ci.yml

name: CI

# Build verification only — runs on PRs and pushes to main.
# Does NOT deploy. Production deploy is gated on publishing a release
# (see deploy.yml, triggered on `release: published`).
on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version-file: .bun-version

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Gate (typecheck, format, lint, dead-code, tests)
        run: bun run gate

      - name: Secret scan
        run: bun run secrets

      - name: Dependency audit (advisory, non-blocking)
        run: bun run audit || echo "::notice::bun audit reported advisories (non-blocking; Dependabot tracks upstream fixes)"

      - name: Build website
        run: bun run build

      - name: Job summary
        if: always()
        run: |
          bun_version=$(bun --version 2>/dev/null || echo n/a)
          node_version=$(node --version 2>/dev/null || echo n/a)
          astro_version=$(node -p "require('astro/package.json').version" 2>/dev/null || echo n/a)
          pages_built=0
          [ -d dist ] && pages_built=$(find dist -name '*.html' | wc -l | tr -d ' ')
          {
            echo "## 🏗️ Build verification — \`${{ job.status }}\`"
            echo ""
            echo "| Item | Value |"
            echo "| --- | --- |"
            echo "| Bun | $bun_version |"
            echo "| Node | $node_version |"
            echo "| Astro | $astro_version |"
            echo "| Pages built | $pages_built |"
            echo "| Commit | \`${GITHUB_SHA::7}\` |"
          } >> "$GITHUB_STEP_SUMMARY"