name: CI

# Security: Do not replace `pull_request` with `pull_request_target` to expose secrets or
# GITHUB_TOKEN write access to PR code. pull_request_target runs untrusted fork PR code with
# base-branch privileges.

on:
  push:
    branches:
      - main
  pull_request:
    types:
      - opened
      - synchronize
      - reopened

env:
  CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

jobs:
  lint:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup node
        uses: actions/setup-node@v6
        with:
          node-version-file: 'package.json'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - run: npm run lint:check

  prettier:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup node
        uses: actions/setup-node@v6
        with:
          node-version-file: 'package.json'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - run: npm run prettier:check

  test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup node
        uses: actions/setup-node@v6
        with:
          node-version-file: 'package.json'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run tests
        run: npm run test:coverage -- --ci --reporters=jest-junit

      - name: Upload tests coverage results
        uses: codecov/codecov-action@v5

  typescript:
    runs-on: ubuntu-latest

    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup node
        uses: actions/setup-node@v6
        with:
          node-version-file: 'package.json'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - run: npm run type:check

  depcheck:
    runs-on: ubuntu-latest

    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup node
        uses: actions/setup-node@v6
        with:
          node-version-file: 'package.json'
          cache: 'npm'

      - name: Restore node_modules
        uses: actions/cache@v5
        id: api-node-modules
        with:
          path: node_modules
          key: ${{ runner.os }}-api-node-modules-${{ hashFiles('package-lock.json') }}-${{ secrets.CACHE_VERSION }}

      - name: Install dependencies
        if: steps.api-node-modules.outputs.cache-hit != 'true'
        run: npm ci --prefer-offline --no-audit

      - run: npm run depcheck