name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

# Mirrors the RareDays framework's CI discipline for consumer apps.
# Static template has no vitest test target — verification chain is
# lint / format / style / typecheck / build / storybook only.

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
        with:
          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
      - run: pnpm lint

  format-check:
    name: Format check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
        with:
          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
      - run: pnpm format:check

  style:
    name: Style
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
        with:
          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
      - run: pnpm style

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
        with:
          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
      - run: pnpm theme:build
      - run: pnpm typecheck

  knip:
    name: Knip
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
        with:
          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
      - run: pnpm knip

  build:
    name: Build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
        with:
          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
      - run: pnpm build

  storybook:
    name: Storybook build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
        with:
          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
      - run: pnpm theme:build
      - run: pnpm storybook:build

  # Single aggregation gate — make THIS the only required status check in
  # branch protection so you don't have to enumerate every job (skipped
  # jobs are tolerated by the gate).
  ci-result:
    name: ci-result
    needs: [lint, format-check, style, typecheck, knip, build, storybook]
    if: ${{ !cancelled() }}
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Aggregate CI results
        env:
          NEEDS: ${{ toJson(needs) }}
        run: |
          echo "$NEEDS" | jq -r 'to_entries[] | "\(.key)\t\(.value.result)"'
          failed=$(echo "$NEEDS" | jq -r '
            to_entries[]
            | select(.value.result == "failure" or .value.result == "cancelled")
            | .key')
          if [ -n "$failed" ]; then
            echo "::error::Failed or cancelled jobs: $failed"
            exit 1
          fi
          echo "All required CI jobs passed (or were skipped)."