ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  # required by go-ci.yml's gosec SARIF upload
  security-events: write

jobs:
  # ─── Go Build & Test ────────────────────────────────────────────────
  # test, lint, verify and security now come from the shared workflow. It
  # probes for Makefile targets per step and falls back to the plain go
  # commands these jobs used to run inline.
  ci:
    uses: xraph/workflows/.github/workflows/go-ci.yml@v1
    with:
      go-versions: '["1.26"]'
      os: '["ubuntu-latest"]'

  # ─── Format Check ──────────────────────────────────────────────────
  format:
    name: Format
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum

      - name: Install goimports
        run: go install golang.org/x/tools/cmd/goimports@latest

      - name: Check formatting (goimports)
        run: |
          OUTPUT=$(goimports -l -local github.com/xraph/shield .)
          if [ -n "$OUTPUT" ]; then
            echo "::error::The following files need goimports formatting:"
            echo "$OUTPUT"
            exit 1
          fi

  # ─── Docs ───────────────────────────────────────────────────────────
  docs:
    name: Docs
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: docs

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Get pnpm store directory
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"

      - name: Cache pnpm
        uses: actions/cache@v5
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-${{ hashFiles('docs/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Type check
        run: pnpm types:check

      - name: Lint
        run: pnpm lint

      - name: Build
        run: pnpm build