name: erp-kit Check

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  erp-kit-check:
    runs-on: ubuntu-slim
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: pnpm
          cache-dependency-path: ./pnpm-lock.yaml
          node-version-file: package.json

      - run: pnpm install

      - name: Validate module documentation
        run: pnpm run module:doc:check

      - name: Validate module source-doc correspondence
        run: pnpm run module:doc:sync-check

      - name: Validate app documentation
        run: pnpm run app:doc:check

      - name: Validate app source-doc correspondence
        run: pnpm run app:doc:sync-check

      # Invoked directly, not via `pnpm run`: `erp-kit update` refreshes
      # workflows but not package.json, so a script may be absent in older repos.
      - name: Verify structure and versions
        run: pnpm exec erp-kit verify --modules-root modules --apps-root apps

      - name: Load license policy
        id: license-policy
        run: |
          node <<'EOF'
          const fs = require("node:fs");
          const config = JSON.parse(fs.readFileSync("license.config.json", "utf-8"));
          const lines = [
            `groups=${(config.groups ?? []).join(",")}`,
            `allow=${(config.allow ?? []).join(",")}`,
            `deny=${(config.deny ?? []).join(",")}`,
            `package_exceptions=${JSON.stringify(config.packageExceptions ?? {})}`,
          ];
          fs.appendFileSync(process.env.GITHUB_OUTPUT, `${lines.join("\n")}\n`);
          EOF

      - name: Check licenses
        uses: tailor-platform/actions/check-licenses@43110f4589acc8aca1ee72243ee31c09933d402d # v2.3.1
        with:
          license-groups: ${{ steps.license-policy.outputs.groups }}
          additional-licenses: ${{ steps.license-policy.outputs.allow }}
          denied-licenses: ${{ steps.license-policy.outputs.deny }}
          package-exceptions: ${{ steps.license-policy.outputs.package_exceptions }}