# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
name: ReScript/Bun CI
on:
  push:
    branches: [main, master]
  pull_request:

# Estate guardrail: scope push to default branches (PR fires once, not
# push+PR) and cancel superseded runs. Safe — read-only PR check.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  actions: read
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7.0.1
      - uses: oven-sh/setup-bun@v2.2.0
        with:
          bun-version: latest

      - name: Bun version
        run: bun --version

      - name: ReScript build
        run: |
          if [ -f bindings/rescript/package.json ]; then
            cd bindings/rescript
            bun install
            bunx --bun rescript || true
          elif [ -f rescript.json ] || [ -f bsconfig.json ]; then
            bun install
            bunx --bun rescript || true
          else
            echo "No ReScript project at repo root; skip"
          fi

  security:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7.0.1
      - uses: oven-sh/setup-bun@v2.2.0
        with:
          bun-version: latest
      - name: Check permissions
        run: |
          grep -rE "allow-run|allow-write|allow-env" . || echo "No dangerous permissions"