name: ci

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      # 固定到 commit SHA（供应链：tag 可被移动，SHA 不可）
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '22'
          cache: npm

      - name: 安装依赖（含 peer：dsh-tools / dsh-llm / cordis）
        run: npm ci

      - name: 供应链审计（生产依赖）
        run: npm audit --omit=dev

      - name: 冒烟（全量守卫）
        run: npm test

      - name: 负向控制（守卫必须能红）
        run: node tools/neg-controls.mjs

      - name: 打包产物与源码一致
        run: |
          npm run build
          git diff --exit-code lib/client.js