name: CI

on:
  push:
    branches: ["main"]
  pull_request:

# Least-privilege token: this workflow only reads the repo. Arbitrary
# dependency build code runs during install, so never expose a writable
# token to it (see the supply-chain notes in pyproject.toml).
permissions:
  contents: read

# Cancel superseded runs on the same ref (rapid PR pushes) instead of
# letting them pile up and post stale statuses.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
        with:
          persist-credentials: false

      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
        with:
          version: "0.10.2"
          enable-cache: true

      # `uv sync --locked` installs the exact uv.lock resolution (direct AND
      # transitive deps) and fails if the lock is stale — a bare `pip install`
      # would ignore the lockfile and let transitive versions float, defeating
      # the repo's exact-pin supply-chain policy. Run `uv lock` and commit the
      # lockfile whenever pyproject dependencies change.
      #
      # `--extra api` is required: the REST tests (tests/test_api*.py) import
      # fastapi/uvicorn, which live in the `api` extra — without it pytest fails
      # at collection with ModuleNotFoundError: fastapi.
      - name: Install (locked)
        run: uv sync --locked --extra dev --extra api --python 3.12

      # --no-sync: don't let `uv run` re-sync without the dev extra and
      # uninstall the tools it is about to run.
      - name: Ruff lint
        run: uv run --no-sync ruff check .

      - name: Ruff format check
        run: uv run --no-sync ruff format --check .

      - name: Mypy
        run: uv run --no-sync mypy openkb

      - name: Pytest
        run: uv run --no-sync pytest

  # Build the Workbench SPA so a broken frontend (vite/config error, stale
  # package-lock, JS error) is caught here at PR time rather than only in
  # publish.yml after a release tag is pushed. Mirrors the release build step.
  web:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
        with:
          persist-credentials: false

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
        with:
          node-version: "20"

      - name: Build Workbench web bundle
        working-directory: frontend
        run: |
          npm ci
          npm run build