# Verification gate for everything that is not a `main` push.
#
# `main` is covered by publish-snapshot.yml, which runs the identical gate
# before it publishes — running both here would just duplicate the work.

name: CI

on:
  pull_request:
  push:
    branches-ignore:
      - main
    tags-ignore:
      - '**'

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    runs-on: ubuntu-latest

    steps:
      - name: Check out
        uses: actions/checkout@v4

      - name: Set up pnpm
        # Version comes from `packageManager` in the root package.json.
        uses: pnpm/action-setup@v4

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc

      - name: Locate the pnpm store
        id: pnpm-store
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore the pnpm store
        # A runner without a cache server should be slow, not broken.
        continue-on-error: true
        uses: actions/cache@v4
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: pnpm-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: pnpm-${{ runner.os }}-

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm run lint:ci

      - name: Typecheck
        run: pnpm run typecheck

      - name: Test with coverage
        # Fails the job below 85% branch coverage — see the `thresholds` block
        # in each package's vitest.config.ts.
        run: pnpm run test:coverage

      - name: Summarise coverage
        # Reporting only — the gate is the step above.
        if: always()
        continue-on-error: true
        run: pnpm run coverage:summary

      - name: Build
        run: pnpm run build

      - name: Check the published file lists
        # Scripts are off because the build already ran; `prepack` would only
        # repeat it. Catches a `files`/`bin` entry that no longer exists.
        run: |
          set -euo pipefail
          for pkg in packages/*/; do
            echo "::group::npm pack $pkg"
            (cd "$pkg" && npm pack --dry-run --ignore-scripts)
            echo "::endgroup::"
          done

      - name: Verify the packed manifests
        # `workspace:*` is mandatory in the manifests but meaningless to npm, so
        # a range that survives into a tarball is an install failure for every
        # consumer. The publish workflows run this too; running it here is what
        # puts the failure on the pull request instead of on the release.
        run: node scripts/verify-pack.mjs

      - name: Upload coverage reports
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@v3
        with:
          name: coverage
          path: packages/*/coverage
          retention-days: 7