name: CI

on:
  pull_request:
  # merge queue is required so all commits on target branches trigger this workflow
  # despite lack of the push event trigger here
  merge_group:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.sha }}
  cancel-in-progress: true

jobs:
  lint-workflows:
    name: Lint workflows
    runs-on: ubuntu-latest
    permissions:
      actions: read # only required in private repos
      security-events: write # allow writing security events
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
        with:
          persona: pedantic
          annotations: true
          advanced-security: false

  test:
    name: Test
    timeout-minutes: 20
    runs-on: ubuntu-latest

    steps:
      - name: Check out repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/ci-setup

      - name: Test
        run: pnpm test

  typecheck:
    name: Typecheck
    timeout-minutes: 20
    runs-on: ubuntu-latest

    steps:
      - name: Check out repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/ci-setup

      - name: Typecheck
        run: pnpm typecheck

  ci-ok:
    name: CI OK
    runs-on: ubuntu-latest
    if: always()
    needs: [lint-workflows, test, typecheck]
    steps:
      - name: Exit with error if some jobs are not successful
        run: exit 1
        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}