ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      # Runners have no global Git identity, and tests that let the app create a
      # repository of its own commit into it without a local one to fall back on.
      - name: Give Git an identity
        run: |
          git config --global user.email "ci@example.com"
          git config --global user.name "CI"

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '22'
          cache: npm

      - run: npm ci

      - name: Check (compile + typecheck + lint + format)
        run: npm run check

      - name: Check static (typecheck + lint + dead code + architecture)
        run: npm run check:static

      - name: Install Semgrep
        run: |
          pipx install semgrep
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Test security rules
        run: npm run test:security-rules

      - name: Test (unit with coverage floor, client)
        run: npm run test:ci

      # The coordinator's prompt-delivery path against a real pty. Gated by
      # env locally because it takes ~20s and needs a working shell.
      - name: Test (coordinator against a real pty)
        run: npm run test:coordinator-pty