ci.yml

name: Checks

on:
  push:
    branches:
      - main
  pull_request:

# npm install runs dependency code next to the token. This job only reads.
permissions:
  contents: read

concurrency:
  group: checks-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: package.json
          cache: npm

      - name: Install
        run: npm ci

      # The accessibility, changelog, governance and security policy pages are
      # generated from the application repository at build time. Without it they
      # fall back to a link, and the checks below would pass against a site four
      # pages short of the real one.
      - name: Fetch the application repository
        run: git clone --depth 1 https://github.com/SandObserver/stackyard.git "$RUNNER_TEMP/stackyard"

      # sync-widgets.mjs is deliberately not run here. The copies under public/
      # are committed, so the previews do not depend on this checkout.
      - name: Build
        run: npm run build
        env:
          STACKYARD_REPO: ${{ runner.temp }}/stackyard

      - name: Check build output
        run: npm run check