name: CI
on:
  push:
    branches:
      - main
      - "feat/**"
      - "fix/**"
  pull_request:
    branches:
      - main

jobs:
  check:
    runs-on: shell
    steps:
      - name: Typecheck, lint, security audit, and test
        run: |
          set -e
          WORK="$(mktemp -d /var/tmp/epicnext-ci.XXXXXX)"
          cleanup() { rm -rf "${WORK}"; }
          trap cleanup EXIT

          echo "--- CI checks (${WORK}) ---"
          git clone --depth 50 \
            /docker/gitea/gitea/git/repositories/remco/epicnext-cms.git \
            "${WORK}"
          cd "${WORK}"

          REF="${{ gitea.sha }}"
          if [ -z "${REF}" ]; then
            echo "ERROR: missing gitea.sha" >&2
            exit 1
          fi
          git fetch --depth 50 origin "${REF}"
          git checkout -f "${REF}"

          export SKIP_ENV_VALIDATION=1
          export ARGON2_MEMORY_SIZE=1024
          export ARGON2_ITERATIONS=1
          export BCRYPT_ROUNDS=4
          pnpm install --frozen-lockfile
          pnpm prisma:generate
          pnpm audit --audit-level=high || echo "WARNING: pnpm audit found high/critical vulnerabilities"
          pnpm biome:lint
          pnpm typecheck
          pnpm test
          echo "--- CI checks passed ---"