name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: '22'
          cache: npm

      # `npm ci` needs the lockfile to match package.json exactly, which is the
      # point: a pull request that changes a dependency has to say so.
      - run: npm ci

      - name: Type check
        run: npx tsc --noEmit

      - name: Tests
        run: npm test

      - name: Build
        run: npm run build

      - name: Secret scan
        run: node scripts/secret-scan.mjs