# CI: lint → typecheck → unit tests → build → e2e (incl. axe + zero-request).
# Actions are SHA-pinned; no ${{ github.event.* }} is ever interpolated into
# run: blocks (script-injection hygiene). Fork PRs run with a read-only token.
name: CI

on:
  push:
    branches: [main, rebuild/astro]
  pull_request:

permissions:
  contents: read

jobs:
  ci:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - run: pnpm lint
      - run: pnpm format
      - run: pnpm check
      - run: pnpm build
      # tests run after build: the domain-allowlist suite audits dist/
      - run: pnpm test

      - name: Install Playwright chromium
        run: pnpm exec playwright install --with-deps chromium

      - run: pnpm test:e2e

      - name: Upload Playwright report on failure
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 7