ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '22'
          cache: npm

      - run: npm ci

      - name: Check (compile + typecheck + lint + format)
        run: npm run check

      - name: Check static (typecheck + lint + dead code + architecture)
        run: npm run check:static

      - name: Install Semgrep
        run: |
          pipx install semgrep
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Test security rules
        run: npm run test:security-rules

      - name: Test
        run: npm test