ci.yml

name: ci

# Lightweight gates on every push and pull request: typecheck + lint + unit
# tests + production build on Node 20, plus full-history secret scanning and a
# workflow self-audit. Playwright e2e, Prettier, and size-limit run locally via
# their npm scripts and are not CI gates.
on:
  push:
    branches: ['**']
  pull_request:

# Cancel superseded runs of the same ref (PRs and branch pushes); a merged
# main push is never cancelled mid-run because each ref has its own group.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != format('refs/heads/{0}', github.event.repository.default_branch) }}

permissions:
  contents: read

jobs:
  # Typecheck + lint + unit tests + production build, in the order a developer
  # runs them locally. One job, one required check context.
  check:
    timeout-minutes: 20
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: '20'
          cache: npm

      - name: Install
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Lint
        run: npm run lint

      - name: Test
        run: npm run test

      - name: Build
        run: npm run build

  # Secrets never land in history: full-history scan on every push/PR. Run as a
  # pinned, checksum-verified CLI (not the marketplace action), so it needs no
  # GitHub Advanced Security and its supply chain is hash-anchored. A non-zero
  # exit means gitleaks found a secret.
  gitleaks:
    timeout-minutes: 10
    runs-on: ubuntu-latest
    env:
      GITLEAKS_VERSION: 8.24.3
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Install gitleaks (pinned, checksum-verified)
        run: |
          set -euo pipefail
          cd "$RUNNER_TEMP"
          base="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}"
          curl -sSLf -o "$base" "$url/$base"
          curl -sSLf -o checksums.txt "$url/gitleaks_${GITLEAKS_VERSION}_checksums.txt"
          grep " $base\$" checksums.txt | sha256sum -c -
          tar -xzf "$base" gitleaks
          sudo install gitleaks /usr/local/bin/gitleaks
          gitleaks version
      - name: Scan full history
        run: gitleaks git --redact --no-banner .

  # Audit the workflows themselves (pwn requests, template injection, cache
  # poisoning, unpinned uses). Run as a digest-pinned CLI image (no SARIF upload
  # to code-scanning). A non-zero exit means a finding.
  zizmor:
    timeout-minutes: 10
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Audit workflows
        run: |
          # zizmor v1.26.1, pinned by digest (the registry publishes version
          # releases under :latest; a raw vX.Y.Z tag does not exist).
          docker run --rm -v "$GITHUB_WORKSPACE:/src:ro" \
            ghcr.io/zizmorcore/zizmor@sha256:d1117e5dbd9ee4970644067b534ab6ab50371f3c6f7f4d05446eb603a6e78f48 \
            --persona regular /src