name: CI

on:
  push:
    branches: [main, master]
  pull_request:

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node: [18, 20, 22]
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js ${{ matrix.node }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: npm

      - name: Install CJK fonts (for Chinese PDF tests)
        run: sudo apt-get update && sudo apt-get install -y fonts-wqy-zenhei

      - name: Install dependencies
        run: npm ci

      - name: Build (tsc)
        run: npm run build

      - name: Run tests
        run: npm test

      # 只读复刻 DSH STORE 的固定源自动策略。0.2.0 起必须是零确定性原因：
      # 一旦有人重新引入运行依赖、直接文件访问、环境变量读取或凭据记号，这里就会失败，
      # 而不是等八小时后被商城判为 blocked。网络不可用时窗口会退回到快照值，
      # 但退出码只看自动策略原因，不会因网络抖动误报。
      - name: DSH STORE fixed-source policy gate
        run: npm run verify:publish-policy

      - name: Verify lib/ is up to date
        run: |
          git diff --exit-code -- lib/ || {
            echo "::error::lib/ 与 src/ 不一致，请先执行 npm run build 并提交编译产物"
            exit 1
          }