name: CI

on:
  pull_request:
  # merge queue is required so all commits on target branches trigger this workflow
  # despite lack of the push event trigger here
  merge_group:
    branches:
      - main
      - next
      # merge group rulesets don't allow wildcards so in settings each maintenance branch needs to be added separately
      - "maintenance/v*" # branch rulesets don't support v[0-9]+

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.sha }}
  cancel-in-progress: true

jobs:
  lint-workflows:
    name: Lint workflows
    runs-on: ubuntu-latest
    permissions:
      actions: read # only required in private repos
      security-events: write # allow writing security events
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
        with:
          persona: pedantic
          annotations: true
          advanced-security: false

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: $/.github/actions/ci-setup

      - name: Test
        run: pnpm test

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: $/.github/actions/ci-setup

      - name: Typecheck
        run: pnpm typecheck

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: $/.github/actions/ci-setup

      - name: Format
        run: pnpm format

  ci-ok:
    name: CI OK
    runs-on: ubuntu-latest
    if: always()
    needs: [lint-workflows, test, typecheck, lint]
    steps:
      - name: Exit with error if some jobs are not successful
        run: exit 1
        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}