ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

# Cancel superseded runs on the same ref so rapid pushes don't pile up runners.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ── Build + test ─────────────────────────────────────────────────────────
  # The plugin is a TypeScript package: `npm run build` compiles with tsc and
  # the test script then runs Node's built-in runner over the ESM .test.mjs
  # files (which import the compiled dist/). Tests stub global fetch, so this is
  # fully offline — no backend or network needed. node 22 is the shipped runtime
  # (package.json engines: >=22.19.0); no OS matrix is required for a pure-JS
  # package with no native deps.
  test:
    name: Build & test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "22"
          cache: "npm"
      - name: Install
        run: npm ci
      - name: Build
        run: npm run build
      - name: Test (node --test)
        run: node --test tests/*.test.mjs

  # ── Shell script lint ────────────────────────────────────────────────────
  # The repo ships installer + local-test shell scripts. shellcheck is
  # preinstalled on ubuntu-latest; scope to error severity so the gate catches
  # real bugs without failing on stylistic notes.
  shellcheck:
    name: Shellcheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Run shellcheck on all shell scripts
        run: |
          set -euo pipefail
          shellcheck --version
          mapfile -d '' files < <(find . -name '*.sh' \
            -not -path './.git/*' -not -path '*/node_modules/*' -print0)
          if [ ${#files[@]} -eq 0 ]; then
            echo "no shell scripts found"; exit 0
          fi
          printf 'checking: %s\n' "${files[@]}"
          shellcheck --severity=error "${files[@]}"

  # ── Aggregate gate ───────────────────────────────────────────────────────
  # One stable required-status-check context. Fails if any upstream job failed
  # OR was skipped/cancelled, so the job graph can be reshaped without orphaning
  # the required check.
  ci-success:
    name: CI Passed
    if: always()
    needs: [test, shellcheck]
    runs-on: ubuntu-latest
    steps:
      - name: Verify all required jobs succeeded
        run: |
          echo "test=${{ needs.test.result }}"
          echo "shellcheck=${{ needs.shellcheck.result }}"
          [ "${{ needs.test.result }}" = "success" ] \
            && [ "${{ needs.shellcheck.result }}" = "success" ]