name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  core:
    name: core (node ${{ matrix.node }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node: ['22.13.x', '24.x', '26.x']
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}

      - name: Install from lockfile
        run: npm ci

      - name: Check workspace versions
        run: npm run check:workspace-versions

      - name: Typecheck core
        run: npm run typecheck --workspace=@codeburn/core

      - name: Test core
        run: npm test --workspace=@codeburn/core

      - name: Build core
        run: npm run build --workspace=@codeburn/core

      - name: Verify every export target exists
        run: npm run verify-dist --workspace=@codeburn/core

      - name: Verify package contents
        run: npm pack --workspace=@codeburn/core --dry-run

  cli:
    name: cli (node ${{ matrix.node }})
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        node: ['22.13.x', '24.x']
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}

      - name: Check workspace versions
        run: npm run check:workspace-versions

      - name: Install from lockfile
        run: npm ci

      - name: Build core
        run: npm run build --workspace=@codeburn/core

      - name: Test cli
        run: npm test --workspace=codeburn

  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Semgrep
        run: pip install semgrep

      - name: Run Semgrep bracket-assign guard
        run: |
          set -e
          semgrep --config .semgrep/rules/no-bracket-assign-hot-paths.yml \
            --strict --json \
            packages/cli/src/providers/ packages/cli/src/parser.ts packages/core/src/providers/ > semgrep-out.json
          SCANNED=$(jq '.paths.scanned | length' semgrep-out.json)
          if [ "$SCANNED" -eq 0 ]; then
            echo "::error::semgrep scanned no files — the rule's paths.include no longer matches any scan target; check .semgrep/rules/no-bracket-assign-hot-paths.yml"
            exit 1
          fi
          FINDINGS=$(jq '.results | length' semgrep-out.json)
          if [ "$FINDINGS" -gt 0 ]; then
            jq -r '.results[] | "::error file=\(.path),line=\(.start.line)::\(.extra.message)"' semgrep-out.json
            exit 1
          fi