name: CI

on:
  pull_request:
  push:
    branches:
      - main
    tags:
      - v*
  workflow_dispatch:

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    name: Verify stand-alone build
    runs-on: ubuntu-latest
    timeout-minutes: 25
    env:
      CI: true
      PUPPETEER_SKIP_DOWNLOAD: true
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 26
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Enforce dependency security policy
        run: npm run security:audit

      - name: Lint source files
        run: npm run lint

      - name: Run repository tests
        run: npm run test:ci

      - name: Build TypeScript output
        run: npm run build

      - name: Smoke-test stand-alone entrypoints
        run: |
          NODE_ENV=dry-run node ./build/stand-alone/crawl.js
          NODE_ENV=dry-run node ./build/stand-alone/search.js
          NODE_ENV=dry-run node ./build/stand-alone/serp.js

  validate-container:
    name: Validate container build
    runs-on: ubuntu-latest
    needs: verify
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Prepare licensed assets
        run: node ./scripts/prepare-licensed-assets.cjs

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build container image without publishing
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
        with:
          context: .
          push: false