---
name: PR Actions

on:
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  pr:
    name: PR Actions
    runs-on: ubuntu-latest
    permissions:
      contents: read # checkout the repository
      pull-requests: write # post the yarn.lock changes comment

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Node.js Environment
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: '.nvmrc'

      - name: Cache Node Modules
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache
        with:
          path: node_modules
          # Include .nvmrc so a Node version bump invalidates caches that may
          # contain native modules built against the previous Node ABI.
          key: node-modules-${{ hashFiles('.nvmrc', '**/yarn.lock') }}

      - name: Enable corepack
        id: corepack
        shell: bash
        run: corepack enable

      # Unconditional and immutable: a cache-hit skip used the restored
      # node_modules unchecked, and a plain `yarn install` rewrote a drifted
      # lockfile instead of failing. --mode=skip-build keeps dependency install
      # scripts off the runner.
      - name: Install Dependencies
        run: yarn install --immutable --mode=skip-build

      - name: Yarn Lock Changes
        uses: Simek/yarn-lock-changes@59f47ee499424d2c2437c5aebf863b5c6d50a5bc # v0.14.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}