tests
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4.2.2

      - name: Setup Node.js
        uses: actions/setup-node@v4.3.0
        with:
          node-version: 20

      - name: Cache npm dependencies
        uses: actions/cache@v4.2.3
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('package.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install dependencies
        run: npm install

      - name: Lint
        run: npx eslint src --max-warnings 0

      - name: Typecheck
        run: npx tsc --noEmit

      - name: Run tests
        run: npm test

      - name: Upload coverage
        if: always()
        uses: actions/upload-artifact@v4.6.2
        with:
          name: coverage
          path: coverage/
          retention-days: 14
          if-no-files-found: ignore