pr-checks.yml

name: PR Checks

on:
  pull_request:
    branches: [dev, staging, main]

jobs:
  frontend-checks:
    name: Frontend Checks
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: TypeScript type check
        run: npx tsc --noEmit

      - name: npm audit
        run: npm audit --audit-level=high

  osv-scan:
    name: Google OSV Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: google/osv-scanner-action/osv-scanner-action@v2
        with:
          scan-args: |-
            --recursive
            .