ci.yml

name: CI

# Every action is pinned to an immutable commit SHA with the human-readable version
# in a trailing comment. A tag like `@v6` is a moving pointer: whoever controls the
# action repo can re-point it at new code, and it runs here with this workflow's
# token. Dependabot's `github-actions` ecosystem proposes the SHA bumps.
#
# `persist-credentials: false` on checkout: by default it writes the job token into
# `.git/config`, leaving it readable by every later step (including anything a
# dependency's install script does). No job here pushes, so none of them need it.

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  # Superseded pull-request runs are cancelled; runs on main are not, so a push to the
  # default branch always ends up with a completed run rather than a cancelled one.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  lint:
    name: Lint & Type Check
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: 'npm'

      - run: npm ci

      - name: Audit dependencies
        # Gate ALL dependencies (prod + dev) at high severity. Most transitive
        # advisories are pinned to patched versions via `overrides`; the few with no
        # applicable fix are listed, with a reason and a clearing condition, in the
        # gate's ALLOWLIST. The gate also fails on a stale allowlist entry, so an
        # exception cannot outlive its cause.
        run: npm run audit:gate

      - name: Run ESLint
        run: npm run lint

      - name: Run TypeScript type check
        run: npm run typecheck

  test:
    name: Unit Tests
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: 'npm'

      - run: npm ci

      - name: Run tests
        run: npm run test:run

  build:
    name: Build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: 'npm'

      - run: npm ci

      - name: Build
        run: npm run build

      - name: Verify MCP preset dispatch boundary
        run: npx vitest run --config vitest.integration.config.ts src/cli/commands/mcp.conformance.integration.test.ts

      - name: Verify the published tarball contents
        # Runs here rather than in `lint` because it asserts the built entrypoints are
        # present, which needs `dist/`. `files` is an allowlist, so a stray new
        # directory is excluded by default — but widening `files` itself is a one-line
        # diff, and this checks the real `npm pack` manifest rather than the intent.
        run: npm run audit:packlist

      # The Pass-1 extraction worker is loaded by runtime path resolution, and under vitest
      # the .ts entry is always the one resolved — so the COMPILED entry that the npm package
      # actually ships is exercised by no other job. A compile or packaging regression there
      # degrades every installed user to the serial lane silently, so it is checked here,
      # where dist/ exists (change: optimize-parallel-extraction-pool).
      - name: Verify the compiled extraction worker
        run: npx vitest run src/core/analyzer/extraction-pool-threads.test.ts

      - name: Upload build artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist
          path: dist/
          retention-days: 7

  ci-success:
    name: CI Success
    runs-on: ubuntu-latest
    needs: [lint, test, build]
    if: always()
    permissions:
      contents: read
    steps:
      - name: Check all jobs passed
        run: |
          if [[ "${{ needs.lint.result }}" != "success" ]] || \
             [[ "${{ needs.test.result }}" != "success" ]] || \
             [[ "${{ needs.build.result }}" != "success" ]]; then
            echo "One or more required jobs failed"
            exit 1
          fi
          echo "All required jobs passed!"